Re: Spamassassin not doing blacklist lookups

2005-11-18 Thread Robert S

Robert S [EMAIL PROTECTED] wrote in message 
news:[EMAIL PROTECTED]
 Don't know if this is of any help, but a lot of DNS tests seem to timeout:

Think I've got it fixed.  Changed settings in /etc/resolv.conf.  Might give 
djbdns a go sometime.  I think our broadband router is doing funny things 
with DNS. 




-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]



Re: Spamassassin not doing blacklist lookups

2005-11-18 Thread Mark Crean

Adam Hardy wrote:


[snip]


sorry if this is a dumb question, but your email implies spam-assassin 
does DNS look-ups to filter out spam - which is not what I thought 
after giving spam assassin the once-over check-out. Is it so? What 
level of effectiveness does it have?


And can it actually filter your pop3 server's inbox before download?



I am using DNS and DCC checking here with spamassassin. Also with the 
rules du jour additions which update blacklist files a couple of times 
a week. The results after three months or so are 100% spam-catching and 
no false positives, though I did start out with a well-trained bayes db. 
The nice aspect of this is that I can now blackhole spam mail with a 
score of more than, say, 15 without having to worry about losing genuine 
mails.


However, this is just on a home set-up with +/- 400 mails a day, mostly 
from mailing lists. Since each email has to be checked online, so to 
speak, things do slow down and if traffic on the net is heavy it can 
take up to around 5 seconds for SA to check each email. For only a few 
emails, this doesn't matter but if you had thousands it would be very 
hard, I imagine. Even so, this has provided the missing ingredient 
that's turned spam filtering from so-so to very good.


I don't know the answer to your second question as I run exim4 as my own 
mailserver, so everything gets downloaded before handing off to SA. 
Doesn't sound very likely, though.


:)

Fish


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]




Re: Spamassassin not doing blacklist lookups

2005-11-16 Thread Mathias Tauber

Don't know if this is of any help, but a lot of DNS tests seem to timeout:

debug: RBL: success for 9 of 17 queries
debug: DNS: timeout for NO_DNS_FOR_FROM after 14 seconds
debug: DNS: timeout for bsp-untrusted after 14 seconds
debug: DNS: timeout for bsp-firsttrusted after 14 seconds
debug: DNS: timeout for spamcop after 14 seconds
debug: DNS: timeout for spamcop after 14 seconds
debug: DNS: timeout for rsl after 14 seconds
debug: DNS: timeout for dsbl-notfirsthop after 14 seconds
debug: DNS: timeout for rsl after 14 seconds


A firewall problem?


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]




Re: Spamassassin not doing blacklist lookups

2005-11-16 Thread Adam Hardy

Robert S on 15/11/05 20:49, wrote:

Don't know if this is of any help, but a lot of DNS tests seem to timeout:

debug: RBL: success for 9 of 17 queries
debug: DNS: timeout for NO_DNS_FOR_FROM after 14 seconds
debug: DNS: timeout for bsp-untrusted after 14 seconds
debug: DNS: timeout for bsp-firsttrusted after 14 seconds
debug: DNS: timeout for spamcop after 14 seconds
debug: DNS: timeout for spamcop after 14 seconds
debug: DNS: timeout for rsl after 14 seconds
debug: DNS: timeout for dsbl-notfirsthop after 14 seconds
debug: DNS: timeout for rsl after 14 seconds




sorry if this is a dumb question, but your email implies spam-assassin 
does DNS look-ups to filter out spam - which is not what I thought after 
giving spam assassin the once-over check-out. Is it so? What level of 
effectiveness does it have?


And can it actually filter your pop3 server's inbox before download?

thanks
Adam


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]




pre-download filtering (was Re: Spamassassin not doing blacklist lookups)

2005-11-16 Thread Jon Dowland
On Wed, Nov 16, 2005 at 07:58:07PM +, Adam Hardy wrote:
 sorry if this is a dumb question, but your email implies spam-assassin
 does DNS look-ups to filter out spam - which is not what I thought
 after giving spam assassin the once-over check-out. Is it so? What
 level of effectiveness does it have?
 
 And can it actually filter your pop3 server's inbox before download?

Not sure about spamassassin in general, but most static rule-based
filters have some rules which are applied to the headers, and some which
are applied to the body. Presumably, in order for there to be an
advantage in filtering before download, you don't want the entire
message fetched and scanned locally, so the filter must be operating on
either just the headers, or a preset number of lines of body too[1].

So, the accuracy of such a filter would be entirely limited to those
rules which were applicable to the headers only, say[2]. Is that really
good enough?


[1] I believe it would have to be a line-based cut-off, due to POP3
protocol restrictions.

[2] These include many of the rules mentioned in this thread
(RECV_IN_SOMERBL, SUBJECT_VIAGRA or whatever)

-- 
Jon Dowland
http://jon.dowland.name/


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]



Spamassassin not doing blacklist lookups

2005-11-15 Thread Robert S
I have installed the default installation of spamassassin on sarge.  I
have recently compared headers from a spam message that was filtered by
my sarge installation (and missed as spam) with the same message
filtered by a Gentoo server (that was correctly identified as spam,
running a default spamassassin installation.

Here are the headers:

Sarge:

X-Spam-Checker-Version: SpamAssassin 3.0.3 (2005-04-27) on
debian.X.net.au
 X-Spam-Level: *
 X-Spam-Status: No, score=1.7 required=5.0 tests=DRUGS_ERECTILE,
RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK autolearn=no version=3.0.3

Gentoo:

X-Spam-Checker-Version: SpamAssassin 3.0.4-gr0 (2005-06-05) on
.X.com.au
 X-Spam-Level: *
 X-Spam-Status: No, score=5.1 required=8.0 tests=DRUGS_ERECTILE,
RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,RCVD_IN_BL_SPAMCOP_NET,
RCVD_IN_NJABL_PROXY,URIBL_SBL autolearn=no version=3.0.4-gr0

As you can see, my Gentoo box has applied blacklist lookups, but my
debian box has not.  The local.cf and init.pre files are identical.

How do I get my Sarge box to do these DNS lookups?  Have I not
installed something?


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]



Re: Spamassassin not doing blacklist lookups

2005-11-15 Thread Mathias Tauber

How do I get my Sarge box to do these DNS lookups?  Have I not
installed something?


Is this package installed?

libnet-dns-perl

Regards
Mathias


--
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]




Re: Spamassassin not doing blacklist lookups

2005-11-15 Thread Robert S
 Is this package installed?

 libnet-dns-perl

Yes - it is installed:

# apt-get install libnet-dns-perl -s
Reading Package Lists... Done
Building Dependency Tree... Done
libnet-dns-perl is already the newest version.
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

Any other ideas? 




-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]



Re: Spamassassin not doing blacklist lookups

2005-11-15 Thread Robert S
Don't know if this is of any help, but a lot of DNS tests seem to timeout:

debug: RBL: success for 9 of 17 queries
debug: DNS: timeout for NO_DNS_FOR_FROM after 14 seconds
debug: DNS: timeout for bsp-untrusted after 14 seconds
debug: DNS: timeout for bsp-firsttrusted after 14 seconds
debug: DNS: timeout for spamcop after 14 seconds
debug: DNS: timeout for spamcop after 14 seconds
debug: DNS: timeout for rsl after 14 seconds
debug: DNS: timeout for dsbl-notfirsthop after 14 seconds
debug: DNS: timeout for rsl after 14 seconds




-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED] 
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]