ipv6 and whitelist_rcvd_from

2007-11-13 Thread Byung-Hee HWANG
the my spamassassin rule is as follow:

whitelist_from_rcvd [EMAIL PROTECTED] mx2.freebsd.org

and here is the recieved header with spamassassin:

Received: by pinus.izb.knu.ac.kr (Postfix, from userid 59)
id 66A1D3ECD; Tue, 13 Nov 2007 17:00:05 +0900 (KST)
X-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on
pinus.izb.knu.ac.kr
X-Spam-Level: 
X-Spam-Status: No, score=-1.8 required=15.1
tests=ALL_TRUSTED,DKIM_SIGNED,
TVD_SPACE_RATIO autolearn=disabled version=3.2.3
X-Spam-Comment: DKIM? See http://www.google.com/search?btnIq=RFC+4871
Received: from mx2.freebsd.org (mx2.freebsd.org
[IPv6:2001:4f8:fff6::35])
by pinus.izb.knu.ac.kr (Postfix) with ESMTP id 75DE43ECB
for [EMAIL PROTECTED]; Tue, 13 Nov 2007 17:00:04 +0900 (KST)

as you can see above, there is no whitelist result. it does not work
anymore, since i enabled ipv6. what can i do for solving this matter?
i'm using 3.2.3 under freebsd.

-- 
You can start by acting like a man. LIKE A MAN!
-- Vito Corleone, Chapter 1, page 36



Re: ipv6 and whitelist_rcvd_from

2007-11-13 Thread Daryl C. W. O'Shea

Byung-Hee HWANG wrote:

as you can see above, there is no whitelist result. it does not work
anymore, since i enabled ipv6. what can i do for solving this matter?


You can go back to using ipv4 or use another whitelist method such as 
whitelist_from_spf/dkim/dk/auth.  Although unless you've got an ipv4 
relay somewhere to delimit your network boundary you may have issues 
with those options as well.  You may have to (if you must stick to ipv6 
for your mail relay) rewrite the relay header (or insert another one) so 
it looks like an ipv4 relay.


Support for ipv6 in SA goes as far as that it will for the most part not 
throw errors if it sees an ipv6 address where it wants an ipv4 address.


There hasn't been any real work done on implementing ipv6 support since, 
AFAIK, none of the SA developers have any real need for it at present. 
It's something I've wanted to implement for a few years now but haven't 
had both the time and tuits to do it at the same time.


Daryl



Re: ipv6 and whitelist_rcvd_from

2007-11-13 Thread Byung-Hee HWANG
hi,

On Tue, 2007-11-13 at 03:22 -0500, Daryl C. W. O'Shea wrote:
 Byung-Hee HWANG wrote:
  as you can see above, there is no whitelist result. it does not work
  anymore, since i enabled ipv6. what can i do for solving this matter?
 
 You can go back to using ipv4 or use another whitelist method such as 
 whitelist_from_spf/dkim/dk/auth.  Although unless you've got an ipv4 
 relay somewhere to delimit your network boundary you may have issues 
 with those options as well.  You may have to (if you must stick to ipv6 
 for your mail relay) rewrite the relay header (or insert another one) so 
 it looks like an ipv4 relay.
 
 Support for ipv6 in SA goes as far as that it will for the most part not 
 throw errors if it sees an ipv6 address where it wants an ipv4 address.
 
 There hasn't been any real work done on implementing ipv6 support since, 
 AFAIK, none of the SA developers have any real need for it at present. 
 It's something I've wanted to implement for a few years now but haven't 
 had both the time and tuits to do it at the same time.

thanks for quick reply, and i solved with whitelist_from instead
whitelist_from_rcvd under ipv6 ;;

respect,
bh

-- 
Never mind being a dance judge, do your job. Take a walk around the
neighborhood and see everything is OK.
-- Peter Clemenza, Chapter 1, page 20



googlepages.com abuse

2007-11-13 Thread ram
I have recently starting seeing spams with URLS contining googlepages
websites 

Currently I am scoring all googlepages.com link mails with 1.5 :-( 
How do you folks trap these mails , And how do we report abuse to google
( if they really bother ) 


Thanks
Ram



Re: Skip SA checks for mails from SA list

2007-11-13 Thread K Anand



Matt Kettler wrote:




As an alternative,  you can use whitelist_from_spf or
whitelist_from_rcvd on the list's return-path. From there, you can
configure shortcircuiting to bypass the rest of SA and bayes_ignore_from
to prevent learning.


Would this be OK

whitelist_from_rcvd [EMAIL PROTECTED]   spamassassin.apache.org



read the doc. I think it should be

whitelist_from_rcvd [EMAIL PROTECTED]  hermes.apache.org

This is what is the rdns for the mail relay that is sending me mails 
from the list.


Anand



Re: Skip SA checks for mails from SA list

2007-11-13 Thread K Anand

K Anand wrote:



Matt Kettler wrote:




As an alternative,  you can use whitelist_from_spf or
whitelist_from_rcvd on the list's return-path. From there, you can
configure shortcircuiting to bypass the rest of SA and bayes_ignore_from
to prevent learning.


Would this be OK

whitelist_from_rcvd [EMAIL PROTECTED]   spamassassin.apache.org



read the doc. I think it should be

whitelist_from_rcvd [EMAIL PROTECTED]  hermes.apache.org

This is what is the rdns for the mail relay that is sending me mails 
from the list.




I tried this but rule is not triggered...So something is wrong. Can 
anyone help ?


Anand


Re: ipv6 and whitelist_rcvd_from

2007-11-13 Thread Byung-Hee HWANG
ah.. sorry.. the subject was wrong..

ipv6 and whitelist_rcvd_from === ipv6 and whitelist_from_rcvd

respect,
bh

On Tue, 2007-11-13 at 17:27 +0900, Byung-Hee HWANG wrote:
 hi,
 
 On Tue, 2007-11-13 at 03:22 -0500, Daryl C. W. O'Shea wrote:
  Byung-Hee HWANG wrote:
   as you can see above, there is no whitelist result. it does not work
   anymore, since i enabled ipv6. what can i do for solving this matter?
  
  You can go back to using ipv4 or use another whitelist method such as 
  whitelist_from_spf/dkim/dk/auth.  Although unless you've got an ipv4 
  relay somewhere to delimit your network boundary you may have issues 
  with those options as well.  You may have to (if you must stick to ipv6 
  for your mail relay) rewrite the relay header (or insert another one) so 
  it looks like an ipv4 relay.
  
  Support for ipv6 in SA goes as far as that it will for the most part not 
  throw errors if it sees an ipv6 address where it wants an ipv4 address.
  
  There hasn't been any real work done on implementing ipv6 support since, 
  AFAIK, none of the SA developers have any real need for it at present. 
  It's something I've wanted to implement for a few years now but haven't 
  had both the time and tuits to do it at the same time.
 
 thanks for quick reply, and i solved with whitelist_from instead
 whitelist_from_rcvd under ipv6 ;;
 
 respect,
 bh
 
-- 
But his ultimate aim is to enter that society with a certain power since
society doesn't really protect its members who do not have their own
individual power.
-- Michael Corleone, Chapter 25, page 363



Re: Skip SA checks for mails from SA list

2007-11-13 Thread Byung-Hee HWANG
On Tue, 2007-11-13 at 14:58 +0530, K Anand wrote:
 K Anand wrote:
  
  Matt Kettler wrote:
 
  
  As an alternative,  you can use whitelist_from_spf or
  whitelist_from_rcvd on the list's return-path. From there, you can
  configure shortcircuiting to bypass the rest of SA and bayes_ignore_from
  to prevent learning.
 
  Would this be OK
 
  whitelist_from_rcvd [EMAIL PROTECTED]   spamassassin.apache.org
 
  
  read the doc. I think it should be
  
  whitelist_from_rcvd [EMAIL PROTECTED]  hermes.apache.org
  
  This is what is the rdns for the mail relay that is sending me mails 
  from the list.
  
 
 I tried this but rule is not triggered...So something is wrong. Can 
 anyone help ?

in my case, the rule works fine.

whitelist_from_rcvd [EMAIL PROTECTED] hermes.apache.org

here is the shot:

Received: by pinus.izb.knu.ac.kr (Postfix, from userid 59)
id E9FE13ECD; Tue, 13 Nov 2007 18:26:07 +0900 (KST)
X-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on
pinus.izb.knu.ac.kr
X-Spam-Level: 
X-Spam-Status: No, score=-37.7 required=15.1
tests=DKIM_SIGNED,DKIM_VERIFIED,
RCVD_IN_DNSWL_MED,USER_IN_WHITELIST autolearn=disabled
version=3.2.3
X-Spam-Comment: DKIM? See http://www.google.com/search?btnIq=RFC+4871
Received: from mail.apache.org (hermes.apache.org [140.211.11.2])
by pinus.izb.knu.ac.kr (Postfix) with SMTP id A7E1F3ECB
for [EMAIL PROTECTED]; Tue, 13 Nov 2007 18:25:58 +0900 (KST)

respect,
bh

-- 
Did you do the job on Sollozzo?
Both of them.
Sure?
I saw their brains.
-- Tessio and Michael Corleone, Chapter 11, page 151



Re: URICountry not working - any clue?

2007-11-13 Thread Byung-Hee HWANG
hi,
 
On Sun, 2007-11-11 at 04:56 -0800, SpankTheSpam wrote:
 Hi
 
 I have installed URICountry plugin along with p5-Mail-SpamAssassin-3.2.3 and
 amavisd-new-2.5.2,1 and have added few rules, and one to test it in my
 local.cf:
[...]

well, imho, its using is not fair to over the world. because there
regarding spam country may/might be a little bit pure email users. we
can use another way instead of the dangerous way. i would like to here
some opinion about that..

respect,
bh

-- 
If by some misfortune an honest man like yourself made enemies they would 
become my enemies and then, believe me, they would fear you.
Be my friend. I accept.
-- Vito Corleone and Amerigo Bonasera, Chapter 1, page 32-33



Re: Skip SA checks for mails from SA list

2007-11-13 Thread K Anand

Byung-Hee HWANG wrote:

On Tue, 2007-11-13 at 14:58 +0530, K Anand wrote:

K Anand wrote:

Matt Kettler wrote:


As an alternative,  you can use whitelist_from_spf or
whitelist_from_rcvd on the list's return-path. From there, you can
configure shortcircuiting to bypass the rest of SA and bayes_ignore_from
to prevent learning.

Would this be OK

whitelist_from_rcvd [EMAIL PROTECTED]   spamassassin.apache.org


read the doc. I think it should be

whitelist_from_rcvd [EMAIL PROTECTED]  hermes.apache.org

This is what is the rdns for the mail relay that is sending me mails 
from the list.


I tried this but rule is not triggered...So something is wrong. Can 
anyone help ?


in my case, the rule works fine.

whitelist_from_rcvd [EMAIL PROTECTED] hermes.apache.org

here is the shot:

Received: by pinus.izb.knu.ac.kr (Postfix, from userid 59)
id E9FE13ECD; Tue, 13 Nov 2007 18:26:07 +0900 (KST)
X-Spam-Checker-Version: SpamAssassin 3.2.3 (2007-08-08) on
pinus.izb.knu.ac.kr
X-Spam-Level: 
X-Spam-Status: No, score=-37.7 required=15.1

tests=DKIM_SIGNED,DKIM_VERIFIED,
RCVD_IN_DNSWL_MED,USER_IN_WHITELIST autolearn=disabled
version=3.2.3
X-Spam-Comment: DKIM? See http://www.google.com/search?btnIq=RFC+4871
Received: from mail.apache.org (hermes.apache.org [140.211.11.2])
by pinus.izb.knu.ac.kr (Postfix) with SMTP id A7E1F3ECB
for [EMAIL PROTECTED]; Tue, 13 Nov 2007 18:25:58 +0900 (KST)



This is what I get 

Return-Path: 
[EMAIL PROTECTED]

Delivered-To: [EMAIL PROTECTED]
Received: (qmail 32150 invoked by uid 89); 13 Nov 2007 09:48:01 -
Received: by simscan 1.2.0 ppid: 32094, pid: 32122, t: 4.4853s
 scanners: attach: 1.2.0 clamav: 0.90/m:42 spam: 3.1.1
X-Spam-Checker-Version: SpamAssassin 3.1.1 (2006-03-10) on sail-steel.com
X-Spam-Level:
X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00
autolearn=unavailable version=3.1.1
Received: from unknown (HELO mail.apache.org) (140.211.11.2)
  by sail-steel.com with SMTP; 13 Nov 2007 09:47:57 -
Received-SPF: pass (sail-steel.com: SPF record at 
spamassassin.apache.org designates 140.211.11.2 as permitted sender)




I think the problem has something to do with this line :

Received: from unknown (HELO mail.apache.org) (140.211.11.2)

Anand


RE: googlepages.com abuse

2007-11-13 Thread Michael Scheidell

 -Original Message-
 From: ram [mailto:[EMAIL PROTECTED] 
 Sent: Tuesday, November 13, 2007 3:33 AM
 To: users@spamassassin.apache.org
 Subject: googlepages.com abuse
 
 
 I have recently starting seeing spams with URLS containing 
 Google pages websites 
 
 Currently I am scoring all googlepages.com link mails with 1.5 :-( 
 How do you folks trap these mails , And how do we report 
 abuse to google ( if they really bother ) 
You can't.  Google ignores complaints, and email to @googlepages.com
will bounce in 5 days due to their refusal to even follow the RFC's and
have a server to receive email.

Change the score to 10 and don't look back.
Let their users have their own isolated piece of the spam infected
world.

-- 
Michael Scheidell, CTO
Office: 561-999-5000 x 1259
Direct: 561-939-7259
Real time security alerts: http://www.secnap.com/news
 
_
This email has been scanned and certified safe by SpammerTrap(tm).
For Information please see http://www.spammertrap.com
_


Re: Is it possible to handle different spamfilters from one .mailfilter

2007-11-13 Thread Matus UHLAR - fantomas
On 12.11.07 18:13, Wolfgang Uhr wrote:
 I've a small problem. We have installed courier mta on our server and we 
 start sa using the command
 
 xfilter /usr/bin/spamassassin
 
 resp.
 
 xfilter /usr/bin/spamc

where do you run that from? The procmailrc/mailfilter?

 If we do this the folder /.spamassassin/ will be created in the first 
 time und will be used in the next calls.

 Now I want to use two different spamfilters for two different users. Is 
 there any parameter to tell spamassassin to use an other folder to store 
 the bayes filter?

spamassassin uses preferences of calling user (or of the user specified by
'-u' flag). Just call SA from different users (or with different -u flags)
and it will be done.
-- 
Matus UHLAR - fantomas, [EMAIL PROTECTED] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Posli tento mail 100 svojim znamim - nech vidia aky si idiot
Send this email to 100 your friends - let them see what an idiot you are


Re: help

2007-11-13 Thread Matus UHLAR - fantomas
On 12.11.07 11:27, Kim Hurlbutt wrote: Wondering if you can point me in the
 right direction on how to make our spam scores lower.  How can I get
 information on how to make edits to our pages to lower our scores?  We
 currently use Kintera to send our email newsletters.  Please help!! 


 Score Details:
  pts rule name  description
  --
  --
  0.2 HTML_FONT_FACE_ODD BODY: HTML font face is not a commonly used
  face
  0.2 HTML_MESSAGE   BODY: HTML included in message
  0.3 HTML_FONT_BIG  BODY: HTML has a big font
  0.6 HTML_TABLE_THICK_BORD  BODY: HTML table has thick border
  0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
  0.7 HTML_50_60 BODY: Message is 50% to 60% HTML
  0.4 FORGED_YAHOO_RCVD  'From' yahoo.com does not match 'Received'
  headers

get normal, correct SW for those newsletters. Nearly all those flags mean
there's something sick in Kintera.
-- 
Matus UHLAR - fantomas, [EMAIL PROTECTED] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
- Have you got anything without Spam in it?
- Well, there's Spam egg sausage and Spam, that's not got much Spam in it.


Re: Skip SA checks for mails from SA list

2007-11-13 Thread Matus UHLAR - fantomas
On 13.11.07 15:52, K Anand wrote:
 This is what I get 
[...]
 I think the problem has something to do with this line :
 
 Received: from unknown (HELO mail.apache.org) (140.211.11.2)

configure your smtp server to add DNS data to Received: line.
*list_from_rcvd doesn't work without list

(although it could be worth adding IP or CIDR check in such cases)

-- 
Matus UHLAR - fantomas, [EMAIL PROTECTED] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Linux - It's now safe to turn on your computer.
Linux - Teraz mozete pocitac bez obav zapnut.


Re: URICountry not working - any clue?

2007-11-13 Thread Matt Kettler
Byung-Hee HWANG wrote:
 hi,
  
 On Sun, 2007-11-11 at 04:56 -0800, SpankTheSpam wrote:
   
 Hi

 I have installed URICountry plugin along with p5-Mail-SpamAssassin-3.2.3 and
 amavisd-new-2.5.2,1 and have added few rules, and one to test it in my
 local.cf:
 
 [...]

 well, imho, its using is not fair to over the world. because there
 regarding spam country may/might be a little bit pure email users. we
 can use another way instead of the dangerous way. i would like to here
 some opinion about that..

   

Uricountry, relaycountry, etc are all quite useful, but I agree their
use must be reasonably tempered.

I strongly disagree with using either of these systems to assign more
than half your spam threshold to any message. Country of origin or
hosting site alone is not a very good sole criteria for declaring a
message to be spam.

However, in my case I do receive a few nonspam messages from Korea each
year, like this message for example, and all are quite clearly nonspam
and technical in nature... I also receive around a thousand spam
messages that were sent from infected hosts in Korea each year (mostly
controlled by American spammers). As a result, I assign 1.5 points (of a
5.0 threshold) to messages delivered to my network from Korea. This
helps catch some of the more evasive spam, but I also have yet to have
it cause a single false positive on a nonspam message. (Your message
would have totaled 1.5/5.0 if it was sent directly, as it caught no
other positive scoring rules)

This is even more true for web hosting. There's no reason an american
company can't have a website hosted overseas. So many of their products
are made there, so why shouldn't the websites be hosted there?

Unfortunately, like any rule, there's a lot of admins out there who
think in absolutes, and assign absurd scores to rules. This is, of
course, highly contrary to the whole design of SpamAssassin, which
exists because Justin got tired of single-criteria decisions for spam
causing false positives. I guess there's a human tendency to see a high
probability and treat that as proof positive. (We all like to
over-simplify things).

I guess I failed to point out to spankthespam that using a 54 point
score on a rule is quite unwise.




Re: URICountry not working - any clue?

2007-11-13 Thread SpankTheSpam



Matt Kettler-3 wrote:
 
 Byung-Hee HWANG wrote:
 hi,
  
 On Sun, 2007-11-11 at 04:56 -0800, SpankTheSpam wrote:
   
 Hi

 I have installed URICountry plugin along with p5-Mail-SpamAssassin-3.2.3
 and
 amavisd-new-2.5.2,1 and have added few rules, and one to test it in my
 local.cf:
 
 [...]

 well, imho, its using is not fair to over the world. because there
 regarding spam country may/might be a little bit pure email users. we
 can use another way instead of the dangerous way. i would like to here
 some opinion about that..

   
 
 Uricountry, relaycountry, etc are all quite useful, but I agree their
 use must be reasonably tempered.
 
 I strongly disagree with using either of these systems to assign more
 than half your spam threshold to any message. Country of origin or
 hosting site alone is not a very good sole criteria for declaring a
 message to be spam.
 
 However, in my case I do receive a few nonspam messages from Korea each
 year, like this message for example, and all are quite clearly nonspam
 and technical in nature... I also receive around a thousand spam
 messages that were sent from infected hosts in Korea each year (mostly
 controlled by American spammers). As a result, I assign 1.5 points (of a
 5.0 threshold) to messages delivered to my network from Korea. This
 helps catch some of the more evasive spam, but I also have yet to have
 it cause a single false positive on a nonspam message. (Your message
 would have totaled 1.5/5.0 if it was sent directly, as it caught no
 other positive scoring rules)
 
 This is even more true for web hosting. There's no reason an american
 company can't have a website hosted overseas. So many of their products
 are made there, so why shouldn't the websites be hosted there?
 
 Unfortunately, like any rule, there's a lot of admins out there who
 think in absolutes, and assign absurd scores to rules. This is, of
 course, highly contrary to the whole design of SpamAssassin, which
 exists because Justin got tired of single-criteria decisions for spam
 causing false positives. I guess there's a human tendency to see a high
 probability and treat that as proof positive. (We all like to
 over-simplify things).
 
 I guess I failed to point out to spankthespam that using a 54 point
 score on a rule is quite unwise.
 
 
 
 

Oh, no, dont worry, I am not those people ;) I set it that high only for
testing purposes to be absolute sure that the plugin and the rule is
working, so I dont have to count all the points and wonder if my -1 was
actually taken or not.

Beside the fact, I am using those two (relay country and uri country) to
add negative points for certain countries (like Poland where most of our
customers reside) rather than to add for all other world.

But the plugins are working now, it seems that it needs amavisd restart to
get new plugins, even if amavisd is calling spamassassin each time the
message comes in.

Thanks a lot for your help.

P.S. Is there any plugin and/or rule that could help me checking if the
sender and recipient addressess were added in RFC - way, that is in 
brackets and add some points if not? 
-- 
View this message in context: 
http://www.nabble.com/URICountry-not-working---any-clue--tf4785757.html#a13730770
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.



Re: URICountry not working - any clue?

2007-11-13 Thread Byung-Hee HWANG
hi,

On Tue, 2007-11-13 at 08:04 -0500, Matt Kettler wrote:
 Byung-Hee HWANG wrote:
  hi,
   
  On Sun, 2007-11-11 at 04:56 -0800, SpankTheSpam wrote:

  Hi
 
  I have installed URICountry plugin along with p5-Mail-SpamAssassin-3.2.3 
  and
  amavisd-new-2.5.2,1 and have added few rules, and one to test it in my
  local.cf:
  
  [...]
 
  well, imho, its using is not fair to over the world. because there
  regarding spam country may/might be a little bit pure email users. we
  can use another way instead of the dangerous way. i would like to here
  some opinion about that..
 

 
 Uricountry, relaycountry, etc are all quite useful, but I agree their
 use must be reasonably tempered.
 
 I strongly disagree with using either of these systems to assign more
 than half your spam threshold to any message. Country of origin or
 hosting site alone is not a very good sole criteria for declaring a
 message to be spam.
 
 However, in my case I do receive a few nonspam messages from Korea each
 year, like this message for example, and all are quite clearly nonspam
 and technical in nature... I also receive around a thousand spam
 messages that were sent from infected hosts in Korea each year (mostly
 controlled by American spammers). As a result, I assign 1.5 points (of a
 5.0 threshold) to messages delivered to my network from Korea. This
 helps catch some of the more evasive spam, but I also have yet to have
 it cause a single false positive on a nonspam message. (Your message
 would have totaled 1.5/5.0 if it was sent directly, as it caught no
 other positive scoring rules)
 
 This is even more true for web hosting. There's no reason an american
 company can't have a website hosted overseas. So many of their products
 are made there, so why shouldn't the websites be hosted there?
 
 Unfortunately, like any rule, there's a lot of admins out there who
 think in absolutes, and assign absurd scores to rules. This is, of
 course, highly contrary to the whole design of SpamAssassin, which
 exists because Justin got tired of single-criteria decisions for spam
 causing false positives. I guess there's a human tendency to see a high
 probability and treat that as proof positive. (We all like to
 over-simplify things).
 
 I guess I failed to point out to spankthespam that using a 54 point
 score on a rule is quite unwise.

your opinion is resonable, thanks!

respect,
bh

-- 
Why do they bother your father with business on a day like this?
Because they know that by tradition no Sicilian can refuse a request on his
daughter's wedding day.
-- Kay Adams and Michael Corleone, Chapter 1, page 26-27



RE: URICountry not working - any clue?

2007-11-13 Thread Bowie Bailey
SpankTheSpam wrote:
 
 But the plugins are working now, it seems that it needs amavisd
 restart to get new plugins, even if amavisd is calling spamassassin
 each time the message comes in.

Amavisd does not call SpamAssassin for each message.  Amavisd
initializes the SpamAssassin libraries when it starts and then uses
those libraries to check each message.  This is basically the same as
the way spamd works.  Any time you make a change to rules or
configuration files, you will need to restart Amavisd.

-- 
Bowie


US Senate as bad internet citizens???

2007-11-13 Thread Philip Prindeville
Well, I recently called my Senator to ask him to support enhanced 
network neutrality legislation (since he worked on the 1998 
Telecommunications Bill).


I received his reply 2 days later by email.  Ok.  I found that there 
were some misconceptions he had about the topic on a purely technical 
basis, and decided to reply to him and set him straight (or more 
appropriately, set the staffer straight that had written the response on 
his behalf).


Well...

The original message was received at Tue, 13 Nov 2007 17:04:21 -0500 (EST)
from localhost [127.0.0.1]

  - The following addresses had permanent fatal errors -
[EMAIL PROTECTED]
   (reason: 550 5.1.1 User unknown)

  - Transcript of session follows -
... while talking to bridgeheadpsq.senate.gov.:


 DATA
  

 550 5.1.1 User unknown
550 5.1.1 [EMAIL PROTECTED]... User unknown
 503 5.5.2 Need Rcpt command.



So I'm wondering... if they send emails out that can't be replied to...  
doesn't that correspond to the very definition of a spammer?  Aren't 
they concealing their identity?


Sigh.

Oh, well.  I knew it was asking too much to have meaningful legislation 
on net neutrality (or digital rights, or copyright reform, etc) come 
from Washington D.C.  Perhaps in 50 years they'll finally have a handle 
on it.


But I dared to hope...

-Philip



Re: US Senate as bad internet citizens???

2007-11-13 Thread Jerry Durand

At 02:22 PM 11/13/2007, Philip Prindeville wrote:

So I'm wondering... if they send emails out that can't be replied to...
doesn't that correspond to the very definition of a 
spammer?  Aren't they concealing their identity?


Sigh.


I just had one of those from my bank.  I asked a question, they 
answered, I replied and it bounced (domain doesn't exist).  I went 
online and said I'd think they could at least get their domain right.


BTW, one thing I found out is checks (at least from this bank) 
expire after 6 months but they'll still cash them at any time in 
the future and we're responsible for covering the funds.  I wonder 
what part of expire they don't understand.  Time to run our business 
checks through the printer to put a void after... notice on them.




--
Jerry Durand, Durand Interstellar, Inc.  www.interstellar.com
tel: +1 408 356-3886, USA toll free: 1 866 356-3886
Skype:  jerrydurand



Re: help

2007-11-13 Thread Philip Prindeville
As a heads up, more people will read your message if you make your 
Subject line more insightful.


Ironically, I contacted Kintera last Spring pointing out that I wasn't 
getting messages from one of their customers because they were sending 
malformed messages that pegged the spam-o-meter (in particular, they 
were sending broken Date: lines).


Didn't hear back.

Apparently, they've never heard of Spam, or have no interest in 
differentiating themselves from less-legitimate content.


Perhaps it's a marketing strategy to sell you more products and services 
to complement the ineffectual ones you're now using.  ;-)


-Philip



Kim Hurlbutt wrote:
Wondering if you can point me in the right direction on how to make 
our spam scores lower.  How can I get information on how to make edits 
to our pages to lower our scores?  We currently use Kintera to send 
our email newsletters.  Please help!!   Thanks
 
An example of our spam score:
 
Your spam score is: 2.9 points


Score Details:
pts rule name  description
 --
--
0.2 HTML_FONT_FACE_ODD BODY: HTML font face is not a commonly used
face
0.2 HTML_MESSAGE   BODY: HTML included in message
0.3 HTML_FONT_BIG  BODY: HTML has a big font
0.6 HTML_TABLE_THICK_BORD  BODY: HTML table has thick border
0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.7 HTML_50_60 BODY: Message is 50% to 60% HTML
0.4 FORGED_YAHOO_RCVD  'From' yahoo.com http://yahoo.com/ does 
not match 'Received'

headers


  Kim Hurlbutt
  Development
   Proctor Academy
  603.735.6218
www.proctoracademy.org http://www.proctoracademy.org 




Re: googlepages.com abuse

2007-11-13 Thread Bart Schaefer
On Nov 13, 2007 3:32 AM, Michael Scheidell [EMAIL PROTECTED] wrote:

  How do you folks trap these mails , And how do we report
  abuse to google ( if they really bother )
 You can't.  Google ignores complaints, and email to @googlepages.com
 will bounce in 5 days due to their refusal to even follow the RFC's and
 have a server to receive email.

Er, which RFC are you claiming requires them to have a server to receive mail?

In any case I inquired of an acquaintance who works at Google and got
this response to the question of how do we report abuse:

Web link: http://www.google.com/support/pages/bin/request.py
with links there for spam, phishing, scumware, etc.

Email links get too heavily spammed so the one contact address which has
leaked gets a push-back mail to use the web form.  All complaints are
acted upon quickly but no individual replies are sent.  Quickly here is
in practice within one business day (but I don't believe that there's a
formal commitment to this).

Any evidence that a complaint has been ignored would be interesting to
see; ultimately, is the page still up? is the check.


Re: Skip SA checks for mails from SA list

2007-11-13 Thread K Anand

Matus UHLAR - fantomas wrote:

On 13.11.07 15:52, K Anand wrote:


Received: from unknown (HELO mail.apache.org) (140.211.11.2)


configure your smtp server to add DNS data to Received: line.
*list_from_rcvd doesn't work without list

(although it could be worth adding IP or CIDR check in such cases)



I use qmail. Do I have to do anything extra to get it to put this info ?

Anand


Re: googlepages.com abuse

2007-11-13 Thread SM

At 19:31 13-11-2007, Bart Schaefer wrote:

Er, which RFC are you claiming requires them to have a server to receive mail?


It's a BCP quoted by SMTP folks to annoy Web-enabled people. :-)

Regards,
-sm 



Re: Skip SA checks for mails from SA list

2007-11-13 Thread Byung-Hee HWANG
hi,

On Wed, 2007-11-14 at 11:43 +0530, K Anand wrote:
 Matus UHLAR - fantomas wrote:
  On 13.11.07 15:52, K Anand wrote:
 
  Received: from unknown (HELO mail.apache.org) (140.211.11.2)
  
  configure your smtp server to add DNS data to Received: line.
  *list_from_rcvd doesn't work without list
  
  (although it could be worth adding IP or CIDR check in such cases)
  
 
 I use qmail. Do I have to do anything extra to get it to put this info ?

you just tell qmail to do rDNS. it is very easy. there is no problem.

respect,
bh

-- 
As the CONSIGLIERE, you agree that it's dangerous to the Don and our Family
to let Sollozzo live?
Yes.
-- Michael Corleone and Tom Hagen, Chapter 11, page 145