Re: SPF breaks email forwarding

2006-07-28 Thread Ramprasad
On Thu, 2006-07-27 at 14:35 -0700, John D. Hardin wrote: On Thu, 27 Jul 2006, Hamish wrote: Forwarding should (IMO) be implemented in such a way as the FORWARDING mailbox should be used as the new return-path (Just like if you forwarded an email from your MUA rather than with the MDA).

The way SA checks the URI for domainname.us.tt

2006-07-28 Thread Maurice Lucas
Hello, I submitted wealthpro.us.MUNGED.tt to uribl but he isn't added because SA will only see us.MUNGED.tt. I know there are some domains which use a 2 level tld zone. like .co.uk which will never be included. Is this not an TLD which has be to changed inside SA to a 2 level tld? If I check

Re: SPF breaks email forwarding

2006-07-28 Thread Hamish Marson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 John D. Hardin wrote: On Thu, 27 Jul 2006, Hamish wrote: Forwarding should (IMO) be implemented in such a way as the FORWARDING mailbox should be used as the new return-path (Just like if you forwarded an email from your MUA rather than with the

Re: SPF breaks email forwarding

2006-07-28 Thread Hamish Marson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Gino Cerullo wrote: On 27-Jul-06, at 4:32 PM, Hamish wrote: On Wednesday 26 July 2006 17:25, Marc Perkel wrote: Benny Pedersen wrote: On Tue, July 25, 2006 18:51, Marc Perkel wrote: SPF breaks email forwarding. My users use forwarding. fair,

Re: Moving from SA 2.6 to SA 3.1.4 [bayes file]

2006-07-28 Thread Martin Hepworth
BG Mahesh wrote: hi We are moving our mailserver to a new machine. The old machine has MailScanner+SA 2.6.x The new machine has MailScanner+SA 3.1.4 How can I move the bayes file from the old machine to the new machine and make sure it is SA 3.1.4 complaint? Basically I want the new

Image spams getting thru

2006-07-28 Thread Ramprasad
I am suddenly facing a lot of image spams from a pretty effiecient spammer now . The Ips he is using are not listed anywhere All spams advertising stocks of HLUN.PK Am I alone facing this problem. Also I found that the From header in all mails is a typical repeated string Like these From:

Re: Image spams getting thru

2006-07-28 Thread Raymond Dijkxhoorn
Hi! All spams advertising stocks of HLUN.PK Am I alone facing this problem. Also I found that the From header in all mails is a typical repeated string No this is seen all over. Anyone a nice rule? Bye, Raymond.

all trusted when no received headers are found

2006-07-28 Thread Ben Wylie
IS there a way to stop all trusted being triggered when no received headers are found at all? Thanks Ben

RE: exim4 + forwarding + spamassassin

2006-07-28 Thread Zinski, Steve
Tried that, and it didn't work. Even with file permissions set to 777, I was seeing these log entries: Jul 25 12:36:10 vps spamd[28501]: locker: safe_lock: cannot create tmp lockfile /.spamassassin/auto-whitelist.lock.vps.zinski.net.28501 for /.spamassassin/auto-whitelist.lock: Permission denied

Re: all trusted when no received headers are found

2006-07-28 Thread Benny Pedersen
On Fri, July 28, 2006 13:56, Ben Wylie wrote: IS there a way to stop all trusted being triggered when no received headers are found at all? that will be brokken if that happens, your own mta should be there no matter how brokken the sending client is what you can do is trust less to avoid it,

Re: SpamAssassin 3.0.3 and MIME_BOUND_RKFINDY

2006-07-28 Thread Golden, James
Excuse my ignorance, but I have seen mention of raising scores for Bayes_99, Bayes_95, and I have several SPAM messages that are trigerring Bayes_50 but are getting a score of 0.00. What are the differences between these and how do I go about raising the scores? I can't seem to find any

Re: Image spams getting thru

2006-07-28 Thread Benny Pedersen
On Fri, July 28, 2006 13:14, Ramprasad wrote: From: Rory [mailto:[EMAIL PROTECTED] From: Barbra [mailto:[EMAIL PROTECTED] Can I write a ruleset to hit these froms yes attached a rule for this -- Benny# header TWO_SUBJS ALL =~ /(?:^|\n)Subject:.*\nSubject:/s # header DOUBLE_SUBJECT

Re: The way SA checks the URI for domainname.us.tt

2006-07-28 Thread Theo Van Dinter
On Fri, Jul 28, 2006 at 09:22:08AM +0200, Maurice Lucas wrote: I submitted wealthpro.us.MUNGED.tt to uribl but he isn't added because SA will only see us.MUNGED.tt. I'm not sure why you think that. us.tt is listed as a two level TLD in SA, so whatever.us.tt is what gets used. -- Randomly

Re: Image spams getting thru

2006-07-28 Thread Ramprasad
Oops they were single from headers , but from different mails On Fri, 2006-07-28 at 16:50 +0200, Benny Pedersen wrote: On Fri, July 28, 2006 13:14, Ramprasad wrote: From: Rory [mailto:[EMAIL PROTECTED] From: Barbra [mailto:[EMAIL PROTECTED] Can I write a ruleset to hit these froms

Re: The way SA checks the URI for domainname.us.tt

2006-07-28 Thread Yet Another Ninja
On 7/28/2006 4:57 PM, Theo Van Dinter wrote: On Fri, Jul 28, 2006 at 09:22:08AM +0200, Maurice Lucas wrote: I submitted wealthpro.us.MUNGED.tt to uribl but he isn't added because SA will only see us.MUNGED.tt. I'm not sure why you think that. us.tt is listed as a two level TLD in SA, so

Re: The way SA checks the URI for domainname.us.tt

2006-07-28 Thread Maurice Lucas
On Fri, 2006-07-28 at 10:57 -0400, Theo Van Dinter wrote: On Fri, Jul 28, 2006 at 09:22:08AM +0200, Maurice Lucas wrote: I submitted wealthpro.us.MUNGED.tt to uribl but he isn't added because SA will only see us.MUNGED.tt. I'm not sure why you think that. us.tt is listed as a two level

list of two level TLDs in SA

2006-07-28 Thread Rob McEwen (PowerView Systems)
... us.tt is listed as a two level TLD in SA I wasn't involved in that URIBL listing which brought this up... but, BTW, I'd love to have that two level TLD in SA list handy. Therefore, can someone point me in the right direction for where I could find SA's list of two level TLDs? Thanks!

Re: list of two level TLDs in SA

2006-07-28 Thread Theo Van Dinter
On Fri, Jul 28, 2006 at 11:27:09AM -0400, Rob McEwen (PowerView Systems) wrote: I wasn't involved in that URIBL listing which brought this up... but, BTW, I'd love to have that two level TLD in SA list handy. Therefore, can someone point me in the right direction for where I could find SA's

Re: SpamAssassin 3.0.3 and MIME_BOUND_RKFINDY

2006-07-28 Thread Theo Van Dinter
On Fri, Jul 28, 2006 at 10:21:11AM -0700, Ninja Dude wrote: In other words, Bayes looks at it, says, I have no idea whether this is spam-like or not. So 0 is the appropriate score for BAYES_50. FWIW, BAYES_50 actually has a tiny tiny non-zero score so it'll show up as a rule hit. Otherwise,

Rules for short spams?

2006-07-28 Thread Evan Platt
I'm getting hammered with short spams. Basically one line, a URI, then about 2 more lines. I've put a sample at http://www.espphotography.com/spam.txt . But that's about what they generally are. Very short, to the point so to speak. Any rules that would help these? Thanks. Evan

Re: Rules for short spams?

2006-07-28 Thread Kelson
Evan Platt wrote: I'm getting hammered with short spams. Basically one line, a URI, then about 2 more lines. ... Any rules that would help these? Enable network tests. URIBL rules were basically invented for this type of spam, and they tend to work quite well. -- Kelson Vibber SpeedGate

Re: SpamAssassin 3.0.3 and MIME_BOUND_RKFINDY

2006-07-28 Thread Vincent Li
On 27-Jul-06, at 7:46 PM, Tao Lin wrote: Hi, John Now I understand what MIME_BOUND_RKFINDY mean. It means my email is generated by Indy component.  And I have some misuse of the Indy component that it gen the html email is not so clean. Once I fix it, my email score from 2.4 downto 0.5!

per user Bayesian filtering

2006-07-28 Thread Joe Harvell
I have Postfix 2.2.10 and SpamAssassin 3.1.3. I have been trying to figure out how to set up per-user Bayesian filtering. Obviously I need to cause sa-learn to maintain a different database for each user. My question is how do I get SpamAssassin to use the DB corresponding to the recipient of

Re: per user Bayesian filtering

2006-07-28 Thread Joe Harvell
I just realized the question also applies to outgoing mail. Would that be based on the senders DB? What about for relayed mail? Is there a way to make it so that SA only gets invoked for incoming mail? Joe Harvell wrote: I have Postfix 2.2.10 and SpamAssassin 3.1.3. I have been trying to

Re: all trusted when no received headers are found

2006-07-28 Thread Matt Kettler
Ben Wylie wrote: IS there a way to stop all trusted being triggered when no received headers are found at all? Thanks Ben That should not happen in recent versions of SA.. What version are you on? SA 3.1.x will only fire ALL_TRUSTED if all of the following are met: 1) there is at

Re: Image spams getting thru

2006-07-28 Thread jdow
From: Benny Pedersen [EMAIL PROTECTED] On Fri, July 28, 2006 13:14, Ramprasad wrote: From: Rory [mailto:[EMAIL PROTECTED] From: Barbra [mailto:[EMAIL PROTECTED] Can I write a ruleset to hit these froms yes attached a rule for this I think he meant the cardiac.cardiac and adjudge.adjudge

Re: list of two level TLDs in SA

2006-07-28 Thread jdow
From: Rob McEwen (PowerView Systems) [EMAIL PROTECTED] Thanks for your help, Theo Van Dinter! Using your tip, I was able to find this on a web site here: http://cpan.uwinnipeg.ca/htdocs/Mail-SpamAssassin/Mail/SpamAssassin/Util/RegistrarBoundaries.pm.html (which I post in cause someone in the

sa-learn killed, bayes not available

2006-07-28 Thread Steven Scotten
The bayesian filter seems super-delicate. If I run sa-learn on a mailbox with more than about 200 messages in it, it gets killed, I'm not sure why: $ sa-learn --spam --dir Maildir/.spam/cur/ Killed $ If sa-learn gets killed in the middle, it leaves a database that it thinks is empty. Before a

Re: Rules for short spams?

2006-07-28 Thread Benny Pedersen
On Fri, July 28, 2006 19:28, Evan Platt wrote: I'm getting hammered with short spams. Basically one line, a URI, then about 2 more lines. I've put a sample at http://www.espphotography.com/spam.txt . But that's about what they generally are. Very short, to the point so to speak. Any rules

Re: SpamAssassin 3.0.3 and MIME_BOUND_RKFINDY

2006-07-28 Thread jdow
From: Theo Van Dinter [EMAIL PROTECTED] FWIW, BAYES_50 actually has a tiny tiny non-zero score so it'll show up as a rule hit. Otherwise, people went crazy not understanding why there were no BAYES_* hits. Gee, I can take out my BAYES_50 tweak. {^_-}

Re: The way SA checks the URI for domainname.us.tt

2006-07-28 Thread jdow
From: Yet Another Ninja [EMAIL PROTECTED] On 7/28/2006 4:57 PM, Theo Van Dinter wrote: On Fri, Jul 28, 2006 at 09:22:08AM +0200, Maurice Lucas wrote: I submitted wealthpro.us.MUNGED.tt to uribl but he isn't added because SA will only see us.MUNGED.tt. I'm not sure why you think that. us.tt

Re: The way SA checks the URI for domainname.us.tt

2006-07-28 Thread jdow
From: Maurice Lucas [EMAIL PROTECTED] On Fri, 2006-07-28 at 10:57 -0400, Theo Van Dinter wrote: On Fri, Jul 28, 2006 at 09:22:08AM +0200, Maurice Lucas wrote: I submitted wealthpro.us.MUNGED.tt to uribl but he isn't added because SA will only see us.MUNGED.tt. I'm not sure why you think

Re: The way SA checks the URI for domainname.us.tt

2006-07-28 Thread Theo Van Dinter
On Fri, Jul 28, 2006 at 04:08:42PM -0700, jdow wrote: And after my playing around with whois one comes to the confusion or conclusion that us.it is not a two level domain or else whois is very broken. I vote for the former conclusion. If you play with the standard spammer trick anything.us.it

Re: The way SA checks the URI for domainname.us.tt

2006-07-28 Thread jdow
From: Maurice Lucas [EMAIL PROTECTED] On Fri, 2006-07-28 at 10:57 -0400, Theo Van Dinter wrote: On Fri, Jul 28, 2006 at 09:22:08AM +0200, Maurice Lucas wrote: I submitted wealthpro.us.MUNGED.tt to uribl but he isn't added because SA will only see us.MUNGED.tt. I'm not sure why you think

Re: The way SA checks the URI for domainname.us.tt

2006-07-28 Thread jdow
From: Maurice Lucas [EMAIL PROTECTED] On Fri, 2006-07-28 at 10:57 -0400, Theo Van Dinter wrote: On Fri, Jul 28, 2006 at 09:22:08AM +0200, Maurice Lucas wrote: I submitted wealthpro.us.MUNGED.tt to uribl but he isn't added because SA will only see us.MUNGED.tt. I'm not sure why you think

Re: The way SA checks the URI for domainname.us.tt

2006-07-28 Thread jdow
From: jdow [EMAIL PROTECTED] From: Maurice Lucas [EMAIL PROTECTED] On Fri, 2006-07-28 at 10:57 -0400, Theo Van Dinter wrote: On Fri, Jul 28, 2006 at 09:22:08AM +0200, Maurice Lucas wrote: I submitted wealthpro.us.MUNGED.tt to uribl but he isn't added because SA will only see us.MUNGED.tt.

Re: The way SA checks the URI for domainname.us.tt

2006-07-28 Thread jdow
From: Theo Van Dinter [EMAIL PROTECTED] Quoth Theo: Why? us.tt acts as a registrar (www.us.tt - joynic.com), dolling out anything.us.tt to others, so we want to be able to deal with that. Same as other country code.tt 2TLDs. Quoth the Trinidad Tobago registrar, ttnic at http://www.nic.tt/ :

Re: per user Bayesian filtering

2006-07-28 Thread John Andersen
On Friday 28 July 2006 10:33, Joe Harvell wrote: I have Postfix 2.2.10 and SpamAssassin 3.1.3. I have been trying to figure out how to set up per-user Bayesian filtering. Obviously I need to cause sa-learn to maintain a different database for each user. My question is how do I get