'mx' appearing in the host portion of the return address

2008-01-28 Thread Arlyle Consulting
Hi, I have a question, and possible feature request. I just installed SpamAssassin on my mail server a couple of days ago. I've been closely studying the messages that get by SA and are spam, and I've noticed something. Many of the messages that are spam that SA misses has return

RE: sa-update error wrong gpg key...

2008-01-28 Thread Steve Monkhouse
Hey guys.. We're seeing the same thing.. although slightly different.. this error has only been happening for a week or so now.. everything's been fine before that.. it seems to be with the RSA key generated on 15Jan.. An sa-update -D shows : [/usr/local/etc/mail/spamassassin]# sa-update -D

spamassassin accuracy test

2008-01-28 Thread Hard Coder
Hello, I decided to benchmark the accuracy of spamassassin. Is there anything special I should take into consideration before I start to flood with both ham and spam? TIA, hc Never miss a thing. Make

What's with the many nnnn.com domains in this spam?

2008-01-28 Thread Per Jessen
Check this out http://jessen.ch/files/spam55.txt It's a typical spam-email with a single gif advertising drugs. The gif is loaded from a website which is listed by uribl.com. The emails has hrefs to the following '.com' domains: juxl.com - contents named 'NAMESRENTER.COM' nkhs.com - some

Re: Spamd uses over 1 gigabyte of memory in one child

2008-01-28 Thread Sevrin Robstad
Matus UHLAR - fantomas wrote: On 27.01.08 15:06, Sevrin Robstad wrote: I have used spamassassin over a year on my mail server, using James as pop/smtp and a homewritten mailet to connect to spamd through tcp. Yesterday I suddenly discovered load average peaks over 100 (!!!) on the

Re: What's with the many nnnn.com domains in this spam?

2008-01-28 Thread Justin Mason
Per Jessen writes: Check this out http://jessen.ch/files/spam55.txt It's a typical spam-email with a single gif advertising drugs. The gif is loaded from a website which is listed by uribl.com. The emails has hrefs to the following '.com' domains: MUNGEDjuxl.com - contents

Re: is DOS_OUTLOOK_TO_MX too low?

2008-01-28 Thread Joseph Brennan
For those that don't know it means Delivered direct to MX with Outlook headers. Sounds like a good rule: Outlook isn't a MTA so shouldn't be able to connect directly to MX records - except for it's configured SMTP server. I looked at our spam reports (spam that was not rejected). It

Re: No Bayes Headers (no errors in debug/logs)

2008-01-28 Thread Theo Van Dinter
On Mon, Jan 28, 2008 at 10:53:50AM -0600, Mitchell Hudson wrote: So I'm not worried about not having any training. And the spamassassin -D bayes message.txt I assumed you meant spamassassin -D bayes message.txt, but in any case I let it run for about 30 minutes and it didn't return any

Re: spamassassin accuracy test

2008-01-28 Thread Matt Kettler
Hard Coder wrote: Hello, I decided to benchmark the accuracy of spamassassin. Is there anything special I should take into consideration before I start to flood with both ham and spam? It's probably easiest if you have them on disk and use the mass-check utility.

Re: No Bayes Headers (no errors in debug/logs)

2008-01-28 Thread Mitchell Hudson
I did actually pull out the number of tokens and I have quite a few in there: 0.000 0 3 0 non-token data: bayes db version 0.000 0 23930 0 non-token data: nspam 0.000 0 8304 0 non-token data: nham 0.000 0

Re: is DOS_OUTLOOK_TO_MX too low?

2008-01-28 Thread Jason Haar
Joseph Brennan wrote: I looked at our spam reports (spam that was not rejected). It looks to me like the biggest target to go for is mail supposedly from The Bat! direct to your MX. Most of the supposed The Bat! spam matches, and it is very low scoring. Yes - I just saw that too - like

Re: Tweaking Rules

2008-01-28 Thread Theo Van Dinter
On Mon, Jan 28, 2008 at 04:10:39PM -0600, Matt wrote: Does anyone see anything wrong with these scores? The RDNS_DYNAMIC worries me a bit since I know a few email servers hosted on dynamic looking reverse DNS's. Well, first, the scores are really aggressive. Generally speaking, you don't

Tweaking Rules

2008-01-28 Thread Matt
I have added the following to the local.cf to decrease the spam that gets through. score RCVD_IN_PBL 3 score RCVD_IN_XBL 5 score RDNS_NONE 5 score RCVD_IN_SORBS_DUL 3 score SPF_FAIL 10 score SPF_SOFTFAIL 5 score SPF_NEUTRAL 2 score RDNS_DYNAMIC 3 Does anyone see anything wrong with these scores?

One SPAM that got through

2008-01-28 Thread --[ UxBoD ]--
Hi, I just had this message get through :- Subject: CONTACT GLOBAL COMPANY FOR YOUR $950,000.00 My Dear Good Friend, I have Paid the fee for your Cheque Draft. But the manager of Eko Bank Benin told me that before the check will get to you that it will expire. So I told him to cash the

Re: No Bayes Headers (no errors in debug/logs)

2008-01-28 Thread Matt Kettler
Mitchell Hudson wrote: I did actually pull out the number of tokens and I have quite a few in there: 0.000 0 3 0 non-token data: bayes db version 0.000 0 23930 0 non-token data: nspam 0.000 0 8304 0 non-token data:

Re: One SPAM that got through

2008-01-28 Thread Matt Kettler
--[ UxBoD ]-- wrote: Hi, I just had this message get through :- snip and it only scored 5.6. These are the rules it hit :- 1.23 ADVANCE_FEE_2 0.00 BAYES_50 0.72 SARE_URGBIZ Contains urgent matter -0.00 SPF_PASS 2.08 SUBJ_ALL_CAPS 1.58 URG_BIZ Looks like you might want to do

Re: What's with the many nnnn.com domains in this spam?

2008-01-28 Thread Jeff Chan
Quoting Justin Mason [EMAIL PROTECTED]: Per Jessen writes: Check this out http://jessen.ch/files/spam55.txt It's a typical spam-email with a single gif advertising drugs. The gif is loaded from a website which is listed by uribl.com. The emails has hrefs to the following '.com'

Logging with SA/procmail standalone (no spamd)

2008-01-28 Thread Jason Antman
Hi, I'm a student at Rutgers University. I've been running SA on my own mailserver (handling 3 users) for a few years now. I recently came into some new hardware, and replaced the old mailserver with a new one running Solaris 10. I'm using SpamAssassin 3.02 in the blastwave.org package. I'm using