Re: Rule to match X-Spam-Flag

2011-06-09 Thread Daryl C. W. O'Shea
On 09/06/2011 10:26 PM, Benny Pedersen wrote: On Fri, 10 Jun 2011 04:08:08 +0200, Benny Pedersen wrote: On Thu, 09 Jun 2011 22:00:09 -0400, Daryl C. W. O'Shea wrote: header CUSTOM_X_SPAM_FLAG ALL:raw =~ /\bX-Spam-Flag: YES\b/i aol have left out the space before YES will test it and report b

Re: Rule to match X-Spam-Flag

2011-06-09 Thread Benny Pedersen
On Fri, 10 Jun 2011 04:08:08 +0200, Benny Pedersen wrote: On Thu, 09 Jun 2011 22:00:09 -0400, Daryl C. W. O'Shea wrote: header CUSTOM_X_SPAM_FLAG ALL:raw =~ /\bX-Spam-Flag: YES\b/i aol have left out the space before YES will test it and report back, thanks for this tip if it works :-) # he

Re: Rule to match X-Spam-Flag

2011-06-09 Thread Benny Pedersen
On Thu, 09 Jun 2011 22:00:09 -0400, Daryl C. W. O'Shea wrote: header CUSTOM_X_SPAM_FLAG ALL:raw =~ /\bX-Spam-Flag: YES\b/i aol have left out the space before YES will test it and report back, thanks for this tip if it works :-)

Re: Rule to match X-Spam-Flag

2011-06-09 Thread Daryl C. W. O'Shea
On 09/06/2011 5:09 AM, Alessandro Dentella wrote: Hi, I find a lot of spam that has already passed other spam-filters with spamassassin better tuned than mine an already have a X-Spam-Flag to YES. I tried to add a rule to match that case: header CUSTOM_X_SPAM_FLAG X-Spam-Flag =~ /\bYES\b

Re: Rule to match X-Spam-Flag

2011-06-09 Thread Joe Sniderman
On 06/09/2011 11:06 AM, Mark Martinec wrote: > Benny, > >>> As a workaround, you may add some header rewrite rule to your MTA >>> which could rewrite a X-Spam-Flag to something else, like >>> X-X-Spam-Flag. >> >> will not give invalid dkim ? > > No, unless the X-Spam-Flag were signed, which is un

Re: Rule to match X-Spam-Flag

2011-06-09 Thread Mark Martinec
Benny, > > As a workaround, you may add some header rewrite rule to your MTA > > which could rewrite a X-Spam-Flag to something else, like > > X-X-Spam-Flag. > > will not give invalid dkim ? No, unless the X-Spam-Flag were signed, which is unlikely. Mark

Re: Rule to match X-Spam-Flag

2011-06-09 Thread Benny Pedersen
On Thu, 9 Jun 2011 11:46:41 +0200, Mark Martinec wrote: As a workaround, you may add some header rewrite rule to your MTA which could rewrite a X-Spam-Flag to something else, like X-X-Spam-Flag. will not give invalid dkim ? seems aol.com does not use amavisd-new, if thay did this header was

Re: Debugging rules and tests: how to interpret them?

2011-06-09 Thread Alex
Hi, >> > if can(Mail::SpamAssassin::Plugin::URIDNSBL::has_tflags_domains_only) >> > urirhssub       URIBL_DBL_REDIR   dbl.spamhaus.org.       A   127.0.1.3 >> > body            URIBL_DBL_REDIR   eval:check_uridnsbl('URIBL_DBL_REDIR') >> > describe        URIBL_DBL_REDIR   Spamhaus spammed redirect

Re: Rule to match X-Spam-Flag

2011-06-09 Thread Yet Another Ninja
On 2011-06-09 11:46, Mark Martinec wrote: Sandro, I find a lot of spam that has already passed other spam-filters with spamassassin better tuned than mine an already have a X-Spam-Flag to YES. I tried to add a rule to match that case: header CUSTOM_X_SPAM_FLAG X-Spam-Flag =~ /\bYES\b/i

Re: Rule to match X-Spam-Flag

2011-06-09 Thread Mark Martinec
Sandro, > I find a lot of spam that has already passed other spam-filters with > spamassassin better tuned than mine an already have a X-Spam-Flag to YES. > > I tried to add a rule to match that case: > > header CUSTOM_X_SPAM_FLAG X-Spam-Flag =~ /\bYES\b/i > score CUSTOM_X_SPAM_FLAG 5 > > B

Rule to match X-Spam-Flag

2011-06-09 Thread Alessandro Dentella
Hi, I find a lot of spam that has already passed other spam-filters with spamassassin better tuned than mine an already have a X-Spam-Flag to YES. I tried to add a rule to match that case: header CUSTOM_X_SPAM_FLAG X-Spam-Flag =~ /\bYES\b/i score CUSTOM_X_SPAM_FLAG 5 But spamassassin -t

Re: Debugging rules and tests: how to interpret them?

2011-06-09 Thread Mark Martinec
Sandro, > > if can(Mail::SpamAssassin::Plugin::URIDNSBL::has_tflags_domains_only) > > urirhssub URIBL_DBL_REDIR dbl.spamhaus.org. A 127.0.1.3 > > bodyURIBL_DBL_REDIR eval:check_uridnsbl('URIBL_DBL_REDIR') > > describeURIBL_DBL_REDIR Spamhaus spammed redirect

Re: Debugging rules and tests: how to interpret them?

2011-06-09 Thread Mark Martinec
Sandro, > > if can(Mail::SpamAssassin::Plugin::URIDNSBL::has_tflags_domains_only) > > urirhssub URIBL_DBL_REDIR dbl.spamhaus.org. A 127.0.1.3 > > bodyURIBL_DBL_REDIR eval:check_uridnsbl('URIBL_DBL_REDIR') > > describeURIBL_DBL_REDIR Spamhaus spammed redirect

Re: Debugging rules and tests: how to interpret them?

2011-06-09 Thread Alessandro Dentella
On Wed, Jun 08, 2011 at 07:05:20PM +0200, Mark Martinec wrote: > Sandro, > > > As an example I have a message that include a link to "ow (dot) ly (/) > > 57lle". Querying host ow.ly.dbl.spamhaus.org clearly shows that it's s > > spammer redirector. > > > > If I feed the message to 'spamassassin -

Re: Debugging rules and tests: how to interpret them?

2011-06-09 Thread Alessandro Dentella
Thanks Mark, On Wed, Jun 08, 2011 at 07:05:20PM +0200, Mark Martinec wrote: > Sandro, > > > As an example I have a message that include a link to "ow (dot) ly (/) > > 57lle". Querying host ow.ly.dbl.spamhaus.org clearly shows that it's s > > spammer redirector. > > > > If I feed the message to '