Re: Apache SpamAssassin 3.4.0 release candidate 2 - invitation to testers

2013-06-21 Thread The Doctor
On Sat, Jun 22, 2013 at 02:45:12AM +0200, Mark Martinec wrote: > This is not a formal announcement, but an invitation to a broader > users community to try the release candidate of the coming release > of Apache SpamAssassin version 3.4.0 . > > Preliminary release notes and a link to the package w

Re: False negatives/positives on debian

2013-06-21 Thread John Hardin
On Sat, 22 Jun 2013, Robert S wrote: That wasn't the complete reply - hit the reply button too soon . . . The two addresses at the top are my ISP's DNS servers and the bottom is the IP address of my server. I still get the administrator notice with this configuration. Is there an additional s

Re: False negatives/positives on debian

2013-06-21 Thread Dave Funk
On Sat, 22 Jun 2013, Robert S wrote: I am running spamassassin_3.3.2-5 on debian Wheezy on a small business server (x86).  I am getting numerous complaints about mail being falely categorised as spam/ham.  I also use version 3.3.2 on my home server using gentoo (amd64) and don't have these pro

Re: False negatives/positives on debian

2013-06-21 Thread Robert S
That wasn't the complete reply - hit the reply button too soon . . . The two addresses at the top are my ISP's DNS servers and the bottom is the IP address of my server. I still get the administrator notice with this configuration. Is there an additional step that I need to take? I'm not a DNS

Re: False negatives/positives on debian

2013-06-21 Thread John Hardin
On Sat, 22 Jun 2013, Robert S wrote: This message seems to get blocked in a lot of blocklists (which also seem to happen to my users' messages). That's the first thing you need to resolve. 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.

False negatives/positives on debian

2013-06-21 Thread Robert S
I am running spamassassin_3.3.2-5 on debian Wheezy on a small business server (x86). I am getting numerous complaints about mail being falely categorised as spam/ham. I also use version 3.3.2 on my home server using gentoo (amd64) and don't have these problems. I have removed all customisations

Apache SpamAssassin 3.4.0 release candidate 2 - invitation to testers

2013-06-21 Thread Mark Martinec
This is not a formal announcement, but an invitation to a broader users community to try the release candidate of the coming release of Apache SpamAssassin version 3.4.0 . Preliminary release notes and a link to the package was published in a posting to the d...@spamassassin.apache.org mailing lis

Re: New virus outbreak with malformed payload

2013-06-21 Thread Kevin A. McGrail
We had none yesterday but some 700 today which is a decent amount. However, the attachments were filtered as bad filenames and quarantined which adds a 2.5 score to our spam tests which also blocked all of them so very few made it to inboxes. R

Re: New virus outbreak with malformed payload

2013-06-21 Thread David F. Skoll
On Fri, 21 Jun 2013 19:56:19 +0200 Benny Pedersen wrote: > > Annoyingly, the envelope sender is no-re...@intuit.com which has an > > SPF permerror... FAIL. > and you accept permerror :) Well, what would you suggest? :) I don't think our customers would accept unconditional blocking of intuit.c

Re: New virus outbreak with malformed payload

2013-06-21 Thread Benny Pedersen
David F. Skoll skrev den 2013-06-21 19:40: Annoyingly, the envelope sender is no-re...@intuit.com which has an SPF permerror... FAIL. and you accept permerror :) *sigh* is the zipfile always 6 bytes where the 2 first chars is not pk ?, that is not even a zip file then -- senders that pu

Re: New virus outbreak with malformed payload

2013-06-21 Thread Jay Plesset
yes, saw both the scanner ones and the new ones, too. jay plesset IT, dp-design.com On 6/21/2013 10:40 AM, David F. Skoll wrote: Hi, We're seeing a huge rash of viruses with malformed payloads. They're supposed to contain a ZIP file, but the MIME part supposedly containing the ZIP file simply

New virus outbreak with malformed payload

2013-06-21 Thread David F. Skoll
Hi, We're seeing a huge rash of viruses with malformed payloads. They're supposed to contain a ZIP file, but the MIME part supposedly containing the ZIP file simply contains: Error[Base64] Sample: http://pastebin.com/fkjf9LHR Yesterday, they were "Scanned Copy" spams from an HP printer. Today

Re: uridnsbl checks on domains in headers

2013-06-21 Thread Axb
On 06/21/2013 05:29 PM, Fabio Sangiovanni wrote: I'm using amavisd-new to pass messages to SA. Envelope recipients are in the mail message, as payloads of my custom X-header. That's why I asked for a way to check headers against URI BLs. I'm considering filtering out bad recipient domains using b

Re: uridnsbl checks on domains in headers

2013-06-21 Thread Fabio Sangiovanni
Il 21/06/13 17:16, Axb ha scritto: On 06/21/2013 05:07 PM, Fabio Sangiovanni wrote: Il 21/06/13 16:27, Axb ha scritto: This is possible against standard headers. you can see how it's done in 20_dnsbl_tests.cf DNS_FROM_AHBL_RHSBL Ok, so I assume there's no way to force checks against custom he

Re: uridnsbl checks on domains in headers

2013-06-21 Thread Fabio Sangiovanni
Il 21/06/13 16:49, Martin Gregorie ha scritto: On Fri, 2013-06-21 at 15:21 +0200, Fabio Sangiovanni wrote: I normally already scan the BCCed message *only*. The main submission channel doesn't have an antispam system on its own; instead, an out-of-band antispam stack (postfix + amavisd-new + sp

Re: uridnsbl checks on domains in headers

2013-06-21 Thread Axb
On 06/21/2013 05:07 PM, Fabio Sangiovanni wrote: Il 21/06/13 16:27, Axb ha scritto: This is possible against standard headers. you can see how it's done in 20_dnsbl_tests.cf DNS_FROM_AHBL_RHSBL Ok, so I assume there's no way to force checks against custom headers. Plus, I'm more interested in

Re: uridnsbl checks on domains in headers

2013-06-21 Thread Fabio Sangiovanni
Il 21/06/13 16:27, Axb ha scritto: This is possible against standard headers. you can see how it's done in 20_dnsbl_tests.cf DNS_FROM_AHBL_RHSBL Ok, so I assume there's no way to force checks against custom headers. Plus, I'm more interested in check against envelope recipients. Why do you nee

Re: uridnsbl checks on domains in headers

2013-06-21 Thread Martin Gregorie
On Fri, 2013-06-21 at 15:21 +0200, Fabio Sangiovanni wrote: > I normally already scan the BCCed message *only*. The main submission > channel doesn't have an antispam system on its own; instead, an > out-of-band antispam stack (postfix + amavisd-new + spamassassin) is in > place; it receives BC

Re: uridnsbl checks on domains in headers

2013-06-21 Thread Axb
On 06/21/2013 03:21 PM, Fabio Sangiovanni wrote: Il 21/06/13 14:19, Martin Gregorie ha scritto: Assuming that the copy is sent to a maildir format mailbox you can periodically run a shell script something this: for m in maildir/* do spamc <$m | rescanned_results_filter mv $m scanned_dir

Re: uridnsbl checks on domains in headers

2013-06-21 Thread Fabio Sangiovanni
Il 21/06/13 14:19, Martin Gregorie ha scritto: Assuming that the copy is sent to a maildir format mailbox you can periodically run a shell script something this: for m in maildir/* do spamc <$m | rescanned_results_filter mv $m scanned_dir done This could be a second pass through your no

RE: sa-learn

2013-06-21 Thread emailitis.com
Benny, Regarding: sa-learn --spam /var/qmail/mailnames/hosted-domain.com/user-1/Maildir/.Spam/cur thank you for the correction and the education.

Re: uridnsbl checks on domains in headers

2013-06-21 Thread Martin Gregorie
On Fri, 2013-06-21 at 10:27 +0200, Fabio Sangiovanni wrote: > Hi everybody, > > I've configured my MSA (Postfix) so that a copy of submitted mail is > sent (BCC'd) to a postfix/amavisd-new/spamassassin system for > out-of-band antispam analysis. > The MSA is set to write envelope from/rcpt addre

Re: sa-learn

2013-06-21 Thread Benny Pedersen
emailitis.com skrev den 2013-06-21 09:27: I have one of our own widely known email addresses that gets a fair bit. I have put Spam into the Spam email. Can I run the following command: sa-learn /var/qmail/mailnames/hosted-domain.com/user-1/Maildir/.Spam/cur sa-learn --spam /var/qmail/mailna

uridnsbl checks on domains in headers

2013-06-21 Thread Fabio Sangiovanni
Hi everybody, I've configured my MSA (Postfix) so that a copy of submitted mail is sent (BCC'd) to a postfix/amavisd-new/spamassassin system for out-of-band antispam analysis. The MSA is set to write envelope from/rcpt addresses in custom headers. Is it possibile to check this addresses' domai

sa-learn

2013-06-21 Thread emailitis.com
I'm trying to get SA to do better manual training to make it better. We have autolearn turned on but some Spam gets through with low BAYES values and having clearly been incorrectly learnt in the past. Server-wide, we can only look at the maillog so not sure how, if we find a pattern of ema