False positive in FB_CIALIS_LEO3 rule

2013-10-18 Thread Marcin Mirosław
Hi! I'm not sure if false positives should be reported here or in bugzilla. If I choosen wrong place please let me know. Innocent phrase in Polish language brakuje Ci aliasów[1] triggers rules mentioned above. [1] - it means: [...] you are missing aliases [...] Regards, Marcin

Re: False positive in FB_CIALIS_LEO3 rule

2013-10-18 Thread Axb
On 10/18/2013 03:07 PM, Marcin Mirosław wrote: Hi! I'm not sure if false positives should be reported here or in bugzilla. If I choosen wrong place please let me know. Innocent phrase in Polish language brakuje Ci aliasów[1] triggers rules mentioned above. [1] - it means: [...] you are missing

Re: False positive in FB_CIALIS_LEO3 rule

2013-10-18 Thread Marcin Mirosław
W dniu 18.10.2013 15:23, Axb pisze: On 10/18/2013 03:07 PM, Marcin Mirosław wrote: Hi! I'm not sure if false positives should be reported here or in bugzilla. If I choosen wrong place please let me know. Innocent phrase in Polish language brakuje Ci aliasów[1] triggers rules mentioned above.

A way to score Number of Recipients in the To: Line ?

2013-10-18 Thread Lutz Petersen
I'm searching a way to give some extra Score depending on the Number of Recipients in the To: Headerline. In the last days there are massive Spamruns that are not marked as Spam - but all of them have a lot of Recipient Mail-Adresses in the To-Line (the last one more than 50..). I didn't found

Re: A way to score Number of Recipients in the To: Line ?

2013-10-18 Thread Axb
On 10/18/2013 04:04 PM, Lutz Petersen wrote: I'm searching a way to give some extra Score depending on the Number of Recipients in the To: Headerline. In the last days there are massive Spamruns that are not marked as Spam - but all of them have a lot of Recipient Mail-Adresses in the To-Line

Re: A way to score Number of Recipients in the To: Line ?

2013-10-18 Thread Kevin A. McGrail
On 10/18/2013 10:04 AM, Lutz Petersen wrote: I'm searching a way to give some extra Score depending on the Number of Recipients in the To: Headerline. In the last days there are massive Spamruns that are not marked as Spam - but all of them have a lot of Recipient Mail-Adresses in the To-Line

Re: FSL_HELO_BARE_IP_2 RCVD_NUMERIC_HELO

2013-10-18 Thread SM
At 02:56 15-10-2013, Stan Hoeppner wrote: In both cases the last two Received: headers in each message are forgeries as no SMTP transaction occurred. I'm sure this violates more than one SMTP RFC, but I doubt Gmane will change the way they do this any time soon. I don't think that there is

Re: False positive in FB_CIALIS_LEO3 rule

2013-10-18 Thread Axb
On 10/18/2013 03:34 PM, Marcin Mirosław wrote: W dniu 18.10.2013 15:23, Axb pisze: On 10/18/2013 03:07 PM, Marcin Mirosław wrote: Hi! I'm not sure if false positives should be reported here or in bugzilla. If I choosen wrong place please let me know. Innocent phrase in Polish language brakuje

whitelist_from conditioned to hostname

2013-10-18 Thread nik600
Dear sir is possible to specify a whitelist_from in local.cf limiting it for some hosts? Example: i want to whitelist my postmas...@foo.tld to avoid backscatter or bouce_message classifications, but want to limit this whitelist only if the sender is from my server, if the smtp client is

Re: whitelist_from conditioned to hostname

2013-10-18 Thread Benny Pedersen
nik600 skrev den 2013-10-18 17:24: Can i do that? sure: whitelist_auth postmas...@example.org whitelist_from allow forges, dont use it, its still candidate to be removed from spamassassin

Re: whitelist_from conditioned to hostname

2013-10-18 Thread Matus UHLAR - fantomas
On 18.10.13 17:24, nik600 wrote: is possible to specify a whitelist_from in local.cf limiting it for some hosts? yes, use whitelist_from_rcvd for that. Note that applies to external mail, e.g. mail received from hosts not in your internal_network. i want to whitelist my postmas...@foo.tld to

Re: whitelist_from conditioned to hostname

2013-10-18 Thread Kris Deugau
nik600 wrote: is possible to specify a whitelist_from in local.cf http://local.cf limiting it for some hosts? Example: i want to whitelist my postmas...@foo.tld to avoid backscatter or bouce_message classifications, but want to limit this whitelist only if the sender is from my server,

Re: A way to score Number of Recipients in the To: Line ?

2013-10-18 Thread John Hardin
On Fri, 18 Oct 2013, Kevin A. McGrail wrote: On 10/18/2013 10:04 AM, Lutz Petersen wrote: I'm searching a way to give some extra Score depending on the Number of Recipients in the To: Headerline. In the last days there are massive Spamruns that are not marked as Spam - but all of them have

Testing the _REMOTEHOSTNAME_ in a rule

2013-10-18 Thread Philip Prindeville
I'm trying to write a rule that gives some spamminess score to messages received from any host that resolves to protection.outlook.com. I tried to use _REMOTEHOSTNAME_ to do this, but I think I got the header syntax wrong. Can someone set me straight? Thanks, -Philip