Re: Why do I get both URIBL_DBL_SPAM and URIBL_BLOCKED?

2014-06-06 Thread Dave Warren
On 2014-06-05 21:48, zespri wrote: As I read it, it means that non-forwarding dnsmasq is simply nonsensical. What am I missing? Yeah... I don't believe dnsmasq would be a good choice, unbound or BIND would be better choices. -- Dave Warren http://www.hireahit.com/

Re: Why do I get both URIBL_DBL_SPAM and URIBL_BLOCKED?

2014-06-06 Thread Axb
On 06/06/2014 08:33 AM, Dave Warren wrote: On 2014-06-05 21:48, zespri wrote: As I read it, it means that non-forwarding dnsmasq is simply nonsensical. What am I missing? Yeah... I don't believe dnsmasq would be a good choice, unbound or BIND would be better choices. or Powerdns-recursor

Re: Why do I get both URIBL_DBL_SPAM and URIBL_BLOCKED?

2014-06-06 Thread zespri
Thank you all. I've installed djbdns and now the URIBL_BLOCKED is gone! Yay! -- View this message in context: http://spamassassin.1065346.n5.nabble.com/Why-do-I-get-both-URIBL-DBL-SPAM-and-URIBL-BLOCKED-tp109457p109463.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

I'm getting T_DKIM_INVALID from gmail

2014-06-06 Thread zespri
I realize that this is not directly related to spam assassin, but I appeal to all you helpful folk here. For whatever reason if I send an email from gmail when it arrives it's marked with T_DKIM_INVALID. I inspected the original and the result and there are a few differences. Dkim header has this:

Re: Why do I get both URIBL_DBL_SPAM and URIBL_BLOCKED?

2014-06-06 Thread Anthony Cartmell
Also, it appears to me that the ISP provider caches not any worse than the local server dns server would cache, so could you please explain, what benefit caching them locally provides over using already set up DNS server at ISP? The caching aspect isn't particularly relevant. The problem

Re: Why do I get both URIBL_DBL_SPAM and URIBL_BLOCKED?

2014-06-06 Thread zespri
Anthony Cartmell-2 wrote The caching aspect isn't particularly relevant. The problem is that your ISP's name server will be querying the URIBL server on behalf of perhaps thousands of SpamAssassin instances on other machines. So it's blocked because it's making too many queries from a

Re: DMARC policy check with AskDNS posible?

2014-06-06 Thread Christian Laußat
Am 05.06.2014 21:48, schrieb Franck Martin: If the policy=reject and the dmarc is fail, then spamassassin should not see the email because opendmarc would have already rejected it (if not it is due to local policy override, so spamassassin should not change that) In the default configuration

Re: Why do I get both URIBL_DBL_SPAM and URIBL_BLOCKED?

2014-06-06 Thread Matus UHLAR - fantomas
On 06.06.14 00:28, zespri wrote: Thank you all. I've installed djbdns and now the URIBL_BLOCKED is gone! Yay! djbdns? I really wonder, when more alternatives were advised to you, why did you choose the oldest, worst, most buggy and years unsupported alternative? -- Matus UHLAR - fantomas,

Re: Why do I get both URIBL_DBL_SPAM and URIBL_BLOCKED?

2014-06-06 Thread zespri
Matus UHLAR - fantomas wrote djbdns? I really wonder, when more alternatives were advised to you, why did you choose the oldest, worst, most buggy and years unsupported alternative? Well, on the page that the original link led to this page was linked:

Re: I'm getting T_DKIM_INVALID from gmail

2014-06-06 Thread Matus UHLAR - fantomas
On 06.06.14 00:44, zespri wrote: For whatever reason if I send an email from gmail when it arrives it's marked with T_DKIM_INVALID. I inspected the original and the result and there are a few differences. Dkim header has this:

Re: Why do I get both URIBL_DBL_SPAM and URIBL_BLOCKED?

2014-06-06 Thread Matus UHLAR - fantomas
Matus UHLAR - fantomas wrote djbdns? I really wonder, when more alternatives were advised to you, why did you choose the oldest, worst, most buggy and years unsupported alternative? On 06.06.14 02:11, zespri wrote: Well, on the page that the original link led to this page was linked:

Re: Why do I get both URIBL_DBL_SPAM and URIBL_BLOCKED?

2014-06-06 Thread Bowie Bailey
On 6/6/2014 5:11 AM, zespri wrote: Matus UHLAR - fantomas wrote djbdns? I really wonder, when more alternatives were advised to you, why did you choose the oldest, worst, most buggy and years unsupported alternative? Well, on the page that the original link led to this page was linked:

Re: Why do I get both URIBL_DBL_SPAM and URIBL_BLOCKED?

2014-06-06 Thread RW
On Fri, 6 Jun 2014 02:11:47 -0700 (PDT) zespri wrote: Matus UHLAR - fantomas wrote djbdns? I really wonder, when more alternatives were advised to you, why did you choose the oldest, worst, most buggy and years unsupported alternative? In short: when you get several options offered

Re: Why do I get both URIBL_DBL_SPAM and URIBL_BLOCKED?

2014-06-06 Thread Matus UHLAR - fantomas
On Fri, 6 Jun 2014 02:11:47 -0700 (PDT) zespri wrote: In short: when you get several options offered to you, and you have no prior knowledge you've got to pick one randomly. That's what I did. On 06.06.14 15:14, RW wrote: If you've already installed djbdns I'd leave it. I'm still using it and

Re: Why do I get both URIBL_DBL_SPAM and URIBL_BLOCKED?

2014-06-06 Thread RW
On Fri, 6 Jun 2014 16:42:50 +0200 Matus UHLAR - fantomas wrote: On Fri, 6 Jun 2014 02:11:47 -0700 (PDT) zespri wrote: In short: when you get several options offered to you, and you have no prior knowledge you've got to pick one randomly. That's what I did. On 06.06.14 15:14, RW wrote:

Re: Why do I get both URIBL_DBL_SPAM and URIBL_BLOCKED?

2014-06-06 Thread Kris Deugau
RW wrote: On Fri, 6 Jun 2014 16:42:50 +0200 Matus UHLAR - fantomas wrote: I would not be surprised... I have already met people having problem because of djbdns (and that's why I don't recommend using it) What problem did they have specifically with dnscache? Seconded; I'd be interested

Re: Why do I get both URIBL_DBL_SPAM and URIBL_BLOCKED?

2014-06-06 Thread RW
On Fri, 06 Jun 2014 11:35:52 -0400 Kris Deugau wrote: RW wrote: On Fri, 6 Jun 2014 16:42:50 +0200 Matus UHLAR - fantomas wrote: I would not be surprised... I have already met people having problem because of djbdns (and that's why I don't recommend using it) What problem did they

Re: Viagra spam not caught

2014-06-06 Thread Daniele Paoni
On 06/05/2014 09:25 AM, Matus UHLAR - fantomas wrote: Seems the only problems Daniele could solve are obsolete rules and mistrained BAYES database. Hello I deleted the bayes database and trained it using real spamham Today I got another one of these emails, the strange thing is that if I

Re: Why do I get both URIBL_DBL_SPAM and URIBL_BLOCKED?

2014-06-06 Thread Karsten Bräckelmann
On Fri, 2014-06-06 at 11:39 +0200, Matus UHLAR - fantomas wrote: On 06.06.14 02:11, a pseudonymous Nabble user wrote: Well, on the page that the original link led to this page was linked: http://wiki.apache.org/spamassassin/CachingNameserver It also clearly states to use a *non-forwarding*

Re: I'm getting T_DKIM_INVALID from gmail

2014-06-06 Thread Karsten Bräckelmann
On Fri, 2014-06-06 at 00:44 -0700, a pseudonymous Nabble user wrote: For whatever reason if I send an email from gmail when it arrives it's marked with T_DKIM_INVALID. I inspected the original and the result and there are a few differences. By sending from gmail, are you referring to using the

Can't keep up with spam from SolarVPS sites

2014-06-06 Thread Philip Prindeville
We’re getting a lot of spam that contains URL’s which look like (remove the ):

Re: I'm getting T_DKIM_INVALID from gmail

2014-06-06 Thread zespri
Thank you for you reply 1) I used gmail web interface, but now after you asked I tried sending from iPad. Result is somewhat different. There is no multipart content type now, but T_DKIM_INVALID is still present. 2) I looked at the original by going to the gmail web interface and selecting show

Re: Can't keep up with spam from SolarVPS sites

2014-06-06 Thread Axb
If you have to post a spam sample, pls use pastebin and post the full msg On 06/06/2014 11:32 PM, Philip Prindeville wrote: We’re getting a lot of spam that contains URL’s which look like (remove the ):

Re: Can't keep up with spam from SolarVPS sites

2014-06-06 Thread John Hardin
On Fri, 6 Jun 2014, Philip Prindeville wrote: We’re getting a lot of spam that contains URL’s which look like (remove the ):

Re: Can't keep up with spam from SolarVPS sites

2014-06-06 Thread Karsten Bräckelmann
On Fri, 2014-06-06 at 23:50 +0200, Axb wrote: [...] Anyone have some working rules they could share? Pls note than any rule shared via lists usually looses its teeth within a few hours .-) Sorry, that's incorrect. The SA commits mailing list is not code only, but includes rules/ and

Re: I'm getting T_DKIM_INVALID from gmail

2014-06-06 Thread Karsten Bräckelmann
On Fri, 2014-06-06 at 00:44 -0700, a pseudonymous Nabble user wrote: For whatever reason if I send an email from gmail when it arrives it's marked with T_DKIM_INVALID. I inspected the original and the result and there are a few differences. [...] 3) The last and I'm guessing the most

Re: Can't keep up with spam from SolarVPS sites

2014-06-06 Thread Philip Prindeville
On Jun 6, 2014, at 3:50 PM, Axb axb.li...@gmail.com wrote: If you have to post a spam sample, pls use pastebin and post the full msg Here’s a prototype: http://ur1.ca/hgxkx

Re: I'm getting T_DKIM_INVALID from gmail

2014-06-06 Thread Karsten Bräckelmann
On Fri, 2014-06-06 at 14:47 -0700, a pseudonymous Nabble user wrote: Thank you for you reply 1) I used gmail web interface, [...] 2) I looked at the original by going to the gmail web interface and selecting show original In that case, it is not necessarily guaranteed the multipart

Re: Can't keep up with spam from SolarVPS sites

2014-06-06 Thread Karsten Bräckelmann
On Fri, 2014-06-06 at 18:36 -0600, Philip Prindeville wrote: On Jun 6, 2014, at 3:50 PM, Axb axb.li...@gmail.com wrote: If you have to post a spam sample, pls use pastebin and post the full msg Here’s a prototype: http://ur1.ca/hgxkx That Return-Path really sticks out. It's basically the

Capturing Matches for Rules

2014-06-06 Thread Karsten Bräckelmann
On Sat, 2014-06-07 at 03:50 +0200, me wrote: That Return-Path really sticks out. It's basically the From: address with embedded To: address. So, in addition to the From matches To and occasional other situations where remembering matches for subsequent regex based rules would come in handy,

Re: Can't keep up with spam from SolarVPS sites

2014-06-06 Thread John Hardin
On Sat, 7 Jun 2014, Karsten Bräckelmann wrote: On Fri, 2014-06-06 at 18:36 -0600, Philip Prindeville wrote: On Jun 6, 2014, at 3:50 PM, Axb axb.li...@gmail.com wrote: If you have to post a spam sample, pls use pastebin and post the full msg Here’s a prototype: http://ur1.ca/hgxkx That

Re: Can't keep up with spam from SolarVPS sites

2014-06-06 Thread Karsten Bräckelmann
On Fri, 2014-06-06 at 19:02 -0700, John Hardin wrote: On Sat, 7 Jun 2014, Karsten Bräckelmann wrote: That Return-Path really sticks out. It's basically the From: address with embedded To: address. It would be possible to do a multiple-header rule with captures and backreferences to

Re: Can't keep up with spam from SolarVPS sites

2014-06-06 Thread John Hardin
On Sat, 7 Jun 2014, Karsten Bräckelmann wrote: On Fri, 2014-06-06 at 19:02 -0700, John Hardin wrote: On Sat, 7 Jun 2014, Karsten Bräckelmann wrote: That Return-Path really sticks out. It's basically the From: address with embedded To: address. It would be possible to do a multiple-header

Re: Can't keep up with spam from SolarVPS sites

2014-06-06 Thread lucas k
I'm having the exact opposite problem. I've created several new addresses that i'm hoping to get clogged up with spam so that I can have a fluid target to write rules against, but so far... nothing. craig@dioxidized, where i posted a bunch of ads on craigslist with the address exposed has not

Re: Can't keep up with spam from SolarVPS sites

2014-06-06 Thread Karsten Bräckelmann
On Fri, 2014-06-06 at 22:34 -0400, lucas k wrote: I'm having the exact opposite problem. I've created several new addresses that i'm hoping to get clogged up with spam so that I can have a fluid target to write rules against, but so far... nothing. craig@dioxidized, where i posted a bunch