Re: Handling very large messages (was Re: Which milter do you prefer?)

2015-03-16 Thread Axb
On 03/16/2015 10:16 AM, Reindl Harald wrote: Am 16.03.2015 um 03:43 schrieb Dave Warren: On 2015-03-15 17:26, Reindl Harald wrote: Am 16.03.2015 um 01:23 schrieb Dave Warren: On 2015-03-15 15:01, Reindl Harald wrote: surely, only 5% of incoming spam attempts make it to spamassassin /

URI_DOTDOT_LOW_CNTRST false positives?

2015-03-16 Thread Per Jessen
I've recently upgraded to SA 3.4.0 - I'm seeing URI_DOTDOT_LOW_CNTRST scoring on many legitimate mails. E.g. from linkedin and distrelec. For instance: http://files.jessen.ch/Tektronix-4-Kanal-Oszilloskop-deutlich-reduziert-TDS-2024C.eml When the above was processed I noticed this in the log:

Re: URI_DOTDOT_LOW_CNTRST false positives?

2015-03-16 Thread Per Jessen
Axb wrote: On 03/16/2015 11:05 AM, Axb wrote: On 03/16/2015 10:54 AM, Per Jessen wrote: I've recently upgraded to SA 3.4.0 - I'm seeing URI_DOTDOT_LOW_CNTRST scoring on many legitimate mails. E.g. from linkedin and distrelec. For instance:

Re: URI_DOTDOT_LOW_CNTRST false positives?

2015-03-16 Thread Axb
On 03/16/2015 11:43 AM, Per Jessen wrote: Axb wrote: On 03/16/2015 11:28 AM, Per Jessen wrote: Axb wrote: On 03/16/2015 11:05 AM, Axb wrote: On 03/16/2015 10:54 AM, Per Jessen wrote: I've recently upgraded to SA 3.4.0 - I'm seeing URI_DOTDOT_LOW_CNTRST scoring on many legitimate mails.

Re: URI_DOTDOT_LOW_CNTRST false positives?

2015-03-16 Thread Axb
On 03/16/2015 10:54 AM, Per Jessen wrote: I've recently upgraded to SA 3.4.0 - I'm seeing URI_DOTDOT_LOW_CNTRST scoring on many legitimate mails. E.g. from linkedin and distrelec. For instance: http://files.jessen.ch/Tektronix-4-Kanal-Oszilloskop-deutlich-reduziert-TDS-2024C.eml When the above

Re: URI_DOTDOT_LOW_CNTRST false positives?

2015-03-16 Thread Axb
On 03/16/2015 11:05 AM, Axb wrote: On 03/16/2015 10:54 AM, Per Jessen wrote: I've recently upgraded to SA 3.4.0 - I'm seeing URI_DOTDOT_LOW_CNTRST scoring on many legitimate mails. E.g. from linkedin and distrelec. For instance:

Re: URI_DOTDOT_LOW_CNTRST false positives?

2015-03-16 Thread Axb
On 03/16/2015 10:54 AM, Per Jessen wrote: I've recently upgraded to SA 3.4.0 - I'm seeing URI_DOTDOT_LOW_CNTRST scoring on many legitimate mails. E.g. from linkedin and distrelec. For instance: http://files.jessen.ch/Tektronix-4-Kanal-Oszilloskop-deutlich-reduziert-TDS-2024C.eml When the above

Re: URI_DOTDOT_LOW_CNTRST false positives?

2015-03-16 Thread Per Jessen
Axb wrote: On 03/16/2015 11:28 AM, Per Jessen wrote: Axb wrote: On 03/16/2015 11:05 AM, Axb wrote: On 03/16/2015 10:54 AM, Per Jessen wrote: I've recently upgraded to SA 3.4.0 - I'm seeing URI_DOTDOT_LOW_CNTRST scoring on many legitimate mails. E.g. from linkedin and distrelec. For

Re: URI_DOTDOT_LOW_CNTRST false positives?

2015-03-16 Thread Axb
On 03/16/2015 11:28 AM, Per Jessen wrote: Axb wrote: On 03/16/2015 11:05 AM, Axb wrote: On 03/16/2015 10:54 AM, Per Jessen wrote: I've recently upgraded to SA 3.4.0 - I'm seeing URI_DOTDOT_LOW_CNTRST scoring on many legitimate mails. E.g. from linkedin and distrelec. For instance:

Re: Handling very large messages (was Re: Which milter do you prefer?)

2015-03-16 Thread Bill Cole
On 14 Mar 2015, at 12:55, David F. Skoll wrote: [...] I can't answer for Kevin, but what we do is this: For oversize messages, we remove non text/* attachments. If they're still oversize, we truncate the text/plain parts. If they're still oversize, we truncate the text/html parts. We do this

Re: Handling very large messages (was Re: Which milter do you prefer?)

2015-03-16 Thread David F. Skoll
On Mon, 16 Mar 2015 10:51:59 -0400 Bill Cole sausers-20150...@billmail.scconsult.com wrote: Is the code for doing this shared anywhere or is it sharable? Please? It's part of our commercial CanIt software. But I can post a chunk of Perl that's roughly what we do. We parse the message into a

Re: Handling very large messages (was Re: Which milter do you prefer?)

2015-03-16 Thread Bill Cole
On 14 Mar 2015, at 15:17, Robert Schetterer wrote: [...] Am 14.03.2015 um 17:55 schrieb David F. Skoll: [...] I can't answer for Kevin, but what we do is this: For oversize messages, we remove non text/* attachments. If they're still oversize, we truncate the text/plain parts. If they're

Re: Handling very large messages (was Re: Which milter do you prefer?)

2015-03-16 Thread Matus UHLAR - fantomas
On 16.03.15 00:59, Jude DaShiell wrote: I have been getting large spam messages for several years on one of my accounts. Since spamassassin cannot handle them, my only recourse are procmail recipes. spamassassin CAN handle them. I have ocnfigued spamass-milter to process all mail (by setting

Re: Handling very large messages (was Re: Which milter do you prefer?)

2015-03-16 Thread Reindl Harald
Am 16.03.2015 um 18:19 schrieb Matus UHLAR - fantomas: On 16.03.15 00:59, Jude DaShiell wrote: I have been getting large spam messages for several years on one of my accounts. Since spamassassin cannot handle them, my only recourse are procmail recipes. spamassassin CAN handle them. I have

Re: Which milter do you prefer?

2015-03-16 Thread Bill Cole
On 13 Mar 2015, at 17:41, Shane Williams wrote: I've been reviewing the current landscape of anti-spam tools since I haven't set up a new system in a while, and one place I'm wondering what people are using is milters for spamassassin/spamc. It seems like spamass-milter is the default go-to

Re: Handling very large messages (was Re: Which milter do you prefer?)

2015-03-16 Thread Nick Edwards
On 3/15/15, Robert Schetterer r...@sys4.de wrote: Am 14.03.2015 um 20:22 schrieb David F. Skoll: On Sat, 14 Mar 2015 20:17:27 +0100 Robert Schetterer r...@sys4.de wrote: Ok, but big spam mails are extrem rare, i wouldnt invest time in that They are quite rare, but common enough IMO that our

Re: Handling very large messages (was Re: Which milter do you prefer?)

2015-03-16 Thread Robert Schetterer
Am 16.03.2015 um 18:33 schrieb Reindl Harald: Am 16.03.2015 um 18:19 schrieb Matus UHLAR - fantomas: On 16.03.15 00:59, Jude DaShiell wrote: I have been getting large spam messages for several years on one of my accounts. Since spamassassin cannot handle them, my only recourse are

Re: Handling very large messages (was Re: Which milter do you prefer?)

2015-03-16 Thread Reindl Harald
Am 16.03.2015 um 19:24 schrieb Robert Schetterer: Am 16.03.2015 um 18:33 schrieb Reindl Harald: Am 16.03.2015 um 18:19 schrieb Matus UHLAR - fantomas: On 16.03.15 00:59, Jude DaShiell wrote: I have been getting large spam messages for several years on one of my accounts. Since spamassassin

Re: URI_DOTDOT_LOW_CNTRST false positives?

2015-03-16 Thread Benny Pedersen
On March 16, 2015 10:55:22 AM Per Jessen p...@computer.org wrote: spamd[865]: dns: new_dns_packet (domain=chde..distrelec.com. type=A class=IN) failed: a domain name contains a null label uri with ..

Re: Handling very large messages (was Re: Which milter do you prefer?)

2015-03-16 Thread Robert Schetterer
Am 16.03.2015 um 19:30 schrieb Reindl Harald: Am 16.03.2015 um 19:24 schrieb Robert Schetterer: Am 16.03.2015 um 18:33 schrieb Reindl Harald: Am 16.03.2015 um 18:19 schrieb Matus UHLAR - fantomas: On 16.03.15 00:59, Jude DaShiell wrote: I have been getting large spam messages for several

Re: Which milter do you prefer?

2015-03-16 Thread Lucio Chiappetti
On Fri, 13 Mar 2015, Patrick Ben Koetter wrote: amavisd-new via amavisd-milter. That what's we got since 2006. Since 2011 spamassassin is second choice after graylisting (i.e. it rejects what graylisting let through)

Re: Handling very large messages (was Re: Which milter do you prefer?)

2015-03-16 Thread Reindl Harald
Am 16.03.2015 um 03:43 schrieb Dave Warren: On 2015-03-15 17:26, Reindl Harald wrote: Am 16.03.2015 um 01:23 schrieb Dave Warren: On 2015-03-15 15:01, Reindl Harald wrote: surely, only 5% of incoming spam attempts make it to spamassassin / clamav here, but you need to keep in mind the