Re: Which SA test can detect/score this (fairly common) 'freemail' whack-a-mole?

2016-06-25 Thread jasonsu
Noel On Sat, Jun 25, 2016, at 06:31 PM, Noel Butler wrote: > ignoring the usual trolls Benny and Harry (Reindl) got it > " loadplugin Mail::SpamAssassin::Plugin::FreeMail " is actually loaded? yep > /var/lib/spamassassin/3.004001/updates_spamassassin_org/20_freemail.cf I think that's it.

Re: Which SA test can detect/score this (fairly common) 'freemail' whack-a-mole?

2016-06-25 Thread Benny Pedersen
On 2016-06-26 02:14, Reindl Harald wrote: Am 26.06.2016 um 02:02 schrieb Benny Pedersen: On 2016-06-26 01:47, Reindl Harald wrote: Authentication-Results: spf.mail.example.com; spf=softfail (domain owner discourages use of this host) smtp.mailfrom=gmail.com (client-ip=212.82.96.171; helo=

Re: Which SA test can detect/score this (fairly common) 'freemail' whack-a-mole?

2016-06-25 Thread Reindl Harald
Am 26.06.2016 um 02:02 schrieb Benny Pedersen: On 2016-06-26 01:47, Reindl Harald wrote: Authentication-Results: spf.mail.example.com; spf=softfail (domain owner discourages use of this host) smtp.mailfrom=gmail.com (client-ip=212.82.96.171; helo=nm12-vm1.bullet.mail.ir2.yahoo.com; envelo

Re: Which SA test can detect/score this (fairly common) 'freemail' whack-a-mole?

2016-06-25 Thread jasonsu
Huh? > and its asked why do i get spam with spf softfails No, I'm not asking about the 'softfail'. At all. > recipient have wanted that spam Um, no. > possible spam that is not spam but relaying fails Again, huh? I'm asking a simple question -- what SA test detects the multiple freemail b

Re: Which SA test can detect/score this (fairly common) 'freemail' whack-a-mole?

2016-06-25 Thread Benny Pedersen
On 2016-06-26 01:47, Reindl Harald wrote: Authentication-Results: spf.mail.example.com; spf=softfail (domain owner discourages use of this host) smtp.mailfrom=gmail.com (client-ip=212.82.96.171; helo=nm12-vm1.bullet.mail.ir2.yahoo.com; envelope-from=mrs.djoe...@gmail.com; receiver=u...@exam

Re: Which SA test can detect/score this (fairly common) 'freemail' whack-a-mole?

2016-06-25 Thread Reindl Harald
Am 26.06.2016 um 01:06 schrieb Benny Pedersen: On 2016-06-26 00:29, jaso...@mail-central.com wrote: Authentication-Results: dmarc.mail.example.com/876fg6sdf6876498f; dmarc=none header.from=gmail.com https://dane.sys4.de/smtp/gmail.com Authentication-Results: dkim.mail.example.com/8

Re: Which SA test can detect/score this (fairly common) 'freemail' whack-a-mole?

2016-06-25 Thread Benny Pedersen
Sorry, I really don't understand any of that. and this is my problem What relevance are the links to dane.sys4.de, and the rest of the comments? same as mangled example.org ? Like I said, I'm asking about 'freemail' detection in SA, why they're not used here, and how to config correctly

Re: Which SA test can detect/score this (fairly common) 'freemail' whack-a-mole?

2016-06-25 Thread jasonsu
> https://dane.sys4.de/smtp/gmail.com > https://dane.sys4.de/smtp/yahoo.com > so why not reject softfail based on it ? > oh yahoo client use gmail, hmm :=) > that user should use smtp auth on gmail, not use yahoo smtp servers for > relaying > and note DNSS

Re: Which SA test can detect/score this (fairly common) 'freemail' whack-a-mole?

2016-06-25 Thread Benny Pedersen
On 2016-06-26 00:29, jaso...@mail-central.com wrote: Authentication-Results: dmarc.mail.example.com/876fg6sdf6876498f; dmarc=none header.from=gmail.com https://dane.sys4.de/smtp/gmail.com Authentication-Results: dkim.mail.example.com/876fg6sdf6876498f; dkim=pass (2048

Which SA test can detect/score this (fairly common) 'freemail' whack-a-mole?

2016-06-25 Thread jasonsu
An inbound spam was caught by SpamAssassin, flagged with BAYES_50=0.8 DCC_CHECK=1.1 DIGEST_MULTIPLE=0.293 HTML_MESSAGE=0.001 MIME_HTML_MOSTLY=0.428 MISSING_HEADERS=1.021 PYZOR_CHECK=2.5 REPLYTO_WITHOUT_TO_CC=1.552 To get to SA, it sn