Re: X-Relay-Countries not working

2018-11-27 Thread Dominic Raferd
On Wed, 28 Nov 2018 at 06:15, Brent Clark wrote: > Thanks for replying > > I did as you asked, here is the pastebin > > https://pastebin.com/XqSXndpW > > I could not see anything like you describe (i.e "I've found that the > plugin will fallback to the 'fast' version ...") > > It looks like KR

Re: X-Relay-Countries not working

2018-11-27 Thread Vitali Quiering
Try removing the eval in the actual code that calls the database file temporarily and check if there are perl modules missing. I‘ve been there too and had to install some maxmind reader and database modules. If they are missing, you‘ll see an error in the debug log then. Vitali > Am 28.11.2018

Re: X-Relay-Countries not working

2018-11-27 Thread Brent Clark
Thanks for replying I did as you asked, here is the pastebin https://pastebin.com/XqSXndpW I could not see anything like you describe (i.e "I've found that the plugin will fallback to the 'fast' version ...") It looks like KR is getting found but if you look at the pastebin below, it does

Re: spoofing mail

2018-11-27 Thread Dominic Raferd
On Wed, 28 Nov 2018 at 01:57, Rick Gutierrez wrote: > El mar., 27 nov. 2018 a las 16:22, David Jones () > escribió: > > > > > Can you send a copy of the original email lightly redacted via pastebin > > so I can run it through my filters to give some pointers? > > > > -- > > David Jones > > Hi

Re: spoofing mail

2018-11-27 Thread Rick Gutierrez
El mar., 27 nov. 2018 a las 16:22, David Jones () escribió: > > Can you send a copy of the original email lightly redacted via pastebin > so I can run it through my filters to give some pointers? > > -- > David Jones Hi David , the email is very simple, but I attach it in the following link

Re: spoofing mail

2018-11-27 Thread David Jones
On 11/27/18 11:22 AM, Rick Gutierrez wrote: > El mar., 27 nov. 2018 a las 11:14, Alan Hodgson > () escribió: > >> >> Wow, that's hard to read. >> >> It was close to being tagged because of the Pakistan relay. Just add a few >> points for Word docs and you should be good. Word docs from spammy

Re: Custom DMARC_FAIL rule

2018-11-27 Thread David Jones
On 11/27/18 7:46 AM, RW wrote: > On Mon, 26 Nov 2018 20:13:12 -0500 > Robert Fitzpatrick wrote: > >> I have the following custom rules working pretty well in testing, but >> ran into this message with two "Authentication-Results" headers: >> >>> Authentication-Results: mx3.webtent.org; dmarc=none

Re: spoofing mail

2018-11-27 Thread Rick Gutierrez
El mar., 27 nov. 2018 a las 11:54, Alan Hodgson () escribió: > > > > Malware/phishes are usually either in an attachment or the message has a > link. Personally I add a lot of points to either if they come through > questionable countries. Users can dig them out of their Junk if they happen >

Re: spoofing mail

2018-11-27 Thread Alan Hodgson
On Tue, 2018-11-27 at 11:22 -0600, Rick Gutierrez wrote: > El mar., 27 nov. 2018 a las 11:14, Alan Hodgson > () escribió: > > > Wow, that's hard to read. > > > > It was close to being tagged because of the Pakistan relay. Just > > add a few points for Word docs and you should be good. Word docs

Re: spoofing mail

2018-11-27 Thread Rick Gutierrez
El mar., 27 nov. 2018 a las 11:14, Alan Hodgson () escribió: > > Wow, that's hard to read. > > It was close to being tagged because of the Pakistan relay. Just add a few > points for Word docs and you should be good. Word docs from spammy countries > should really get a lot of points. Hi Alan

Re: spoofing mail

2018-11-27 Thread Alan Hodgson
On Tue, 2018-11-27 at 10:42 -0600, Rick Gutierrez wrote: > Hi , I have a situation a little complicated, I have emails from > spammers that come with the name of one of my users, but the email > address is not from my domain , they send it from a valid domain, > which complies with spf, DKIM etc

--virtual-config-dir=pattern is not substituted

2018-11-27 Thread Eggert Ehmke
I have Spamassassin running on Debian with Postfix, Dovecot etc. It seems to work, Spam is filtered to my Quarantine. I have some virtual mailboxes in /var/mail/vhosts and have set up the Option -x --virtual-config-dir=/var/mail/vhosts/%d/%l/spamassassin This does not work, in the log file

spoofing mail

2018-11-27 Thread Rick Gutierrez
Hi , I have a situation a little complicated, I have emails from spammers that come with the name of one of my users, but the email address is not from my domain , they send it from a valid domain, which complies with spf, DKIM etc etc, some idea that could help me to adjust my spamassassin and

Re: Is $THIS possible?

2018-11-27 Thread Grant Taylor
Hi Giovanni, On 11/27/2018 12:56 AM, Giovanni Bechis wrote: I do not know if it's viable for your own use but amavisd penpal feature could be an option (https://www.ijs.si/software/amavisd/#features-spam) It creates a redis database where it correlates outbound msg-id and replies so it can

Re: X-Relay-Countries not working

2018-11-27 Thread RW
On Tue, 27 Nov 2018 12:51:40 +0200 Brent Clark wrote: > Good day Guys > > I have the following spam email, and I picked up that the plugin > 'Mail::SpamAssassin::Plugin::RelayCountry', is not picking up Korea. > > https://pastebin.com/i45KsgVk Try running it through spamassassin -D

Re: X-Relay-Countries not working

2018-11-27 Thread Matus UHLAR - fantomas
On 27.11.18 12:51, Brent Clark wrote: I have the following spam email, and I picked up that the plugin 'Mail::SpamAssassin::Plugin::RelayCountry', is not picking up Korea. https://pastebin.com/i45KsgVk header RELAYCOUNTRY_BAD X-Relay-Countries =~ /^(CN|RU|SU|IN|BR|UA|KR)/ describe

Re: Custom DMARC_FAIL rule

2018-11-27 Thread RW
On Mon, 26 Nov 2018 20:13:12 -0500 Robert Fitzpatrick wrote: > I have the following custom rules working pretty well in testing, but > ran into this message with two "Authentication-Results" headers: > > > Authentication-Results: mx3.webtent.org; dmarc=none (p=none > > dis=none)

X-Relay-Countries not working

2018-11-27 Thread Brent Clark
Good day Guys I have the following spam email, and I picked up that the plugin 'Mail::SpamAssassin::Plugin::RelayCountry', is not picking up Korea. https://pastebin.com/i45KsgVk header RELAYCOUNTRY_BAD X-Relay-Countries =~ /^(CN|RU|SU|IN|BR|UA|KR)/ describe RELAYCOUNTRY_BAD Relayed through