Re: RCVD_IN_DNSWL

2022-05-13 Thread Jeff Koch
See below: On 5/13/2022 8:41 PM, Arne Jensen wrote: Den 13-05-2022 kl. 23:42 skrev Jeff Koch: We're getting numerous false positives on 'RCVD_IN_DNSWL_HI RBL'. When I check these IP's (193.106.175.39, for example) at https://www.dnswl.org they are NOT listed.    * -5.0

Re: RCVD_IN_DNSWL

2022-05-13 Thread Arne Jensen
Den 13-05-2022 kl. 23:42 skrev Jeff Koch: We're getting numerous false positives on 'RCVD_IN_DNSWL_HI RBL'. When I check these IP's (193.106.175.39, for example) at https://www.dnswl.org they are NOT listed.    * -5.0 RCVD_IN_DNSWL_HI RBL: Sender listed at https://www.dnswl.org/,

RCVD_IN_DNSWL

2022-05-13 Thread Jeff Koch
Hi: We're getting numerous false positives on 'RCVD_IN_DNSWL_HI RBL'. When I check these IP's (193.106.175.39, for example) at https://www.dnswl.org they are NOT listed.    * -5.0 RCVD_IN_DNSWL_HI RBL: Sender listed at https://www.dnswl.org/, high    *  trust   

Re: Rule to detect non-standard headers that aren't X- prefixed

2022-05-13 Thread Philip Prindeville
> On May 11, 2022, at 9:24 AM, John Hardin wrote: > > On Tue, 10 May 2022, Philip Prindeville wrote: > >> Anyone have a rule to detect the following nonsense headers seen in this >> message I got? >> >> Return-Path: >> Received: from cp24.deluxehosting.com (cp24.deluxehosting.com >>

Re: Rule to detect non-standard headers that aren't X- prefixed

2022-05-13 Thread Henrik K
On Fri, May 13, 2022 at 12:22:48PM -0600, Philip Prindeville wrote: > > How do you look at what a rule is matching? I've never figured that out... Debug output: spamassassin -t -D rules < message.eml 2>&1 | grep 'got hit'

Re: Rule to detect non-standard headers that aren't X- prefixed

2022-05-13 Thread Philip Prindeville
> On May 11, 2022, at 1:53 AM, Henrik K wrote: > > On Wed, May 11, 2022 at 10:49:32AM +0300, Henrik K wrote: >> On Wed, May 11, 2022 at 10:44:05AM +0300, Henrik K wrote: >>> On Tue, May 10, 2022 at 06:19:38PM -0600, Philip Prindeville wrote: See my original message. I can't

Re: Rule to detect non-standard headers that aren't X- prefixed

2022-05-13 Thread Philip Prindeville
> On May 11, 2022, at 1:44 AM, Henrik K wrote: > > On Tue, May 10, 2022 at 06:19:38PM -0600, Philip Prindeville wrote: >> See my original message. >> >> I can't think of a single way to match each header, and then test for any of >> them not matching the pattern... > > Simply use regex

Re: LONGLN_LOW_CONTRAST

2022-05-13 Thread Bill Cole
On 2022-05-13 at 07:45:40 UTC-0400 (Fri, 13 May 2022 04:45:40 -0700) jdow is rumored to have said: Has anybody else noticed this rule is hitting rather often since Thunderbird has changed to a gray fond rather than black font for their default? Not so much. Still just a 100% spam small

LONGLN_LOW_CONTRAST

2022-05-13 Thread jdow
Has anybody else noticed this rule is hitting rather often since Thunderbird has changed to a gray fond rather than black font for their default? {o.o}