Re: RCVD_IN_DNSWL_HI false positives

2021-05-12 Thread Michael B Allen
On Wed, May 12, 2021 at 10:26 PM Arne Jensen wrote: > Den 13-05-2021 kl. 02:19 skrev Michael B Allen: > > On Wed, May 12, 2021 at 6:10 PM Matthias Leisi wrote: > >>> That is unfortunate. It's not entirely crystal clear to me that > >>> deliberatel

Re: RCVD_IN_DNSWL_HI false positives

2021-05-12 Thread Michael B Allen
On Wed, May 12, 2021 at 6:10 PM Matthias Leisi wrote: > > > That is unfortunate. It's not entirely crystal clear to me that > > deliberately returning false positives that allow potentially > > destructive SPAM to get through filters is a good way to enforce usage > > policy. > > We use the „retur

Re: RCVD_IN_DNSWL_HI false positives

2021-05-12 Thread Michael B Allen
On Wed, May 12, 2021 at 5:01 PM Matthias Leisi wrote: > > Am 12.05.2021 um 21:02 schrieb Michael B Allen : > > > X-Spam-Report: > > * -5.0 RCVD_IN_DNSWL_HI RBL: Sender listed at https://www.dnswl.org/, high > > * trust > > * [173.82.162.98 listed in lis

RCVD_IN_DNSWL_HI false positives

2021-05-12 Thread Michael B Allen
Hi all, Because of RCVD_IN_DNSWL_HI a bunch of SEO type stuff is getting through. Strangely the domains are not listed in www.dnswl.org like the one below is "fixtheweberrors.online": IP address 173.82.162.98 is not whitelisted at dnswl.org. Most of it is .online stuff. What am I missing? How

Keyword Whitelist?

2017-01-11 Thread Michael B Allen
Is there a way to add a rule that simply matches specific key words? For example, if someone actually names my product it's basically guaranteed not to be spam. In this case, I want to just whitelist it (or maybe apply -10 to the score). Any pointers would be appreciated. Mike

Re: Testing Spamminess of Own Mail

2017-01-11 Thread Michael B Allen
On Wed, Jan 11, 2017 at 10:31 AM, Antony Stone wrote: > On Wednesday 11 January 2017 at 16:22:13, Michael B Allen wrote: > >> On Wed, Jan 11, 2017 at 10:03 AM, Antony Stone wrote: >> > On Wednesday 11 January 2017 at 15:57:20, Michael B Allen wrote: >> >> Is

Re: Testing Spamminess of Own Mail

2017-01-11 Thread Michael B Allen
On Wed, Jan 11, 2017 at 10:03 AM, Antony Stone wrote: > On Wednesday 11 January 2017 at 15:57:20, Michael B Allen wrote: > >> Is it possible to send a message to myself to see what SA thinks of my mail >> rig? > >> If I just send a message from one account to another, o

Testing Spamminess of Own Mail

2017-01-11 Thread Michael B Allen
Is it possible to send a message to myself to see what SA thinks of my mail rig? I'm using CentOS 7.2, spamassassin 3.4.0 and postfix 2.10 and running spamd + spamc in postfix master.cf > sendmail > procmail > .Spam folder. If I just send a message from one account to another, of course it never

Re: [solved] Debugging Scores

2017-01-10 Thread Michael B Allen
On Tue, Jan 10, 2017 at 11:03 AM, Axb wrote: > On 01/10/2017 04:49 PM, Michael B Allen wrote: >>>> >>>> PS: Is it possible to see what values are associated with all tags for >>>> debugging purposes? Meaning can I run a command that dumps a list of >&

Re: Increase BAYES_99 score?

2017-01-10 Thread Michael B Allen
On Tue, Jan 10, 2017 at 3:33 AM, Tom Hendrikx wrote: > > > On 10-01-17 07:07, Michael B Allen wrote: >> If I understand correctly, the BAYES_X tags add a value corresponding >> to the X value. So BAYES_99 is basically adding 0.99 to the spam >> score? > > This is

Debugging Scores

2017-01-10 Thread Michael B Allen
>> PS: Is it possible to see what values are associated with all tags for >> debugging purposes? Meaning can I run a command that dumps a list of >> all tags and their associated values so that I can decide which tags >> could have their scores adjusted? > > You can grep for the scores in /var/lib/

Filter Non-ISO-8859-1 Text

2017-01-10 Thread Michael B Allen
>> PS2: Is there a tag that indicates that the message contains a large >> amount of non-latin1 text? I do get a lot of legitimate non-ISO-8859-1 >> messages but usually it's just a name or at most an address. So less >> than 100 bytes. >> > > Please start a new thread and show us a sample of such

Increase BAYES_99 score?

2017-01-09 Thread Michael B Allen
If I understand correctly, the BAYES_X tags add a value corresponding to the X value. So BAYES_99 is basically adding 0.99 to the spam score? Ideally I feel it should be possible to scale this value such as by using simple multiplication or even exponentially. Is it possible to increase the score

Re: No BAYES_XX tags in X-Spam-Report

2015-06-23 Thread Michael B Allen
On Tue, Jun 23, 2015 at 12:48 PM, Bill Cole wrote: >> Yes, I want a system-wide bayes db. And I am running spamd and spamc >> and I assume that is all working (but of course I have no idea if it >> really is). >> >> But I want users to be able to put spams that get through into >> ~/Maildir/.Learn

Re: No BAYES_XX tags in X-Spam-Report

2015-06-22 Thread Michael B Allen
On Mon, Jun 22, 2015 at 10:42 PM, Bill Cole wrote: > On 22 Jun 2015, at 21:45, Michael B Allen wrote: > >> On Mon, Jun 22, 2015 at 8:01 PM, Reindl Harald >> wrote: >>>> >>>> [root@www .spamassassin]# pwd >>>> /var/log/spamassassin/.spamass

Re: No BAYES_XX tags in X-Spam-Report

2015-06-22 Thread Michael B Allen
On Mon, Jun 22, 2015 at 9:45 PM, Michael B Allen wrote: > and after running sa-learn again (as root) on ham, my db is now broken: > > [root@www .spamassassin]# sa-learn --dump magic > bayes: bayes db version 0 is not able to be used, aborting! at > /usr/share/perl5/vendor_perl/Ma

Re: No BAYES_XX tags in X-Spam-Report

2015-06-22 Thread Michael B Allen
On Mon, Jun 22, 2015 at 8:01 PM, Reindl Harald wrote: >> [root@www .spamassassin]# pwd >> /var/log/spamassassin/.spamassassin >> [root@www .spamassassin]# ls -la >> total 1100 >> drwx-- 2 spamd spamd4096 Jun 22 19:42 . >> drwx-- 3 spamd spamd4096 Jun 7 00:41 .. >> -rw--- 1 spa

No BAYES_XX tags in X-Spam-Report

2015-06-22 Thread Michael B Allen
How can I tell if SA is tagging using bayes? [root@www .spamassassin]# pwd /var/log/spamassassin/.spamassassin [root@www .spamassassin]# ls -la total 1100 drwx-- 2 spamd spamd4096 Jun 22 19:42 . drwx-- 3 spamd spamd4096 Jun 7 00:41 .. -rw--- 1 spamd spamd 45056 Jun 22 19:42

Re: Must-Have Plugins?

2015-06-11 Thread Michael B Allen
On Thu, Jun 11, 2015 at 10:03 AM, RW wrote: > On Wed, 10 Jun 2015 18:45:10 -0400 > Michael B Allen wrote: > >> On Wed, Jun 10, 2015 at 9:56 AM, David Jones wrote: >> >>> given that install unbound as local resolver takes 2 minutes it's >> >&g

Re: Must-Have Plugins?

2015-06-10 Thread Michael B Allen
On Wed, Jun 10, 2015 at 9:56 AM, David Jones wrote: >>> given that install unbound as local resolver takes 2 minutes it's even not >>> worth to argue on that topic and a spamfilter without RBL's and URIBL's is >>> just nonsense > >>I have installed a caching DNS server before (albeit probably abou

Re: Must-Have Plugins?

2015-06-10 Thread Michael B Allen
On Wed, Jun 10, 2015 at 7:25 AM, Reindl Harald wrote: > > > Am 10.06.2015 um 13:21 schrieb Kevin A. McGrail: >> >> On 6/10/2015 12:45 AM, Michael B Allen wrote: >>> >>> But I just can't >>> bring myself to install a caching DNS server and run e

Re: Must-Have Plugins?

2015-06-09 Thread Michael B Allen
On Tue, Jun 9, 2015 at 8:36 AM, David Jones wrote: >>>On 08.06.15 23:03, Michael B Allen wrote: >>>So I have had SA running for about 2 days on a very small site with a >>>handful of users. I've been running the default config just to see how >>>well it

Must-Have Plugins?

2015-06-08 Thread Michael B Allen
So I have had SA running for about 2 days on a very small site with a handful of users. I've been running the default config just to see how well it would do by itself. Unfortunately quite a lot of spam is getting through. So far 40 of 142 spams have passed. So my question is, what is the best way

Better Post Processing

2015-06-06 Thread Michael B Allen
Right now I'm using procmail to put spam in user's .Spam Maildir folder and then periodically just manually running sa-learn on .LearnAsSpam and then deleting everything from both folders. This is obviously not ideal since it's a) manual and b) deletes everything and so there's no way to look into

Re: Basic Setup Questions

2010-06-27 Thread Michael B Allen
in the future and see if the "stock" SA ruleset can do the job before I seek out a third party ruleset. > Are you quitting the Java mess to enter into the Perl one? ;) Every language has it's niche. Filtering SPAM seems like the ideal task for the Pathologically Eclectic Rubbish Lister. Mike -- Michael B Allen Java Active Directory Integration http://www.ioplex.com/

Basic Setup Questions

2010-06-27 Thread Michael B Allen
Hello, I have just setup spamassassin. A lot of spam is getting filtered. But a lot is not. What are the prevailing additional steps for improving filtering? Is using bayes worth it? My default config does not appear to be using bayes. How do I enable it? The documentation simply says "run sa-l

Whitelisting PayPal "Notification of payment" Messages

2008-03-13 Thread Michael B Allen
Hi, I really have my HTML rules cranked up and it's killing my PayPal payment notifications. I can't whitelist by From because PayPal sends the notifications from the person sending the money and not an address in the paypal.com domain. How can I whitelist these messages? Is there some way to wh

More Sophisticated Score Adjustments?

2007-06-17 Thread Michael B Allen
Hi, Is there any way to adjust groups of tests like increasing all HTML_IMAGE_ONLY_* tests by +1.0? Mike

Re: Turning the Screws

2007-06-17 Thread Michael B Allen
Hi Jerry, I added a bunch of other SARE cfs and I'm doing much much better now. Although rule_du_jour is still giving me HTML for SARE_OEM. Thanks to all who helped, Mike On Sun, 17 Jun 2007 12:45:34 -0700 Jerry Durand <[EMAIL PROTECTED]> wrote: > 70_sare_oem.cf -- Micha

Re: Turning the Screws

2007-06-17 Thread Michael B Allen
Hi, With only SARE_STOCKS EVILNUMBERS0 SARE_RANDOM I'm still getting quite a bit of spam. What SARE rule do people recommend? Is it ok to have a lot of them? Mike

Re: Turning the Screws

2007-06-16 Thread Michael B Allen
On Sat, 16 Jun 2007 17:02:29 -0500 Lindsay Haisley <[EMAIL PROTECTED]> wrote: > On Sat, 2007-06-16 at 17:53 -0400, Michael B Allen wrote: > > When I run ./rules_du_jour I just get a mess of errors about trying > > to write to /etc/spamassassin which does not exist. > &g

Re: Turning the Screws

2007-06-16 Thread Michael B Allen
On Sat, 16 Jun 2007 16:25:48 -0500 Daniel J McDonald <[EMAIL PROTECTED]> wrote: > On Sat, 2007-06-16 at 17:01 -0400, Michael B Allen wrote: > > Hi, > > > > I just setup a new server with vanilla SA > > What version? 3.1.9 on CentOS 5 > > on CentO

Turning the Screws

2007-06-16 Thread Michael B Allen
Hi, I just setup a new server with vanilla SA on CentOS 5 and a lot of obvious drug/stock/foreign stuff is getting through. I have verified that DNSBL is being used. In general, I would like to know what the prevailing wisdom is as to increasing the agressiveness of my filter. Are there certain p

Re: Pls explain my false positive

2007-06-15 Thread Michael B Allen
On Fri, 15 Jun 2007 11:42:43 -0400 Theo Van Dinter <[EMAIL PROTECTED]> wrote: > On Fri, Jun 15, 2007 at 10:00:43AM -0400, Michael B Allen wrote: > > X-Spam-Status: Yes, score=5.3 required=5.0 tests=AWL autolearn=no > > version=3.1.9 > > X-Spam-Report: > >

Pls explain my false positive

2007-06-15 Thread Michael B Allen
Hi, I just installed SA on a stock CentOS 5 machine. I forwarded a spam to it and it worked. Then I sent a very short "hi" message that I would expect should make it through but it did not. >From looking at the X-Spam headers: X-Spam-Status: Yes, score=5.3 required=5.0 tests=AWL autolearn=no ver