Sorry for the OT post, but the simscan list appears to be completely dead
and I need to figure this out. I've used simscan in the past with no
problems; I just can't figure out what's happening to spam scoring higher
than 6.0 but less than 12.0, so anybody who's familiar with the latest
On Wed, 17 Dec 2008, LuKreme wrote:
On 16-Dec-2008, at 23:57, ram wrote:
http://www.surbl.org/usage-policy.html
I did the 'request a quote'. For 3,000 users and 550,000 emails a day (hey,
i was just making up numbers here) the cost is US$600/year. If you're a
non-profit it's $500/year
Of the fair amount of false negatives that get through, more than 90% of
them appear to hit on URIBL_BLACK. I have incrementally increased it
recently to a score of 5.0 (I hit on 6.0). The stuff that's still getting
through seems to be hitting on only URIBL_BLACK.
I am very tempted to
. Looking through the 631 domains
that did not have enough points to be classed as spam, I didn't see more
than one or two that shouldn't have been blocked. granted, i did not
look through the emails themselves, just the domain name.
I'm currently scoring it 1.0, and might raise it up to 2.0
On Wed, 24 Sep 2008, [EMAIL PROTECTED] wrote:
I was actually hoping to use it like I use zen.spamhaus.org and dul.sorbs.net
and just reject emails listed on those. It is very rare that I get a false
positive from either, but their efficacy isn't what it used to be, either.
So, I just
Getting back to the subject...can anyone enlighten us to the efficacy of
this DNSBL? For example, how does it compare to zen.spamhaus.org, varius
DUL type lists, etc. I would love to reject more before SA gets involved.
James Smallacombe PlantageNet, Inc. CEO and
We're suddenly getting a ton of spam with koi8-r encoding...I tried to do
a custom rule for it like this:
header SUBJ_RUSS_CHAR Subject =~/koi8-r/i
describe SUBJ_RUSS_CHAR has Russian char encoding
score SUBJ_RUSS_CHAR3.5
The short headers for these spams look like
On Thu, 14 Feb 2008, Per Jessen wrote:
[EMAIL PROTECTED] wrote:
We're suddenly getting a ton of spam with koi8-r encoding...I tried to
do a custom rule for it like this:
header SUBJ_RUSS_CHAR Subject =~/koi8-r/i
describe SUBJ_RUSS_CHAR has Russian char encoding
I just performed a routine sa-update (just on stock SA rules, no SARE) and
the scores are no longer appearing in the message headers, and spam isn't
being filtered. The log shows the following:
Jul 10 09:26:39 mail spamd[37580]: spamd: result: . 0 - SARE_DIPLOMA2
He's hitting on 2 different DUL rules, because he's sending directly from
his DSL IP to your S/A server. You need to whitelist his IP address, or
otherwise have it bypasss S/A scanning.
On Tue, 5 Dec 2006, John Tice wrote:
I have a new client whose mail is scoring way high... several others
I've been running SA on 5.6.1, but I'm building a new FreeBSD box and its
prefered version is 5.8. I noticed that in the SA docs, it mentions
performance problems with 5.8.
FreeBSD has version 5.6.2 in ports, but I seem to recall that one
shouldn't use perl versions that ended in even numbers,
On Wed, 2 Aug 2006, Andrzej Adam Filip wrote:
Steven W. Orr [EMAIL PROTECTED] writes:
On Wednesday, Aug 2nd 2006 at 13:50 -0700, quoth Derek Harding:
=On Wed, 2006-08-02 at 16:37 -0400, Tom Ray wrote:
= Anyone serious about stopping SPAM should not use SpamCop. They have no
= real
I've seen this before, but it's been a while. An AOL user who's on
Verizon DSL, sends an email that trips two DNS BLs in SA. This user's
Verizon DSL IP is listed for being an open relay, which it may or may not
be, since this is presumably a dynamic IP The mail is then relayed
through AOL's
, and smtp connections are stacking up behind it
and occasionally spamd is so overwhelmed a spam gets through with no
checks. CPU also spikes up to over 20.0 at times, on a dual Xeon server
with maybe a thousand mailboxes.
In the logs, the only thing I see that's showing an issue with SA
children from 15 to 25, yet it still seems to be spending
most of it's time at 25, and smtp connections are stacking up behind
it and occasionally spamd is so overwhelmed a spam gets through with
no checks. CPU also spikes up to over 20.0 at times, on a dual Xeon
server with maybe a thousand
On Wed, 31 May 2006 [EMAIL PROTECTED] wrote:
[EMAIL PROTECTED] wrote:
A couple of days after an upgrade from 3.0.4 to 3.1.2, I'm noticing
that it seems alot slower. I turned off most network tests,
including DCC, Pyzor and Razor and it still looks like there's an
issue.
Is it possible
On Wed, 31 May 2006, Theo Van Dinter wrote:
On Wed, May 31, 2006 at 11:12:03AM -0400, [EMAIL PROTECTED] wrote:
May 31 07:53:52 mail spamd[59117]: Use of uninitialized value in
subtraction (-) at
/usr/local/lib/perl5/site_perl/5.6.1/Mail/SpamAssassin/Locker/UnixNFSSafe.pm
line 102,
On Wed, 31 May 2006 [EMAIL PROTECTED] wrote:
On Wed, 31 May 2006, Theo Van Dinter wrote:
On Wed, May 31, 2006 at 11:12:03AM -0400, [EMAIL PROTECTED] wrote:
May 31 07:53:52 mail spamd[59117]: Use of uninitialized value in
subtraction (-) at
I upgraded from 3.0.4 yesterday without too much trouble...once I got
3.1.2 online, I noticed a nice reduction in false negatives, and cpu
remained low (holiday here in US).
This morning, spamd died with no warning, except of course a huge increase
in spam. Nothing in /var/log/messages, and
On Thu, 27 Apr 2006, Theo Van Dinter wrote:
On Wed, Apr 26, 2006 at 05:32:45PM -0400, Joe Flowers wrote:
Any educated guesses on when 3.1.2 will be released?
From a selfish point of view, I'm trying to kill several upgrades with
one stone.
I was hoping to get it out this month, but I
On Thu, 16 Feb 2006, mouss wrote:
Matt Kettler a ?crit :
Philip Prindeville wrote:
Well, I could whitelist the list sender, but the MAIL FROM: includes a
monotonically increasing integer... so it's never the same string twice.
That's sort of shoots us in the foot, doesn't it? ;-)
I've had a couple of these since upgrading to 3.0.4. Headers with NO IP
address in it, just this:
Received: from localhost by (our server)
I assume that if it's not a bug on my end, some users and/or servers are
sending out from 127.0.0.1, which in turn sets off:
On Thu, 26 May 2005, Joe Zitnik wrote:
I think points can be made for both sides of the argument. The thing
that makes bayes different, is that a well trained bayes database is
specific to your environment. If you're a law firm, your learned ham is
going to be heavy in legalese, medical
(running 3.0.2) Nearly all spam that gets through is being tagged as
BAYES_00 since I started using sbl_xbl at the smtp level (before that,
alot more was hitting).
I've been using the same corpus with daily manual additions of my own, and
also using 70_sare_bayes_poison_nxm.cf to prevent this
I'm suddenly getting errors on both custom and built-in rules in my
maillog:
Feb 6 23:20:28 mail spamd[66363]: Subroutine PORN_16_body_test redefined
at /usr/local/share/spamassassin/20_porn.cf, rule PORN_16, line 10,
GEN139 line 208.
Feb 6 23:20:28 mail spamd[66363]: Subroutine
I just created a rule for the most common spams that have been making it
through SA, but for some reason, it's not showing up in the tests:
body SEE_ATTACH /See attachment message.html/i
describe SEE_ATTACH body contains See attachment message.html
score SEE_ATTACH
On Mon, 7 Feb 2005, Alex Broens wrote:
[EMAIL PROTECTED] wrote:
On Mon, 7 Feb 2005 [EMAIL PROTECTED] wrote:
I just created a rule for the most common spams that have been making it
through SA, but for some reason, it's not showing up in the tests:
body SEE_ATTACH /See
up several alternative
paths now, and yours seem to be the better way to go.
I had not noticed before that /usr/sbin/sendmail in fact only was a
symlink. I have been testing your script, and it is necessary for me to
modify it.
This is what I did:
I stored your script on my own local
them over. Now SA is not flagging any mail. Any
suggestions? Our secondary mx box is picking up the load right now.
Check your file system.
Check the files in /etc/mail/spamassassin with grep.
Check the copied files.
Thomas
Shane
- --
icq:133073900
http://www.t-arend.de
every time? What's the best way to
keep it under control?
Not to quibble, but why doesn't the SA default to putting all these files
under /var or at least /usr ? Filling up the root FS can cause big
problems...
Thanks,
James Smallacombe PlantageNet, Inc. CEO and Janitor
[EMAIL
.
Rational, I suppose, but I use the network tests and still found it
neccessary to bump the bayes 9x up to get decent results after upgrading
from 2.63 the other day.
BTW, it looks like bayes_90 has been deprecated. When I run a lint on my
local.cf, I get:
warning: score set for non-existent
31 matches
Mail list logo
