Re: List of trusted senders

2017-01-25 Thread Kevin A. McGrail
On 1/25/2017 7:54 PM, Joe Quinn wrote: As a side note, spamassassin will not be able to fully implement DMARC. Part of a valid implementation involves being able to notify the authentic sender of when they are being forged, which involves sending a new email. Which is a hurdle but a simple c

Re: List of trusted senders

2017-01-25 Thread Joe Quinn
On 1/25/2017 11:03 AM, Benny Pedersen wrote: Kevin A. McGrail skrev den 2017-01-25 16:46: On 1/25/2017 9:10 AM, David Jones wrote: Could we build a tool like masscheck to help extend these entries for trusted senders that are known to maintain proper SPF, DKIM, DMARC with valid opt-out processi

Re: List of trusted senders

2017-01-25 Thread David Jones
>From: Paul Stead >Sent: Wednesday, January 25, 2017 3:34 PM >On 25/01/2017, 17:49, "David Jones" wrote: >>    Here is an example I just received: >>    http://pastebin.com/fwbgMKF4 >Received: from mta165a.pmx1.epsl1.com (mta165a.pmx1.epsl1.com >[142.54.245.165]) - Pastebin.com >pastebin.com

Re: List of trusted senders

2017-01-25 Thread Paul Stead
On 25/01/2017, 21:34, "Paul Stead" wrote: A similar method I use is to have the DKIM signing domains I like in a rbl server and query them with askdns askdns LOCAL_TRUSTED_DKIM _DKIMDOMAIN_.lookup.example.com A 127.0.0.2 tflags LOCAL_TRUSTED_DKIM nice net describe

Re: List of trusted senders

2017-01-25 Thread Paul Stead
On 25/01/2017, 17:49, "David Jones" wrote: Here is an example I just received: http://pastebin.com/fwbgMKF4 This message is very spammy looking and hit a high BAYES_ rule but was sent from a trustworthy sender with good SPF, DKIM and opt-out. The IP was not listed on any ma

Re: List of trusted senders

2017-01-25 Thread David Jones
>>Kevin A. McGrail skrev den 2017-01-25 16:46: >>> On 1/25/2017 9:10 AM, David Jones wrote: Could we build a tool like masscheck to help extend these entries for trusted senders that are known to maintain proper SPF, DKIM, DMARC with valid opt-out processing? >>> Off the cuff

Re: List of trusted senders

2017-01-25 Thread David B Funk
On Wed, 25 Jan 2017, Benny Pedersen wrote: same as with clamav 3dr party spam signatures should not really have being in clamav, but on a sa channel, i know there is a perl script to make that 3dr party sigs back to sa, but it uses so much memmory that its not practical :( my solution to th

Re: List of trusted senders

2017-01-25 Thread Benny Pedersen
Kevin A. McGrail skrev den 2017-01-25 17:20: dkim is domain based, spf and dmarc is ip based, so not really easy to use a ip based rbl :=) Good point. I will clarify that I personally use RBLs as an inclusive term for RBLs and URIBLs and I use them in ways that aren't blacklists but just more

Re: List of trusted senders

2017-01-25 Thread David Jones
>Kevin A. McGrail skrev den 2017-01-25 16:46: >> On 1/25/2017 9:10 AM, David Jones wrote: >>> Could we build a tool like masscheck to help extend these >>> entries for trusted senders that are known to maintain >>> proper SPF, DKIM, DMARC with valid opt-out processing? >>> >> Off the cuff, this s

Re: List of trusted senders

2017-01-25 Thread Kevin A. McGrail
On 1/25/2017 11:03 AM, Benny Pedersen wrote: Kevin A. McGrail skrev den 2017-01-25 16:46: On 1/25/2017 9:10 AM, David Jones wrote: Could we build a tool like masscheck to help extend these entries for trusted senders that are known to maintain proper SPF, DKIM, DMARC with valid opt-out processi

Re: List of trusted senders

2017-01-25 Thread Benny Pedersen
Kevin A. McGrail skrev den 2017-01-25 16:46: On 1/25/2017 9:10 AM, David Jones wrote: Could we build a tool like masscheck to help extend these entries for trusted senders that are known to maintain proper SPF, DKIM, DMARC with valid opt-out processing? Off the cuff, this sounds like the concep

Re: List of trusted senders

2017-01-25 Thread Kevin A. McGrail
On 1/25/2017 9:10 AM, David Jones wrote: Could we build a tool like masscheck to help extend these entries for trusted senders that are known to maintain proper SPF, DKIM, DMARC with valid opt-out processing? Off the cuff, this sounds like the concept of more than a few whitelist RBLs. Regard

List of trusted senders

2017-01-25 Thread David Jones
A couple of years ago I started making an extensive list of whitelist_auth and whitelist_from_rcvd (for those with broken SPF and no DKIM) which made my SA scoring very reliable.  Before I did this, I was constantly reacting to new spam campaigns which was a loosing battle. I noticed some patterns