Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-27 Thread Kai Schaetzl
Mr. List Mail User, your efforts in this respect are ridiculous, now your are resurrecting long dead bodies. I can't believe that you read this document and still believe it could have any relevance to this. Wow. 1. this is what rfc-editor.org says about 954: RFC0954 NICNAME/WHOIS K.

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-26 Thread List Mail User
... On Thursday 25 May 2006 21:31, Kai Schaetzl took the opportunity to write: Jamie L. Penman-Smithson wrote on Thu, 25 May 2006 17:12:07 +0100: .de does not have a working WHOIS server, that's fundamentally broken: No, *your* whois client is outdated and broken. snip And this is not the

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-26 Thread Kai Schaetzl
List Mail User wrote on Thu, 25 May 2006 23:02:21 -0700 (PDT): DeNIC does not follow this protocol; 1. there's nothing which backs your claim, *nothing*. 2. example is an example and nothing else. You should know that. There are also special words in RFCs which clearly define mandatory

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-26 Thread Magnus Holmgren
On Friday 26 May 2006 15:53, List Mail User took the opportunity to write: Kai, There doesn't seem to be any language barrier, so either you refuse to read and follow the RFC trail yourself, or you require spoon-feeding. What about RFC1032, page 5 VERIFICATION OF DATA

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-26 Thread Kai Schaetzl
List Mail User wrote on Fri, 26 May 2006 06:53:36 -0700 (PDT): What about RFC1032, page 5 RFC 1032 is not authoritative in any way. It never was a standard, it doesn't define anything about the whois protocol. If you think so it's wishful thinking. This RFC is not obsolete, and make quite

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-26 Thread Pablo Allietti
On Fri, May 26, 2006 at 02:31:16PM +0200, Kai Schaetzl wrote: Jamie L. Penman-Smithson wrote on Fri, 26 May 2006 00:52:39 +0100: After some research, I came to the conclusion that .de is, indeed, still broken: ftp://ftp.isi.edu/in-notes/rfc3912.txt And *where exactly* does this

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-26 Thread jdow
From: Kai Schaetzl [EMAIL PROTECTED] Jamie L. Penman-Smithson wrote on Fri, 26 May 2006 00:52:39 +0100: After some research, I came to the conclusion that .de is, indeed, still broken: ftp://ftp.isi.edu/in-notes/rfc3912.txt And *where exactly* does this RFC say that the whois input and

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-26 Thread List Mail User
... From: Kai Schaetzl [EMAIL PROTECTED] Jamie L. Penman-Smithson wrote on Fri, 26 May 2006 00:52:39 +0100: After some research, I came to the conclusion that .de is, indeed, still broken: ftp://ftp.isi.edu/in-notes/rfc3912.txt And *where exactly* does this RFC say that the whois

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-25 Thread Kai Schaetzl
Mike Jackson wrote on Wed, 24 May 2006 08:44:17 -0700: Personally, I have those two rules zero-scored in my local.cf. Even though I like RFCI, and use their bogusmx and dsn lists at the MTA level, these two create too many false positives. You cannot trust any of the rfc-ignorant.org lists,

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-25 Thread Magnus Holmgren
On Thursday 25 May 2006 17:31, Kai Schaetzl took the opportunity to write: Mike Jackson wrote on Wed, 24 May 2006 08:44:17 -0700: Personally, I have those two rules zero-scored in my local.cf. Even though I like RFCI, and use their bogusmx and dsn lists at the MTA level, these two create

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-25 Thread Mike Jackson
Personally, I have those two rules zero-scored in my local.cf. Even though I like RFCI, and use their bogusmx and dsn lists at the MTA level, these two create too many false positives. You cannot trust any of the rfc-ignorant.org lists, they list whole TLDs just because they don't like

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-25 Thread Jamie L. Penman-Smithson
On 25 May 2006, at 16:31, Kai Schaetzl wrote: Mike Jackson wrote on Wed, 24 May 2006 08:44:17 -0700: Personally, I have those two rules zero-scored in my local.cf. Even though I like RFCI, and use their bogusmx and dsn lists at the MTA level, these two create too many false positives.

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-25 Thread Kai Schaetzl
Jamie L. Penman-Smithson wrote on Thu, 25 May 2006 17:12:07 +0100: .de does not have a working WHOIS server, that's fundamentally broken: No, *your* whois client is outdated and broken. whois something.de [Querying whois.denic.de] [whois.denic.de] % Copyright (c)2004 by DENIC % Version:

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-25 Thread Kai Schaetzl
Magnus Holmgren wrote on Thu, 25 May 2006 18:01:19 +0200: [...], however 'entire TLD'-based domains return a different result code in the A record (127.0.0.7 versus 127.0.0.5) so as to allow sites to differentiate between them. That is not of interest at all. The problem is they list TLDs

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-25 Thread Benny Pedersen
You cannot trust any of the rfc-ignorant.org lists, they list whole TLDs just because they don't like something about them. These lists go by personal taste than any other. http://www.rfc-ignorant.org/tools/lookup.php?domain=something.de http://www.rfc-ignorant.org/policy-whois.php

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-25 Thread Magnus Holmgren
On Thursday 25 May 2006 21:31, Kai Schaetzl took the opportunity to write: Jamie L. Penman-Smithson wrote on Thu, 25 May 2006 17:12:07 +0100: .de does not have a working WHOIS server, that's fundamentally broken: No, *your* whois client is outdated and broken. snip And this is not the

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-25 Thread Jamie L. Penman-Smithson
On 25 May 2006, at 20:31, Kai Schaetzl wrote: Jamie L. Penman-Smithson wrote on Thu, 25 May 2006 17:12:07 +0100: .de does not have a working WHOIS server, that's fundamentally broken: No, *your* whois client is outdated and broken. Agreed, it works in a later version. snip And this is

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-25 Thread Jamie L. Penman-Smithson
On 25 May 2006, at 21:54, Magnus Holmgren wrote: On Thursday 25 May 2006 21:31, Kai Schaetzl took the opportunity to write: Jamie L. Penman-Smithson wrote on Thu, 25 May 2006 17:12:07 +0100: .de does not have a working WHOIS server, that's fundamentally broken: No, *your* whois client is

RE: false scoring for DNS_FROM_RFC_ABUSE

2006-05-25 Thread Matthew.van.Eerde
Jamie L. Penman-Smithson wrote: (RFC) open TCP (SYN) -- (SYN+ACK) - send query SmithCRLF get answer Info about SmithCRLF - More info about

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-24 Thread John Rudd
On May 24, 2006, at 3:01 AM, [EMAIL PROTECTED] wrote: Event though hotmail.com domain has a abuse address and a postmaster address, why do mails from hotmail.com domain get trigerred for these tests 0.4 DNS_FROM_RFC_ABUSE 1.4 DNS_FROM_RFC_POST I believe the requirement is not just that the

RE: false scoring for DNS_FROM_RFC_ABUSE

2006-05-24 Thread Sietse van Zanen
. -Sietse From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Wed 24-May-06 12:01 To: users@spamassassin.apache.org Subject: false scoring for DNS_FROM_RFC_ABUSE Event though hotmail.com domain has a abuse address and a postmaster address, why do mails from

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-24 Thread Mike Jackson
Event though hotmail.com domain has a abuse address and a postmaster address, why do mails from hotmail.com domain get trigerred for these tests 0.4 DNS_FROM_RFC_ABUSE 1.4 DNS_FROM_RFC_POST Because it's listed on both of those lists at rfc-ignorant.org:

RE: false scoring for DNS_FROM_RFC_ABUSE

2006-05-24 Thread padma
mail server admins even block mail coming from there by default. -Sietse From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Wed 24-May-06 12:01 To: users@spamassassin.apache.org Subject: false scoring for DNS_FROM_RFC_ABUSE Event though hotmail.com

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-24 Thread padma
that info was indeed good! On Wed, 24 May 2006, Mike Jackson wrote: Event though hotmail.com domain has a abuse address and a postmaster address, why do mails from hotmail.com domain get trigerred for these tests 0.4 DNS_FROM_RFC_ABUSE 1.4 DNS_FROM_RFC_POST Because it's listed on both

false scoring for DNS_FROM_RFC_ABUSE

2006-05-23 Thread padma
Event though hotmail.com domain has a abuse address and a postmaster address, why do mails from hotmail.com domain get trigerred for these tests 0.4 DNS_FROM_RFC_ABUSE 1.4 DNS_FROM_RFC_POST Regards Padma ERNET Helpdesk