Re: thanks to thinking people.

2010-07-19 Thread Brian Godette
On 7/15/2010 6:55 PM, Alexandre Chapellon wrote: Hi all, Few months ago I asked this list if using SA on outgoing smtp was a good idea (Thread: SA on outgoing SMTP). This thread quickly moved to Block direct port 25 for non-mta users! I was really afraid of doing so and didn't really

Re: thanks to thinking people.

2010-07-19 Thread Toni Mueller
Hi, On Mon, 19.07.2010 at 09:43:20 -0600, Brian Godette bgode...@idcomm.com wrote: I hope you realize you still need to deal with the issues of users with weak/guessable passwords and phishing of account info as well as the newer bots that recover account info from Outlook/Outlook

Indirectly related to SA.

2010-07-19 Thread Brian Godette
Like some people I run a small internal spamtrap of never used by real users addresses for use in feeding Bayes as well as reporting to Razor and internal IXHASH. In addition I also have a database that returns 550 User unknown for all email addresses that are dead, with the date they were

Re: Indirectly related to SA.

2010-07-19 Thread LuKreme
On 19-Jul-2010, at 10:45, Brian Godette wrote: My question is, at what point would one consider such an address old enough for inclusion into a reviewed trap for further training and reporting, and at what point, if it were left returning 550 User unknown, where it could bypass review?

Re: thanks to thinking people.

2010-07-19 Thread Ted Mittelstaedt
On 7/19/2010 8:43 AM, Brian Godette wrote: On 7/15/2010 6:55 PM, Alexandre Chapellon wrote: Hi all, Few months ago I asked this list if using SA on outgoing smtp was a good idea (Thread: SA on outgoing SMTP). This thread quickly moved to Block direct port 25 for non-mta users! I was really

I need MORE SPAM - You get less spam

2010-07-19 Thread Marc Perkel
Still trying to build my black list (hostkarma) and looking for more spam. The way it works is that any of you can add this as your highest numbered MX record. http://wiki.junkemailfilter.com/index.php/Project_tarbaby It returns a 421 error after the DATA command. Anything that comes to us

Re: thanks to thinking people.

2010-07-19 Thread Brian Godette
On 7/19/2010 1:29 PM, Ted Mittelstaedt wrote: On 7/19/2010 8:43 AM, Brian Godette wrote: On 7/15/2010 6:55 PM, Alexandre Chapellon wrote: Hi all, Few months ago I asked this list if using SA on outgoing smtp was a good idea (Thread: SA on outgoing SMTP). This thread quickly moved to Block

Re: thanks to thinking people.

2010-07-19 Thread Ted Mittelstaedt
On 7/19/2010 12:56 PM, Brian Godette wrote: On 7/19/2010 1:29 PM, Ted Mittelstaedt wrote: On 7/19/2010 8:43 AM, Brian Godette wrote: On 7/15/2010 6:55 PM, Alexandre Chapellon wrote: Hi all, Few months ago I asked this list if using SA on outgoing smtp was a good idea (Thread: SA on

Re: I need MORE SPAM - You get less spam

2010-07-19 Thread John Hardin
On Mon, 19 Jul 2010, Marc Perkel wrote: Still trying to build my black list (hostkarma) and looking for more spam. The way it works is that any of you can add this as your highest numbered MX record. I'll say it again, Marc: you'd get better response from large sites if you offered source

Re: I need MORE SPAM - You get less spam

2010-07-19 Thread Ted Mittelstaedt
Marc, So then OK what happens when a BGP flap somewhere on the Internet that isn't even us, cuts us off for 10 minutes and 500 pieces of legitimate mail end up going to your server? Domains these days are really, really cheap. Just setup some honeypots, man. Ted On 7/19/2010 12:48 PM,

Re: I need MORE SPAM - You get less spam

2010-07-19 Thread Marc Perkel
The tarbaby server can tell the different between legit email and spam bot mail. It doesn't blacklist everything that hits it. And the good email will be turned away with a 4xx error. On 7/19/2010 1:52 PM, Ted Mittelstaedt wrote: Marc, So then OK what happens when a BGP flap somewhere on

Re: thanks to thinking people.

2010-07-19 Thread Matt
Blocking outbound 25 from the rest of your network, and disallowing submission to your MX on 25 from your network , does very little for keeping your own MX from sending spam which is what SA on outgoing SMTP would be for. It's great from a policy standpoint and contains the simple bots, but

Re: I need MORE SPAM - You get less spam

2010-07-19 Thread Ted Mittelstaedt
Even the best spmfilters we have cannot tell the difference between legit e-mail and spambot mail 100% of the time. I know you think that you have a clever way of collecting spambots since you are depending on a border case. Most of these clever solutions depend on border cases, it could be

Re: thanks to thinking people.

2010-07-19 Thread RW
On Mon, 19 Jul 2010 13:25:26 -0700 Ted Mittelstaedt t...@ipinc.net wrote: It's been our experience that spam-scanning outbound mail causes a lot more problems than setting up mailserver monitoring and being responsive to it. Sooner or later one of your customers is going to call you and

Re: thanks to thinking people.

2010-07-19 Thread Brian Godette
On 7/19/2010 2:25 PM, Ted Mittelstaedt wrote: On 7/19/2010 12:56 PM, Brian Godette wrote: On 7/19/2010 1:29 PM, Ted Mittelstaedt wrote: On 7/19/2010 8:43 AM, Brian Godette wrote: On 7/15/2010 6:55 PM, Alexandre Chapellon wrote: Hi all, Few months ago I asked this list if using SA on

Re: thanks to thinking people.

2010-07-19 Thread Brian Godette
On 7/19/2010 4:01 PM, RW wrote: On Mon, 19 Jul 2010 13:25:26 -0700 Ted Mittelstaedtt...@ipinc.net wrote: It's been our experience that spam-scanning outbound mail causes a lot more problems than setting up mailserver monitoring and being responsive to it. Sooner or later one of your

Re: thanks to thinking people.

2010-07-19 Thread RW
On Mon, 19 Jul 2010 16:58:49 -0600 Brian Godette bgode...@idcomm.com wrote: On 7/19/2010 4:01 PM, RW wrote: On Mon, 19 Jul 2010 13:25:26 -0700 Ted Mittelstaedtt...@ipinc.net wrote: It's been our experience that spam-scanning outbound mail causes a lot more problems than setting up

Re: disable trusted_networks and internal_networks

2010-07-19 Thread Matt Kettler
On 7/16/2010 2:31 PM, Cliff Hayes wrote: Hello, Our webmail server is on the same server as sendmail and spamassassin. I would like to filter outbound webmail but can't because the most recent versions of spamassassin have 127.0.0.1 trusted by default. How can I override this? Or is that