Bare addresses alternative for __MANY_RECIPS?

2013-10-21 Thread Tom Hendrikx
Hi, I have been using __MANY_RECIPS in some meta rules for some time now, and noticed a weird FP today. The rule seems to count the number of '@'s in the To and CC header. Someone sent a mail to using the (albeit silly) format, probably by using reply-to-all in a braindead MUA: To The foo

RP_MATCHES_RCVD

2013-10-21 Thread Mauricio Tavares
b Trying to figure out why RP_MATCHES_RCVD scored so low. Is it because Return-Path: se...@c001n01.zahost.ru and the last Received matches that domain? if so, anything I can do to score t as the proper spam it is? Original Message Return-Path: se...@c001n01.zahost.ru

Re: RP_MATCHES_RCVD

2013-10-21 Thread John Hardin
On Mon, 21 Oct 2013, Mauricio Tavares wrote: b Trying to figure out why RP_MATCHES_RCVD scored so low. Is it because Return-Path: se...@c001n01.zahost.ru and the last Received matches that domain? if so, anything I can do to score t as the proper spam it is? RP_MATCHES_RCVD is a check

Re: RP_MATCHES_RCVD

2013-10-21 Thread Matus UHLAR - fantomas
On Mon, 21 Oct 2013, Mauricio Tavares wrote: b Trying to figure out why RP_MATCHES_RCVD scored so low. Is it because Return-Path: se...@c001n01.zahost.ru and the last Received matches that domain? if so, anything I can do to score t as the proper spam it is? On 21.10.13 10:24, John Hardin

Re: Testing the _REMOTEHOSTNAME_ in a rule

2013-10-21 Thread Philip Prindeville
On Oct 19, 2013, at 5:28 PM, Karsten Bräckelmann guent...@rudersport.de wrote: On Fri, 2013-10-18 at 18:34 -0600, Philip Prindeville wrote: I'm trying to write a rule that gives some spamminess score to messages received from any host that resolves to protection.outlook.com. I tried to use

Re: Testing the _REMOTEHOSTNAME_ in a rule

2013-10-21 Thread Karsten Bräckelmann
On Mon, 2013-10-21 at 13:19 -0600, Philip Prindeville wrote: On Oct 19, 2013, at 5:28 PM, Karsten Bräckelmann guent...@rudersport.de wrote: RULE_NAME X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns=evil.example.net / That rdns value is added to the Received header by your SMTP, and your

Re: Bare addresses alternative for __MANY_RECIPS?

2013-10-21 Thread Karsten Bräckelmann
On Mon, 2013-10-21 at 14:11 +0200, Tom Hendrikx wrote: I have been using __MANY_RECIPS in some meta rules for some time now, and noticed a weird FP today. The rule seems to count the number of '@'s in the To and CC header. Someone sent a mail to using the (albeit silly) format, probably by