Re: Spam rule for HTTP/HTTPS request to sender's root domain

2019-03-01 Thread Rupert Gallagher
On Fri, Mar 1, 2019 at 23:14, Mike Marynowski wrote: >> Does SpamAssassin even have facilities to do that? > Yes, if spf runs at priority 1, you can define your test at priority 2, so SA > executes them in the given order. >> Don't all rules run all the time? > They run when relevant, in the

Re: Spam rule for HTTP/HTTPS request to sender's root domain

2019-03-01 Thread Rupert Gallagher
The focus was on the To header for mailing lists, complaints on MUAs and people's choices. If you do not want to appear in the To header of a list, you are exercising a legal right under the GDPR. So, to cut through all those problems and enforce a sound solution, I suggest list majordomos do

Re: Spam rule for HTTP/HTTPS request to sender's root domain

2019-03-01 Thread Mike Marynowski
Does SpamAssassin even have facilities to do that? Don't all rules run all the time? SpamAssassin still needs to run all the rules because MTAs might have different spam mark / spam delete /etc thresholds than the one set in SA. The number of cycles you're talking about is the same as an RBL

Re: Spam rule for HTTP/HTTPS request to sender's root domain

2019-03-01 Thread Rupert Gallagher
Case study: example.com bans any e-mail sent from its third levels up, and does it by spf. spf-banned.example.com sent mail, and my SA at server.com adds a big fat penalty, high enough to bounch it. Suppose I do not bounch it, and use your filter to check for its websites. It turns out that

Re: Spam rule for HTTP/HTTPS request to sender's root domain

2019-03-01 Thread Mike Marynowski
On 3/1/2019 4:31 PM, Grant Taylor wrote: afraid.org is much like DynDNS in that one entity (afaid.org themselves or DynDNS) provide DNS services for other entities. I don't see a good way to differentiate between the sets of entities. I haven't come across any notable amount of spam that's

Re: Spam rule for HTTP/HTTPS request to sender's root domain

2019-03-01 Thread Grant Taylor
On 03/01/2019 01:25 AM, Rupert Gallagher wrote: A future-proof list that complies with GDPR would automatically rewrite the To header, leaving the list address only. Doesn't GDPR also include things like signatures? Thus if the mailing list is only modifying the email metadata and not the

Re: Spam rule for HTTP/HTTPS request to sender's root domain

2019-03-01 Thread Grant Taylor
On 02/28/2019 09:39 PM, Mike Marynowski wrote: I modified it so it checks the root domain and all subdomains up to the email domain. :-) As for your question - if afraid.org has a website then you are correct, all subdomains of afraid.org will not flag this rule, but if lots of afraid.org

Re: Spam rule for HTTP/HTTPS request to sender's root domain

2019-03-01 Thread Mike Marynowski
On 3/1/2019 1:07 PM, RW wrote: Sure, but had it turned-out that most of these domains didn't have the A record necessary for your HTTP test, it wouldn't have been worth doing anything more complicated. I've noticed a lot of the spam domains appear to point to actual web servers but throw 403

Re: Spam rule for HTTP/HTTPS request to sender's root domain

2019-03-01 Thread Mike Marynowski
Sorry, I meant I thought it was doing those checks because I know I was playing with checking A records before and figured the rules would have it enabled by default...I tried to find the rules after I sent that message and realized that was related to sender domain A record checks done in my

Re: Spam rule for HTTP/HTTPS request to sender's root domain

2019-03-01 Thread Antony Stone
On Friday 01 March 2019 at 17:37:18, Mike Marynowski wrote: > Quick sampling of 10 emails: 8 of them have valid A records on the email > domain. I presumed SpamAssassin was already doing simple checks like that. That doesn't sound like a good idea to me (presuming, I mean). Antony. -- "The

Re: Spam rule for HTTP/HTTPS request to sender's root domain

2019-03-01 Thread RW
On Fri, 1 Mar 2019 11:37:18 -0500 Mike Marynowski wrote: > Looking for an A record on what - just the email address domain or > the chain of parent domains as well? If the latter, well a lack of A > record will cause this to fail so it's kind of embedded in. Sure, but had it turned-out that most

Re: whitelist_from_rcvd hits only sometimes

2019-03-01 Thread Matus UHLAR - fantomas
On 28.02.19 12:44, Helmut Schneider wrote: >I'm trying to find out why a message sometimes hits >whitelist_from_rcvd and sometimes does not. I checked the headers >again and again but cannot see the difference. > >whitelist_from_rcvd quarant...@eu.quarantine.symantec.com >messagelabs.com

Re: whitelist_from_rcvd hits only sometimes

2019-03-01 Thread RW
On Fri, 1 Mar 2019 17:46:55 +0100 Matus UHLAR - fantomas wrote: > On 28.02.19 12:44, Helmut Schneider wrote: > >I'm trying to find out why a message sometimes hits > >whitelist_from_rcvd and sometimes does not. I checked the headers > >again and again but cannot see the difference. > > >

Re: whitelist_from_rcvd hits only sometimes

2019-03-01 Thread Matus UHLAR - fantomas
On 28.02.19 12:44, Helmut Schneider wrote: I'm trying to find out why a message sometimes hits whitelist_from_rcvd and sometimes does not. I checked the headers again and again but cannot see the difference. whitelist_from_rcvd quarant...@eu.quarantine.symantec.com messagelabs.com

Re: Spam rule for HTTP/HTTPS request to sender's root domain

2019-03-01 Thread Mike Marynowski
Looking for an A record on what - just the email address domain or the chain of parent domains as well? If the latter, well a lack of A record will cause this to fail so it's kind of embedded in. Quick sampling of 10 emails: 8 of them have valid A records on the email domain. I presumed

Re: TxRep increases sa-learn processing time exponentially

2019-03-01 Thread David Gessel
Nix, That's probably a reasonable path for now, I'm using TxRep with the diff I posted but not on a large mail server.   Thanks for the insight. -David On 27/02/2019 17.27, Nix wrote: > On 27 Feb 2019, David Gessel told this: > >> check

Re: whitelist_from_rcvd hits only sometimes

2019-03-01 Thread RW
On Thu, 28 Feb 2019 12:44:16 +0100 Helmut Schneider wrote: > Hi, > > I'm trying to find out why a message sometimes hits > whitelist_from_rcvd and sometimes does not. I checked the headers > again and again but cannot see the difference. I couldn't reproduce this with the email labelled as

Re: Spam rule for HTTP/HTTPS request to sender's root domain

2019-03-01 Thread RW
On Wed, 27 Feb 2019 12:16:20 -0500 Mike Marynowski wrote: > Almost all of the spam emails that are > coming through do not have a working website at the room domain of > the sender. Did you establish what fraction of this spam could be caught just by looking for an A record?

Re: Spam rule for HTTP/HTTPS request to sender's root domain

2019-03-01 Thread Mike Marynowski
Changing up the algorithm a bit. Once a domain has been added to the cache, the DNS service will perform HTTP checks in the background automatically on a much more aggressive schedule for invalid domains so that temporary website problems are much less of an issue and invalid domains don't

Re: Spam rule for HTTP/HTTPS request to sender's root domain

2019-03-01 Thread Rupert Gallagher
A future-proof list that complies with GDPR would automatically rewrite the To header, leaving the list address only. Any other recipient will still receive it from the original sender. On Thu, Feb 28, 2019 at 20:29, Mike Marynowski wrote: > Unfortunately I don't see a reply-to header on your