Re: Multiple REFUSED logs with sorbs.net ?

2024-05-19 Thread Benny Pedersen
J Doe skrev den 2024-05-19 23:57: On 2024-05-17 23:13, Noel Butler wrote: On 18/05/2024 08:14, J Doe wrote: Here is an example entry: 10-May-2024 05:34:39.024 lame-servers: info: REFUSED unexpected RCODE resolving 'rbldns10.sorbs.net/A/IN': 108.59.172.201#53 SORBS has been

Re: Multiple REFUSED logs with sorbs.net ?

2024-05-19 Thread J Doe
On 2024-05-17 23:13, Noel Butler wrote: On 18/05/2024 08:14, J Doe wrote: Hello, I make use of SpamAssassin 4.0.0 on a low volume e-mail server.  I also run my own validating resolver with Bind 9.18.27 on the e-mail server. The only piece of software I have in my e-mail stack that uses 

Re: uridnsbl_skip_domain question

2024-05-18 Thread giovanni
On 5/17/24 3:17 PM, Matus UHLAR - fantomas wrote: Hi guys, I have configured exclusion for some common domains e.g. gov.sk in SA: uridnsbl_skip_domain [...] gov.sk slovensko.sk However it seems that that domain is still queried:  9826  68.951573    127.0.0.1 → 127.0.0.1    DNS 104 Standard

Re: Difference between spamc -L and sa-learn

2024-05-18 Thread Bill Cole
On 2024-05-18 at 10:26:54 UTC-0400 (Sat, 18 May 2024 16:26:54 +0200) Francis Augusto Medeiros-Logeay is rumored to have said: Hi, Is there any difference between using spamc -L and sa-learn ? Yes. The compiled-C spamc binary loads no Perl, it just talks over a socket to spamd, which is

Re: Error parsing sql configuration

2024-05-18 Thread Francis Augusto Medeiros-Logeay
> On 18 May 2024, at 17:10, Bill Cole > wrote: > > On 2024-05-18 at 10:25:28 UTC-0400 (Sat, 18 May 2024 16:25:28 +0200) > Francis Augusto Medeiros-Logeay > is rumored to have said: > >> Hi, >> >> I use Spamassassin 4 on Ubuntu 24.04. >> >> I have configured SQL for storing user

Re: Error parsing sql configuration

2024-05-18 Thread Bill Cole
On 2024-05-18 at 10:25:28 UTC-0400 (Sat, 18 May 2024 16:25:28 +0200) Francis Augusto Medeiros-Logeay is rumored to have said: Hi, I use Spamassassin 4 on Ubuntu 24.04. I have configured SQL for storing user preferences. Things work fine, but I am getting these errors on my logs: Sat May

Difference between spamc -L and sa-learn

2024-05-18 Thread Francis Augusto Medeiros-Logeay
Hi, Is there any difference between using spamc -L and sa-learn ? I noticed that the later is way slower. I don’t use a journal for local updating, so both write directly to the database. Best, Francis

Error parsing sql configuration

2024-05-18 Thread Francis Augusto Medeiros-Logeay
Hi, I use Spamassassin 4 on Ubuntu 24.04. I have configured SQL for storing user preferences. Things work fine, but I am getting these errors on my logs: Sat May 18 16:22:21 2024 [75733] info: config: not parsing, administrator setting: use_pyzor\t1 Sat May 18 16:22:21 2024 [75733] info:

Re: Multiple REFUSED logs with sorbs.net ?

2024-05-17 Thread Noel Butler
On 18/05/2024 08:14, J Doe wrote: Hello, I make use of SpamAssassin 4.0.0 on a low volume e-mail server. I also run my own validating resolver with Bind 9.18.27 on the e-mail server. The only piece of software I have in my e-mail stack that uses SORBS is SpamAssassin. I have noticed in my

Multiple REFUSED logs with sorbs.net ?

2024-05-17 Thread J Doe
Hello, I make use of SpamAssassin 4.0.0 on a low volume e-mail server. I also run my own validating resolver with Bind 9.18.27 on the e-mail server. The only piece of software I have in my e-mail stack that uses SORBS is SpamAssassin. I have noticed in my resolver logs multiple entries where

uridnsbl_skip_domain question

2024-05-17 Thread Matus UHLAR - fantomas
Hi guys, I have configured exclusion for some common domains e.g. gov.sk in SA: uridnsbl_skip_domain [...] gov.sk slovensko.sk However it seems that that domain is still queried: 9826 68.951573127.0.0.1 → 127.0.0.1DNS 104 Standard query 0xbffe A mail.gov.sk.multi.uribl.com OPT in

Unsubscribe

2024-05-15 Thread Anshul Chauhan

Re: SA treats percentage spaces wording as uri

2024-05-14 Thread Bill Cole
On 2024-05-13 at 20:09:33 UTC-0400 (Tue, 14 May 2024 10:09:33 +1000) Noel Butler is rumored to have said: This morning one of our ent_domains DMARC weekly report from a third party was listed as spam by SA which took the wording Not_percent-twenty_Resolved and passed it off to URI checks

Re: SA treats percentage spaces wording as uri

2024-05-14 Thread Shawn Iverson
On Mon, May 13, 2024 at 8:10 PM Noel Butler wrote: > This morning one of our ent_domains DMARC weekly report from a third party > was listed as spam by SA which took the wording > Not_percent-twenty_Resolved and passed it off to URI checks adding > dot.com to it when there is no dot com after

Re: SA treats percentage spaces wording as uri

2024-05-14 Thread Matus UHLAR - fantomas
On 14.05.24 10:09, Noel Butler wrote: This morning one of our ent_domains DMARC weekly report from a third party was listed as spam by SA which took the wording Not_percent-twenty_Resolved and passed it off to URI checks adding dot.com to it when there is no dot com after it, and a raw

SA treats percentage spaces wording as uri

2024-05-13 Thread Noel Butler
This morning one of our ent_domains DMARC weekly report from a third party was listed as spam by SA which took the wording Not_percent-twenty_Resolved and passed it off to URI checks adding dot.com to it when there is no dot com after it, and a raw message search of that message in less in

Re: dkim https://16years.secvuln.info/

2024-05-13 Thread Bill Cole
On 2024-05-13 at 08:09:04 UTC-0400 (Mon, 13 May 2024 14:09:04 +0200) Benny Pedersen is rumored to have said: i write here so in hope to start a debate on it, is there a code change any where to handle this ? That's not a SA issue. Nothing SA does can fix it The change (in Debian) that fixed

dkim https://16years.secvuln.info/

2024-05-13 Thread Benny Pedersen
i write here so in hope to start a debate on it, is there a code change any where to handle this ?

Re: Score 0.001

2024-05-13 Thread Thomas Barth via users
Am 2024-05-13 04:33, schrieb jdow: Um, "FORGED_SPF_HELO"? Are you sure this message is from MS? {^_^} The mail/report is authentic. They already corrected this "error" or changed the sending server. In today's report FORGED_SPF_HELO is 0.001 and the score is below 5 :) On 20240512

Re: Score 0.001

2024-05-12 Thread jdow
Um, "FORGED_SPF_HELO"? Are you sure this message is from MS? {^_^} On 20240512 06:56:59, Thomas Barth wrote: Am 2024-05-12 12:39, schrieb Greg Troxel: I would suggest that if Debian is modifying the default config from 5 to 6.31, then probably they should not be doing that. This is a status

Re: Score 0.001

2024-05-12 Thread Benny Pedersen
Thomas Barth skrev den 2024-05-12 15:56: Am 2024-05-12 12:39, schrieb Greg Troxel: I would suggest that if Debian is modifying the default config from 5 to 6.31, then probably they should not be doing that. This is a status of dmarc-report from microsoft today X-Spam-Status: Yes,

Re: Score 0.001

2024-05-12 Thread Thomas Barth
Am 2024-05-12 12:39, schrieb Greg Troxel: I would suggest that if Debian is modifying the default config from 5 to 6.31, then probably they should not be doing that. This is a status of dmarc-report from microsoft today X-Spam-Status: Yes, score=5.938 tagged_above=2 required=6.31

Re: Score 0.001

2024-05-12 Thread Matus UHLAR - fantomas
On 12.05.24 06:39, Greg Troxel wrote: I would suggest that if Debian is modifying the default config from 5 to 6.31, then as it was already said, it's not Debian, it's default score in amavis. Even the original header is in the amavis format: X-Spam-Status: No, score=3.999 tagged_above=2

Re: Score 0.001

2024-05-12 Thread Greg Troxel
I would suggest that if Debian is modifying the default config from 5 to 6.31, then probably they should not be doing that. as a packager, I fix bugs (and file upstream bug reports), but it's usually linuxy nonportability things that are clearly bugs (test ==, hardcoded lists of accepted

Re: Score 0.001

2024-05-12 Thread Thomas Barth
Am 2024-05-12 01:08, schrieb jdow: Methinks this is a perfect example of "one man's spam is another man's ham." Or in my case, "A woman's spam is often a man's ham." I like spam when it's well designed. That's why I no longer reject it on my newly set up mail server. I just want them all to

Re: Whitelist rules should never pass on SPF fail

2024-05-11 Thread Noel Butler
On 11/05/2024 03:40, Bill Cole wrote: So what? domain owners state hard fail it SHOULD be hard failed, irrespective of if YOU think you know better than THEM or not, if we hardfail we accept the risks that come with it. In practice, there is a prioritizing of whose wishes I prioritize on

Re: Score 0.001

2024-05-11 Thread jdow
On 20240511 14:56:51, Greg Troxel wrote: Thomas Barth writes: Am 2024-05-11 21:54, schrieb Bill Cole: I have no idea who the Debian "spam analysts" are but I am certain that they are not doing any sort of data-driven dynamic adjustments of scores based on a threshold of 6.3 nor are they

Re: Score 0.001

2024-05-11 Thread Thomas Barth
Am 2024-05-11 23:49, schrieb Vincent Lefevre: The value 6.31 does not even appear in the spamassassin source package. Sorry, the values are overwritten via the Amavis defaults. cat /etc/debian_version 10.13 egrep -nri "sa_tag_level_deflt|sa_kill_level_deflt" /etc

Re: Score 0.001

2024-05-11 Thread Greg Troxel
Thomas Barth writes: > Am 2024-05-11 21:54, schrieb Bill Cole: >> I have no idea who the Debian "spam analysts" are but I am certain >> that they are not doing any sort of data-driven dynamic adjustments >> of scores based on a threshold of 6.3 nor are they (obviously) >> adjusting that

Re: Score 0.001

2024-05-11 Thread Vincent Lefevre
On 2024-05-11 20:26:59 +0200, Thomas Barth wrote: > Am 2024-05-11 19:24, schrieb Loren Wilton: [...] > > > found in > > > > > > X-Spam-Status: No, score=5.908 tagged_above=2 required=6.31 > > > tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, > > > DKIM_VALID_EF=-0.1,

Re: Score 0.001

2024-05-11 Thread Thomas Barth
Am 2024-05-11 21:54, schrieb Bill Cole: I have no idea who the Debian "spam analysts" are but I am certain that they are not doing any sort of data-driven dynamic adjustments of scores based on a threshold of 6.3 nor are they (obviously) adjusting that threshold daily based on current scores.

Re: Score 0.001

2024-05-11 Thread Bill Cole
On 2024-05-11 at 14:26:59 UTC-0400 (Sat, 11 May 2024 20:26:59 +0200) Thomas Barth is rumored to have said: Hello Am 2024-05-11 19:24, schrieb Loren Wilton: Can I just take the names of the rules? e.g. at least two checks should fire: meta MULTIPLE_TESTS (( RAZOR2_CF_RANGE_51_100 +

Re: Score 0.001

2024-05-11 Thread Thomas Barth
Hello Am 2024-05-11 19:24, schrieb Loren Wilton: Can I just take the names of the rules? e.g. at least two checks should fire: meta MULTIPLE_TESTS (( RAZOR2_CF_RANGE_51_100 + RAZOR2_CHECK + URIBL_ABUSE_SURBL) > 1) score MULTIPLE_TESTS 1 found in X-Spam-Status: No, score=5.908

Re: Score 0.001

2024-05-11 Thread Loren Wilton
Can I just take the names of the rules? e.g. at least two checks should fire: meta MULTIPLE_TESTS (( RAZOR2_CF_RANGE_51_100 + RAZOR2_CHECK + URIBL_ABUSE_SURBL) > 1) score MULTIPLE_TESTS 1 found in X-Spam-Status: No, score=5.908 tagged_above=2 required=6.31 tests=[DKIM_SIGNED=0.1,

Re: Score 0.001

2024-05-11 Thread Thomas Barth
Hi guys, thank you all for your advice! Am 2024-05-10 22:39, schrieb Bowie Bailey: The rules with the low scores are not intended to contribute to the spam score for the email.  They only have a defined score at all because if the score is 0, SA will not run the rule. It works like this:

Re: Score 0.001

2024-05-10 Thread Bowie Bailey
On 5/10/2024 2:57 AM, Thomas Barth wrote: Am 2024-05-10 06:19, schrieb Reindl Harald (privat): Am 10.05.24 um 00:05 schrieb Thomas Barth: Am 2024-05-09 21:41, schrieb Loren Wilton: Low-score tests are neither spam nor ham signs by themselves. They can be used in metas in conjunction with

Re: Score 0.001

2024-05-10 Thread Bill Cole
On 2024-05-10 at 14:15:56 UTC-0400 (Fri, 10 May 2024 14:15:56 -0400) Bill Cole is rumored to have said: > On 2024-05-09 at 18:19:14 UTC-0400 (Thu, 9 May 2024 15:19:14 -0700) > jdow > is rumored to have said: > >> On 20240509 15:05:46, Thomas Barth wrote: >>> Am 2024-05-09 21:41, schrieb Loren

Fwd: Re: Rule: "1.0 R_DCD 90% of .com. is spam"

2024-05-10 Thread Benny Pedersen
oh dear, when do he stop ? Original besked Emne: Re: Rule: "1.0 R_DCD 90% of .com. is spam" Dato: 2024-05-10 20:17 Afsender: "Reindl Harald (gmail)" Modtager: Benny Pedersen Am 10.05.24 um 20:14 schrieb Benny Pedersen: Matus UHLAR - fantomas skrev den 2024-05-10 18:46: On

Re: Score 0.001

2024-05-10 Thread Bill Cole
On 2024-05-10 at 11:00:45 UTC-0400 (Fri, 10 May 2024 08:00:45 -0700 (PDT)) John Hardin is rumored to have said: > Note that poorly-performing rules may get a score that looks informational, > but that may change over time based on the corpora. IOW: rules that in themselves are not good enough

Re: Score 0.001

2024-05-10 Thread Bill Cole
On 2024-05-09 at 18:19:14 UTC-0400 (Thu, 9 May 2024 15:19:14 -0700) jdow is rumored to have said: > On 20240509 15:05:46, Thomas Barth wrote: >> Am 2024-05-09 21:41, schrieb Loren Wilton: >>> Low-score tests are neither spam nor ham signs by themselves. They can be >>> used in metas in

Re: Rule: "1.0 R_DCD 90% of .com. is spam"

2024-05-10 Thread Benny Pedersen
Matus UHLAR - fantomas skrev den 2024-05-10 18:46: On 10.05.24 15:36, Rupert Gallagher wrote: The ikea mail was received through ... mta-numbers.ikea.com.sparkpostmail.com and is a request for feedback. The SA rule says ... header R_DCD Received =~ /\.com\./ I still do not know where the

Re: Rule: "1.0 R_DCD 90% of .com. is spam"

2024-05-10 Thread Bill Cole
On 2024-05-10 at 11:08:53 UTC-0400 (Fri, 10 May 2024 15:08:53 +) Rupert Gallagher is rumored to have said: > R_DCD That string does not occur anywhere in the SpamAssassin distribution, neither in the code nor in the rules, *including* the rules that are not currently performing well

Re: Whitelist rules should never pass on SPF fail

2024-05-10 Thread Bill Cole
On 2024-05-09 at 17:21:07 UTC-0400 (Fri, 10 May 2024 07:21:07 +1000) Noel Butler is rumored to have said: > So what? domain owners state hard fail it SHOULD be hard failed, irrespective > of if YOU think you know better than THEM or not, if we hardfail we accept > the risks that come with it.

Re: Rule: "1.0 R_DCD 90% of .com. is spam"

2024-05-10 Thread Matus UHLAR - fantomas
On 10.05.24 15:36, Rupert Gallagher wrote: The ikea mail was received through ... mta-numbers.ikea.com.sparkpostmail.com and is a request for feedback. The SA rule says ... header R_DCD Received =~ /\.com\./ I still do not know where the rule comes from, DCD may actually mean dot-com-dot,

Re: Rule: "1.0 R_DCD 90% of .com. is spam"

2024-05-10 Thread Rupert Gallagher
Ahhh The ikea mail was received through ... mta-numbers.ikea.com.sparkpostmail.com and is a request for feedback. The SA rule says ... header R_DCD Received =~ /\.com\./ I still do not know where the rule comes from, DCD may actually mean dot-com-dot, and perhaps it is true that they are

Re: Rule: "1.0 R_DCD 90% of .com. is spam"

2024-05-10 Thread Rupert Gallagher
I only have stock and KAM, and it is definitely not a custom rule of mine. Original Message On May 10, 2024, 17:11, Matus UHLAR - fantomas wrote: > On 10.05.24 15:08, Rupert Gallagher wrote: >My local evidence does not > support the general claim that 90% of .com is spam. > >I

Re: Rule: "1.0 R_DCD 90% of .com. is spam"

2024-05-10 Thread Matus UHLAR - fantomas
On 10.05.24 15:08, Rupert Gallagher wrote: My local evidence does not support the general claim that 90% of .com is spam. I just received a mail from informat...@info.email.ikea.com marked as spam, with positive R_DCD. The rule did not trigger on mail from other .com addresses. I do not know

Rule: "1.0 R_DCD 90% of .com. is spam"

2024-05-10 Thread Rupert Gallagher
My local evidence does not support the general claim that 90% of .com is spam. I just received a mail from informat...@info.email.ikea.com marked as spam, with positive R_DCD. The rule did not trigger on mail from other .com addresses. I do not know what R_DCD means, and search indexes do not

Re: Score 0.001

2024-05-10 Thread John Hardin
On Fri, 10 May 2024, Thomas Barth wrote: So now I repeat my question: is it possible to increase the minimum value to 0.1 by default? Not really. The score for a rule is either a fixed value assigned by the rule developer or a dynamic value calculated by masscheck nightly. There isn't a

Re: Score 0.001

2024-05-10 Thread jdow
On 20240509 23:57:12, Thomas Barth wrote: Am 2024-05-10 06:19, schrieb Reindl Harald (privat): Am 10.05.24 um 00:05 schrieb Thomas Barth: Am 2024-05-09 21:41, schrieb Loren Wilton: Low-score tests are neither spam nor ham signs by themselves. They can be used in metas in conjunction with

Re: Score 0.001

2024-05-10 Thread Matus UHLAR - fantomas
On 09.05.24 20:41, Thomas Barth wrote: I don't understand why there are so many checks where the meaningless value of 0.001 is assigned. Those rules may be tested in the present. They also may be informative, e.g. DMARC_MISSING or SPF_PASS rules with score 0 are not used so using 0 is not

Re: Score 0.001

2024-05-10 Thread Thomas Barth
Am 2024-05-10 06:19, schrieb Reindl Harald (privat): Am 10.05.24 um 00:05 schrieb Thomas Barth: Am 2024-05-09 21:41, schrieb Loren Wilton: Low-score tests are neither spam nor ham signs by themselves. They can be used in metas in conjunction with other indicators to help determine ham or

Re: Score 0.001

2024-05-09 Thread jdow
On 20240509 15:05:46, Thomas Barth wrote: Am 2024-05-09 21:41, schrieb Loren Wilton: Low-score tests are neither spam nor ham signs by themselves. They can be used in metas in conjunction with other indicators to help determine ham or spam. A zero value indicates that a rule didn't hit and the

Re: Score 0.001

2024-05-09 Thread Thomas Barth
Am 2024-05-09 21:41, schrieb Loren Wilton: Low-score tests are neither spam nor ham signs by themselves. They can be used in metas in conjunction with other indicators to help determine ham or spam. A zero value indicates that a rule didn't hit and the sign is not present. A small score

Re: Whitelist rules should never pass on SPF fail

2024-05-09 Thread Noel Butler
On 09/05/2024 22:47, Bill Cole wrote: On 2024-05-09 at 08:37:06 UTC-0400 (Thu, 09 May 2024 14:37:06 +0200) Benny Pedersen is rumored to have said: Bill Cole skrev den 2024-05-09 14:22: In fact, I can't think of any whitelist test that should pass if SPF fails. If you operate on the theory

Re: Score 0.001

2024-05-09 Thread Loren Wilton
Low-score tests are neither spam nor ham signs by themselves. They can be used in metas in conjunction with other indicators to help determine ham or spam. A zero value indicates that a rule didn't hit and the sign is not present. A small score indicates that the rule did hit, so the sign it is

Score 0.001

2024-05-09 Thread Thomas Barth
Hello, I don't understand why there are so many checks where the meaningless value of 0.001 is assigned. The total score could be much higher. Do I have to define all the checks myself with a desired value? X-Spam-Status: No, score=3.999 tagged_above=2 required=6.31

Re: Using -t to test rule changes

2024-05-09 Thread Bill Cole
On 2024-05-08 at 19:18:28 UTC-0400 (Wed, 8 May 2024 19:18:28 -0400) Alex is rumored to have said: Hi, I'm using the latest version of SA from trunk (although I don't think that matters) and trying to make adjustments to rules on a particular false-positive email that was quarantined by amavis

Re: Whitelist rules should never pass on SPF fail

2024-05-09 Thread Bill Cole
On 2024-05-09 at 08:37:06 UTC-0400 (Thu, 09 May 2024 14:37:06 +0200) Benny Pedersen is rumored to have said: Bill Cole skrev den 2024-05-09 14:22: In fact, I can't think of any whitelist test that should pass if SPF fails. If you operate on the theory that a SPF failure is always a sign of

Re: Whitelist rules should never pass on SPF fail

2024-05-09 Thread Benny Pedersen
Bill Cole skrev den 2024-05-09 14:22: In fact, I can't think of any whitelist test that should pass if SPF fails. If you operate on the theory that a SPF failure is always a sign of spam, you can make your SpamAssassin always trust SPF failures absolutely. I would not recommend that. Some

Re: Whitelist rules should never pass on SPF fail

2024-05-09 Thread Bill Cole
On 2024-05-08 at 15:53:47 UTC-0400 (Wed, 08 May 2024 16:53:47 -0300) kurt.va1der.ca via users is rumored to have said: I received a (relatively) well crafted Phishing email today. It was clearly a well planned campaign. The Spamassassin score was as follows: X-Spam-Status: No, score=-0.4

Re: Using -t to test rule changes

2024-05-09 Thread Benny Pedersen
Alex skrev den 2024-05-09 01:18: What can be done to be able to process a quarantined email again so I can make adjustments to prevent it from being quarantined? is not an spamassassin issue, ask glue maillists

Re: Whitelist rules should never pass on SPF fail

2024-05-09 Thread Benny Pedersen
kurt.va1der.ca via users skrev den 2024-05-08 21:53: I received a (relatively) well crafted Phishing email today. It was clearly a well planned campaign. The Spamassassin score was as follows: X-Spam-Status: No, score=-0.4 required=5.0 tests=GOOG_REDIR_NORDNS=0.001,

Using -t to test rule changes

2024-05-08 Thread Alex
Hi, I'm using the latest version of SA from trunk (although I don't think that matters) and trying to make adjustments to rules on a particular false-positive email that was quarantined by amavis so I can adjust the rules to prevent it from being quarantined. The problem is that amavis

Re: Whitelist rules should never pass on SPF fail

2024-05-08 Thread Noel Butler
On 09/05/2024 05:57, Jarland Donnell wrote: That's easy though at least. Set the DNSWL rule to 0. I appreciate their effort but it's simply not an accurate way to determine the value of an email in 2024. It's never been the deciding factor between whether or not an email was spam, in any

Re: Whitelist rules should never pass on SPF fail

2024-05-08 Thread Loren Wilton
Obviously the right way is for the master rules to be adjusted. But if you want a local fix, try something like this: score RCVD_IN_DNSWL_HI -0.001 metaMY_RCVD_IN_DNSWL_HIRCVD_IN_DNSWL_HI && !SPF_FAIL score MY_RCVD_IN_DNSWL_HI-5 describeMY_RCVD_IN_DNSWL_HI

Re: Whitelist rules should never pass on SPF fail

2024-05-08 Thread Jarland Donnell
That’s easy though at least. Set the DNSWL rule to 0. I appreciate their effort but it’s simply not an accurate way to determine the value of an email in 2024. It’s never been the deciding factor between whether or not an email was spam, in any email I’ve audited in the last decade. > On

Whitelist rules should never pass on SPF fail

2024-05-08 Thread kurt.va1der.ca via users
I received a (relatively) well crafted Phishing email today. It was clearly a well planned campaign. The Spamassassin score was as follows: X-Spam-Status: No, score=-0.4 required=5.0 tests=GOOG_REDIR_NORDNS=0.001, HTML_FONT_LOW_CONTRAST=0.001,HTML_MESSAGE=0.001,

Re: How to get the X-Spam-Flag

2024-05-04 Thread Matija Nalis
On Fri, May 03, 2024 at 08:22:09PM +0200, tba...@txbweb.de wrote: > when a send a test spam message to my server it recognizes it as spam and > puts it into /var/lib/amavis/virusmails as a gz file. In this file I can > find the complete X-Spam-Header, etc: > > But this header is missing in the

How to get the X-Spam-Flag

2024-05-03 Thread tbarth
System (fresh installation): Debian 12,5, Postfix, Dovecot, Amavis (Clamav, Spamassassin) Hello, when a send a test spam message to my server it recognizes it as spam and puts it into /var/lib/amavis/virusmails as a gz file. In this file I can find the complete X-Spam-Header, etc:

Re: Multiple test failures

2024-04-24 Thread Sidney Markowitz
Hi Scott, Your question is timely. When you posted that, I wasn't aware of problems with t/spamd_client.t, but now I have enough examples that it is the next failure case I'm tracking down. Can you email me directly (don't have to do the detailed back and forth to the entire mailing list)

Re: Multiple test failures

2024-04-24 Thread Scott Ellentuch
Hi, Any updates on this ? Tnx, Tuc On Tue, Apr 9, 2024 at 6:24 PM Scott Ellentuch wrote: > Hi, > > Yes, as ec2-user running the make and then make test ends up failing. > There are no issues with the port as a previous tcpdump has shown, it > transfers data back and forth. It gets through

Re: Tips for improving bounce message deliverability?

2024-04-24 Thread Benny Pedersen
Bill Cole skrev den 2024-04-24 19:37: On 2024-04-24 at 12:27:01 UTC-0400 (Wed, 24 Apr 2024 18:27:01 +0200) Benny Pedersen is rumored to have said: For example, it matches on * 3.1 URI_IMG_CWINDOWSNET Non-MSFT image hosted by Microsoft Azure infra, possible phishing this is not in

Re: authres missing spf-helo ?

2024-04-24 Thread Benny Pedersen
Matus UHLAR - fantomas skrev den 2024-04-24 18:58: On 24.04.24 18:50, Benny Pedersen wrote: unsure so i ask :) try to explain your question a bit more perldoc Mail::SpamAssassin::Plugin::AuthRes EVAL FUNCTIONS header RULENAME eval:check_authres_result(method, result) Can be

Re: Tips for improving bounce message deliverability?

2024-04-24 Thread Bill Cole
On 2024-04-24 at 12:27:01 UTC-0400 (Wed, 24 Apr 2024 18:27:01 +0200) Benny Pedersen is rumored to have said: >> For example, it matches on >> * 3.1 URI_IMG_CWINDOWSNET Non-MSFT image hosted by Microsoft Azure >> infra, possible phishing > > this is not in spamassassin core rules Yes, it is:

Re: Tips for improving bounce message deliverability?

2024-04-24 Thread Matus UHLAR - fantomas
Alex skrev den 2024-04-24 15:45: I'm using SA 4.0.1 and amavisd with postfix. I've identified a few bounce messages in the quarantine because they weren't identified properly. Here's one: https://pastebin.com/RMNkcyhF 1.3 RDNS_NONE Delivered to internal network by a host with no

Re: authres missing spf-helo ?

2024-04-24 Thread Matus UHLAR - fantomas
On 24.04.24 18:50, Benny Pedersen wrote: unsure so i ask :) try to explain your question a bit more -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek

authres missing spf-helo ?

2024-04-24 Thread Benny Pedersen
unsure so i ask :)

Re: Tips for improving bounce message deliverability?

2024-04-24 Thread Benny Pedersen
Alex skrev den 2024-04-24 15:45: Hi, I'm using SA 4.0.1 and amavisd with postfix. I've identified a few bounce messages in the quarantine because they weren't identified properly. Here's one: https://pastebin.com/RMNkcyhF Content preview: Delivery has failed to these recipients or groups:

Tips for improving bounce message deliverability?

2024-04-24 Thread Alex
Hi, I'm using SA 4.0.1 and amavisd with postfix. I've identified a few bounce messages in the quarantine because they weren't identified properly. Here's one: https://pastebin.com/RMNkcyhF For example, it matches on * 3.1 URI_IMG_CWINDOWSNET Non-MSFT image hosted by Microsoft Azure infra,

Re: SA 4.0.1 - DMARC plugin

2024-04-20 Thread Sidney Markowitz
I was wrong about the severity. It does look like the error aborts the running of the DMARC plugin when it happens, so no DMARC result will be scored for that email. I've committed a fix to trunk. This bug only happens in perl versions less than 5.20.0. I see that this case was in CentOS 7

Re: SA 4.0.1 - DMARC plugin

2024-04-19 Thread Sidney Markowitz
As a practical matter, the message appears to be a warning in the log, but the results would be correct, so it can be ignored. Sidney Markowitz wrote on 20/04/24 9:55 am: I've open a bug in which I noted my suspicion of what is happening.

Re: SA 4.0.1 - DMARC plugin

2024-04-19 Thread Sidney Markowitz
I've open a bug in which I noted my suspicion of what is happening. https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8245 If you have a sanitized email that consistently causes this to happen, please attach it to the bug report. As I said in the bug report, I suspect that an email that

SA 4.0.1 - DMARC plugin

2024-04-19 Thread Mateusz Krawczyk
Hello, after updating SA 4.0.0 to 4.0.1, (CentOS 7 - Perl version 5.16.3) I get the following message in log regarding the DMARC plugin: plugin: eval failed: Can't use an undefined value as an ARRAY reference at /usr/share/perl5/Mail/SpamAssassin/Plugin/DMARC.pm line 336. File "DMARC.pm": my

Re: How to find why a mail is SPAM DROPPED ?

2024-04-18 Thread Benny Pedersen
Pierluigi Frullani skrev den 2024-04-18 20:23: It was simscan, that is compiled with enable-drop. with is fine The problem was a bad expression in blacklist_from section in local.cf [1] this is spam, not virus Sorry for the noise. if you like to reject all / drop all, why not pants ?

Re: How to find why a mail is SPAM DROPPED ?

2024-04-18 Thread Benny Pedersen
Pierluigi Frullani skrev den 2024-04-18 19:52: So could it be simscan ? super you wake up :) configure it to pass spam, and reject virus simscan is very old, btw

Re: How to find why a mail is SPAM DROPPED ?

2024-04-18 Thread Benny Pedersen
Pierluigi Frullani skrev den 2024-04-18 19:44: I'm really fighting with spamassasin as one ( legit ) mail get spam dropped with a 99.90 value, also if I have put, in local.cf [1] a required hit of 100. why is 100 required score ? spamassassin does only tag, it does not drop The mail is

Re: How to find why a mail is SPAM DROPPED ?

2024-04-18 Thread Pierluigi Frullani
It was simscan, that is compiled with enable-drop. The problem was a bad expression in blacklist_from section in local.cf Sorry for the noise. Pierluigi Il giorno gio 18 apr 2024 alle ore 19:56 Reindl Harald (privat) < ha...@rhsoft.net> ha scritto: > > > Am 18.04.24 um 19:52 schrieb Pierluigi

Re: How to find why a mail is SPAM DROPPED ?

2024-04-18 Thread Pierluigi Frullani
So could it be simscan ? I'm using qmail with simscan for clamav and spamassasin. Thanks ! Il giorno gio 18 apr 2024 alle ore 19:48 Reindl Harald (privat) < ha...@rhsoft.net> ha scritto: > > > Am 18.04.24 um 19:44 schrieb Pierluigi Frullani: > > Hello all, > > I'm really fighting with

How to find why a mail is SPAM DROPPED ?

2024-04-18 Thread Pierluigi Frullani
Hello all, I'm really fighting with spamassasin as one ( legit ) mail get spam dropped with a 99.90 value, also if I have put, in local.cf a required hit of 100. The mail is sent from a legit gmail account ( my daughter ) to me and contains some amazon links for stuff to buy. I have disabled

Re: spamassassin with gmail

2024-04-15 Thread Noel Butler
On 16/04/2024 08:24, Michael Grant via users wrote: I am not at all advocating people use gmail. Something like 68% of the planet already uses it and few people like I really wonder about that, or did they pull a trump... I ran this June last year, the results are somewhat surprising, of

Re[2]: spamassassin with gmail

2024-04-15 Thread Michael Grant via users
https://isbg.gitlab.io/isbg/index.html support gmail and spamassassin other then that i tryed to make a gentoo ebuild for it, have to retry now :) Yes that's kinda similar! I'll have to try that! Thanks.

Re: spamassassin with gmail

2024-04-15 Thread Benny Pedersen
Michael Grant via users skrev den 2024-04-15 12:55: Do any of you use spamassassin with a gmail account, and if so, how are people doing it? The reason to do this is gmail's spam filtering isn't perfect and you don't have the control you have with spamassassin. ...

Re[2]: spamassassin with gmail

2024-04-15 Thread Michael Grant via users
Matija Sorry, you have misunderstood what I posted. I am not at all advocating people use gmail. Something like 68% of the planet already uses it and few people like you and me have the skills to host our own email. It's not crazy for the people who use gmail or yahoo or other providers,

RE: Re[2]: spamassassin with gmail

2024-04-15 Thread Marc
> >Why not just forward messages? Register a domain put some mx servers in > front of gmails mx. I recently was testing with such relay/forward, works > perfectly, I am only changing the envelope nothing else. DKIM, spf > everyting perfectly working. > > > I'd be interested to know if anyone runs

Re: spamassassin with gmail

2024-04-15 Thread Matija Nalis
On Mon, Apr 15, 2024 at 01:48:53PM +, Michael Grant via users wrote: > > I don't like any daemon connecting to my mail storage. Can you imagine if > > your solution gets hacked, how much data would be compromised? I prefer > > messages being scanned/marked before stored. I wonder if this is

Re[2]: spamassassin with gmail

2024-04-15 Thread Michael Grant via users
From "Marc" You can add to this, that gmail actually is also losing email and annoying is that you can't send zip files. I am constantly asking people to give me a different email address. Yup! And it's not too difficult to pull messages out of the Spam folder and put them back into Inbox.

RE: spamassassin with gmail

2024-04-15 Thread Marc
> > Do any of you use spamassassin with a gmail account, and if so, how are > people doing it? The reason to do this is gmail's spam filtering isn't > perfect You can add to this, that gmail actually is also losing email and annoying is that you can't send zip files. I am constantly asking

spamassassin with gmail

2024-04-15 Thread Michael Grant via users
Do any of you use spamassassin with a gmail account, and if so, how are people doing it? The reason to do this is gmail's spam filtering isn't perfect and you don't have the control you have with spamassassin. We built some plumbing to do this using gmail's API, and also IMAP which can work

Re: Defining what the default welcomelist means

2024-04-14 Thread Bill Cole
I believe we are in solid agreement, a few notes below explaining how... On 2024-04-14 at 08:00:19 UTC-0400 (Sun, 14 Apr 2024 08:00:19 -0400) Greg Troxel is rumored to have said: > Bill Cole writes: > >> On 2024-04-12 at 18:56:15 UTC-0400 (Fri, 12 Apr 2024 18:56:15 -0400) >> Greg Troxel >>

  1   2   3   4   5   6   7   8   9   10   >