Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-19 Thread Thomas Cameron
On 1/7/24 05:40, Matus UHLAR - fantomas wrote: I built email servers for a non-profit I volunteer for.  If email comes into the server for presid...@myassociation.org, I would normally just create an alias in /etc/aliases so that emails to president@ get forwarded to the president's "real"

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-19 Thread Thomas Cameron
On 1/7/24 04:07, Byung-Hee HWANG wrote: Hellow Thomas, See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1043539#88 Sincerely, Byung-Hee The issue is not so much that GMail doesn't accept the email. It does, since I have DKIM, DMARC, and SPF set up. But it drops it into the spam

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-19 Thread Benny Pedersen
Byung-Hee HWANG skrev den 2024-01-19 11:12: I rely on DNSWL for the reputable MX. if repution is 100% needed we all have to make local rescore on all local mails, since repution is to be local, not external just i consider dnswl level 0 to be possitive scored, and let the other levels be

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-19 Thread Benny Pedersen
Marc skrev den 2024-01-19 09:34: Hi Byung and Benny, are you having a nice MX party? :) not needed yet, hehe

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-19 Thread Benny Pedersen
Byung-Hee HWANG skrev den 2024-01-19 06:16: Actually i used Google MX for 10 years. Recently, i created dedicated MXs and am continuing to operate them. Plus, the dedicated MXs run on Google Cloud and RimuHosting. it was to vierd for me to figure out how to get it working, and posible in the

Re: [UPDATE] Changes to Validity Reputation Data Through DNS

2024-01-19 Thread Tom Bartel
On Thu, Jan 18, 2024 at 6:53 PM Greg Troxel wrote: > H > Tom Bartel writes: > > > Starting March 1, 2024, we will allow up to 10,000 requests per user > over a > > 30-day time period. After the 10,000 requests, users must create a > > MyValidity account to continue using this free service. Upon

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-19 Thread Byung-Hee HWANG
On Fri, 2024-01-19 at 08:34 +, Marc wrote: > > > Byung-Hee HWANG skrev den 2024-01-08 12:27: > > > > > > > Gmail is my last INBOX. That's enough for me. > > > > > > +1, so you are ready to setup google mx ? :) > > > > > > > Hellow Benny, > > > > Actually i used Google MX for 10 years.

RE: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-19 Thread Marc
> > Byung-Hee HWANG skrev den 2024-01-08 12:27: > > > > > Gmail is my last INBOX. That's enough for me. > > > > +1, so you are ready to setup google mx ? :) > > > > Hellow Benny, > > Actually i used Google MX for 10 years. Recently, i created dedicated > MXs and am continuing to operate them.

Re: [UPDATE] Changes to Validity Reputation Data Through DNS

2024-01-18 Thread Olivier
Tom, Tom Bartel writes: > Hello SA Community, > > Following is an update on the changes at Validity regarding public query > access for reputation data in DNS. We're finalizing the implementation in SA > to enable this. As with Spamhaus DQS, we'll use the response code > 127.255.255.255 to

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-18 Thread Byung-Hee HWANG
On Mon, 2024-01-08 at 17:17 +0100, Benny Pedersen wrote: > Byung-Hee HWANG skrev den 2024-01-08 12:27: > > > Gmail is my last INBOX. That's enough for me. > > +1, so you are ready to setup google mx ? :) > Hellow Benny, Actually i used Google MX for 10 years. Recently, i created dedicated MXs

Re: [UPDATE] Changes to Validity Reputation Data Through DNS

2024-01-18 Thread Greg Troxel
H Tom Bartel writes: > Starting March 1, 2024, we will allow up to 10,000 requests per user over a > 30-day time period. After the 10,000 requests, users must create a > MyValidity account to continue using this free service. Upon the creation > of a MyValidity account, you will receive

[UPDATE] Changes to Validity Reputation Data Through DNS

2024-01-18 Thread Tom Bartel
Hello SA Community, Following is an update on the changes at Validity regarding public query access for reputation data in DNS. We're finalizing the implementation in SA to enable this. As with Spamhaus DQS, we'll use the response code 127.255.255.255 to indicate excessive querying. Any

Re: Dinged for .Date

2024-01-17 Thread Bill Cole
On 2024-01-16 at 18:33:23 UTC-0500 (Tue, 16 Jan 2024 17:33:23 -0600) Noel is rumored to have said: This - getting a .com domain to send mail - is really the only choice you have. I have not seen major problems with *.net or *.org domains getting deliverability and some ccTLDs have

Re: Adding IP to report

2024-01-17 Thread Linkcheck via users
Thanks, Matus, but that does not work. I'm looking for something that will show in the spam body or subject so I do not have to view the headers.

Re: Dinged for .Date

2024-01-16 Thread Andy Smith
Hi, On Mon, Jan 15, 2024 at 05:06:11PM -0800, Cabel Sasser wrote: > If you believe every new gTLD is garbage (and I get that!), why isn’t > SpamAssassin automatically dinging, say, 1,200+ of them? I have to second the advice to send email from a different domain. It's just going to be the case

Re: Dinged for .Date

2024-01-16 Thread Noel
On 1/16/2024 4:49 PM, Cabel Sasser wrote: HI Josh, Thank you so much for your reply! Most likely, SA specifically whitelisting legit domains in those poisonous TLDs which are brought to our attention by, for instance, reports like yours. Less likely but possible: seeing enough ham claiming

Re: Dinged for .Date

2024-01-16 Thread Cabel Sasser
HI Josh, Thank you so much for your reply! > Most likely, SA specifically whitelisting legit domains in those poisonous > TLDs which are brought to our attention by, for instance, reports like yours. > Less likely but possible: seeing enough ham claiming to be from those TLDs in > the

Re: Adding IP to report

2024-01-16 Thread Matus UHLAR - fantomas
On 16.01.24 15:29, Linkcheck via users wrote: When receiving a report in a spam the reported rules state reason and score but it would be useful if, either on one of those rules or a separate rule (or even in the Subject) there could be a report of the final Received IP. Depending on the IP

Adding IP to report

2024-01-16 Thread Linkcheck via users
When receiving a report in a spam the reported rules state reason and score but it would be useful if, either on one of those rules or a separate rule (or even in the Subject) there could be a report of the final Received IP. Depending on the IP and its country of origin I sometimes block the

Re: Dinged for .Date

2024-01-16 Thread Ralph Seichter
* Michael Orlitzky: > the result for me at least is that it's less work (i.e. less > expensive) to just block every new gTLD and whitelist the few > legitimate senders brave enough to live there. My guess is that a significant number of mail service administrators use the same approach. I

Re: Rule to identify quoted-printable text

2024-01-16 Thread Jimmy
Hello Laurent, I wanted to express my gratitude for sharing the tip on rawbody matching. Your assistance is greatly appreciated. Thank you, Jimmy On Tue, Jan 16, 2024 at 4:01 PM Laurent S. < 110ef9e3086d8405c2929e34be5b4...@protonmail.ch> wrote: > Hi Jimmy, > > If you want to get that exact

Re: Rule to identify quoted-printable text

2024-01-15 Thread Laurent S.
Hi Jimmy, If you want to get that exact version using rawbody, here's how it would need to look like: rawbody __PASSWORD_IN_QP /\bp\x{D0}\x{B0}ssword/i As a trick to know what to use in such a case, I added this rule on my debug/rule testing machine: rawbody __ALLRAWBODY /.+/ tflags

Rule to identify quoted-printable text

2024-01-15 Thread Jimmy
-- Content-Transfer-Encoding: quoted-printable Login p=D0=B0ssword is s=D0=B5t to =D0=B5xpir=D0=B5 -- In the provided email snippet, I aim to match the text "p=D0=B0ssword" using the following rule: rawbody __PASSWORD_IN_QP /\bp=D0=B0ssword/i Despite my

Re: Dinged for .Date

2024-01-15 Thread Michael Orlitzky
On Mon, 2024-01-15 at 17:06 -0800, Cabel Sasser wrote: > > There are 1,239 gTLDs. The SpamAssassin source* blocks just *22* of them. > The official unofficial KAM ruleset blocks a few more, and there are plenty of third-party URIBLs that essentially block gTLDs through SA, albeit at one level

Re: Dinged for .Date

2024-01-15 Thread John Hardin
On Mon, 15 Jan 2024, Cabel Sasser wrote: There are 1,239 gTLDs. The SpamAssassin source* blocks just *22* of them. If you believe every new gTLD is garbage (and I get that!), why isn’t SpamAssassin automatically dinging, say, 1,200+ of them? Or put another way, why _these_ 22, and _only_

Re: Dinged for .Date

2024-01-15 Thread Cabel Sasser
Hi MIchael! I totally understand what you’re saying. I get it 100%. But your math doesn’t quite add up for me. There are 1,239 gTLDs. The SpamAssassin source* blocks just *22* of them. If you believe every new gTLD is garbage (and I get that!), why isn’t SpamAssassin automatically dinging,

Re: Dinged for .Date

2024-01-15 Thread Michael Orlitzky
On Mon, 2024-01-15 at 15:58 -0800, Cabel Sasser wrote: > > Can anyone help me understand “the science”? And how these domains are chosen > for such a heavy punishment? What you're facing is essentially an economic problem. Everyone knows dot-com, and to a lesser extent dot-net and dot-org. But

Dinged for .Date

2024-01-15 Thread Cabel Sasser
Hello friends! We make a handheld game system called Playdate, and our site lives at play.date. We find that our support email often doesn’t get delivered, making for occasionally very angry customers. In debugging this, we’re looking at spam score. In SA, .date is one of the “bad domains”

Re: milter vs spamc

2024-01-15 Thread Mike Bostock via users
In your message regarding Re: milter vs spamc dated 15/01/2024, Mike Bostock said ... > In your message regarding Re: milter vs spamc dated 15/01/2024, Benoit > Panizzon said ... > > Hi > > > What are the pros and cons? > > In my opinion, an email should either be received by a MTA and > >

wellsfargo/google drive

2024-01-15 Thread Alex
Hi, Google Drive is being used to send links with malicious content. I know, shocking. But should Google Drive be in the DKIM WL? What more can be done to stop these? I have a few body filters, but these are just links sent using Google to PDFs with malicious links. https://pastebin.com/Qpj1drSa

Re: milter vs spamc

2024-01-15 Thread Mike Bostock via users
In your message regarding Re: milter vs spamc dated 15/01/2024, Benoit Panizzon said ... > Hi > > What are the pros and cons? > In my opinion, an email should either be received by a MTA and > delivered to the recipient, or rejected during the SMTP phase. Thanks everyone for the good advice.

Re: milter vs spamc

2024-01-15 Thread Benoit Panizzon
Hi > The only con is that milter can't apply multiple SA settings when single > mail has multiple destination users - it only has to use single setting for > them. We found a way around this, we use MIMEDefang as Milter and have built database lookups in the config. Usually, per user SA

Re: milter vs spamc

2024-01-15 Thread Matus UHLAR - fantomas
On 14.01.24 22:22, Mike Bostock via users wrote: I currently have users set up with spamc called in .procmailrc However, I have quite a few aliases/redirects in sendmail virtusertable who are not being protected by Spamassassin. spamass-milter has setting for default user (-U username) that

Re: milter vs spamc

2024-01-15 Thread Benoit Panizzon
Hi > What are the pros and cons? In my opinion, an email should either be received by a MTA and delivered to the recipient, or rejected during the SMTP phase. This eliminates: * Emails 'disappearing' (false positives as example) * Sending late bounces to fake sender when rejected by the LDA

Re: milter vs spamc

2024-01-14 Thread Benny Pedersen
Mike Bostock via users skrev den 2024-01-14 23:22: I currently have users set up with spamc called in .procmailrc virtual users is hard to support then However, I have quite a few aliases/redirects in sendmail virtusertable who are not being protected by Spamassassin. good, move all system

milter vs spamc

2024-01-14 Thread Mike Bostock via users
I currently have users set up with spamc called in .procmailrc However, I have quite a few aliases/redirects in sendmail virtusertable who are not being protected by Spamassassin. Would I be better using the milter? What are the pros and cons? How do I redirect spam to a mailbox if I use the

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-08 Thread Benny Pedersen
Byung-Hee HWANG skrev den 2024-01-08 12:27: Gmail is my last INBOX. That's enough for me. +1, so you are ready to setup google mx ? :) https://support.google.com/a/answer/140034?hl=en i don't like it yet, missing dnssec and dane, tlsa, google is not friendly there if google wants my

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-08 Thread Matus UHLAR - fantomas
This is not a good advice. Whoever filters SPF at SMTP time will reject that message. Gmail is not the only mail service available. On 08.01.24 20:27, Byung-Hee HWANG wrote: Gmail is my last INBOX. That's enough for me. that's what I wanted to say - enough for someone, but not generally

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-08 Thread Byung-Hee HWANG
> > This is not a good advice. Whoever filters SPF at SMTP time will > reject that > message. Gmail is not the only mail service available. Hellow Matus, Gmail is my last INBOX. That's enough for me. Sincerely, Byung-Hee -- ^고맙습니다 _布德天下_ 감사합니다_^))//

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-07 Thread Matus UHLAR - fantomas
I built email servers for a non-profit I volunteer for. If email comes into the server for presid...@myassociation.org, I would normally just create an alias in /etc/aliases so that emails to president@ get forwarded to the president's "real" email address, say

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-07 Thread Byung-Hee HWANG
> > I built email servers for a non-profit I volunteer for. If email > comes > into the server for presid...@myassociation.org, I would normally > just > create an alias in /etc/aliases so that emails to president@ get > forwarded to the president's "real" email address, say >

Re: symlinking config files

2024-01-05 Thread Kris Deugau
Thomas Krichel wrote: Hi gang, my first post here. I'm running version 4.0.0-8 on debian testing. This is for Mailman. I have a script that creates a welcomelist for all my Mailman members. I include it via a symlink. # ls -l /etc/spamassassin/88_mailman_members.cf lrwxrwxrwx

Re: symlinking config files

2024-01-05 Thread Thomas Krichel
Bill Cole writes > You probably only needed to restart spamd. I think I did this every time I tested, and I tested many times over. -- Written by Thomas Krichel http://openlib.org/home/krichel on his 21399th day.

Re: symlinking config files

2024-01-05 Thread Bill Cole
On 2024-01-05 at 13:53:00 UTC-0500 (Fri, 5 Jan 2024 18:53:00 +) Thomas Krichel is rumored to have said: Hi gang, my first post here. I'm running version 4.0.0-8 on debian testing. This is for Mailman. I have a script that creates a welcomelist for all my Mailman members. I

Re: symlinking config files

2024-01-05 Thread Thomas Krichel
Antony Stone writes > Check the user which spamc runs Thank you for this! root@tagol~# ps axf | grep spam 789246 ?S 0:00 \_ spamd child root@tagol~# ps axf | grep spam 662102 ?Ss 0:00 gpg-agent --homedir /etc/spamassassin/sa-update-keys --use-standard-socket

Re: symlinking config files

2024-01-05 Thread Antony Stone
On Friday 05 January 2024 at 19:53:00, Thomas Krichel wrote: > I'm running version 4.0.0-8 on debian testing. This is for > Mailman. I have a script that creates a welcomelist for all my > Mailman members. I include it via a symlink. > Clearly spamassassin follows the symlink and reads

symlinking config files

2024-01-05 Thread Thomas Krichel
Hi gang, my first post here. I'm running version 4.0.0-8 on debian testing. This is for Mailman. I have a script that creates a welcomelist for all my Mailman members. I include it via a symlink. # ls -l /etc/spamassassin/88_mailman_members.cf lrwxrwxrwx 1 root root 57 Jan 5 15:52

Re: Gift Card Scam

2024-01-05 Thread Matus UHLAR - fantomas
On 04.01.24 22:57, Matija Nalis wrote: bodyGIFT_CARD /gift card/i score GIFT_CARD 1.5 metaFREEMAIL_GIFTCARDSGIFT_CARD && (FREEMAIL_FROM || !DKIM_VALID) Matus UHLAR - fantomas skrev den 2024-01-05 09:06: shouldn't that be !DKIM_VALID_AU ? valid DKIM signature means

Re: Gift Card Scam

2024-01-05 Thread Benny Pedersen
Matus UHLAR - fantomas skrev den 2024-01-05 09:06: On 04.01.24 22:57, Matija Nalis wrote: bodyGIFT_CARD /gift card/i score GIFT_CARD 1.5 metaFREEMAIL_GIFTCARDSGIFT_CARD && (FREEMAIL_FROM || !DKIM_VALID) shouldn't that be !DKIM_VALID_AU ? valid DKIM signature means

Re: Gift Card Scam

2024-01-05 Thread Matus UHLAR - fantomas
On 04.01.24 22:57, Matija Nalis wrote: bodyGIFT_CARD /gift card/i score GIFT_CARD 1.5 metaFREEMAIL_GIFTCARDSGIFT_CARD && (FREEMAIL_FROM || !DKIM_VALID) shouldn't that be !DKIM_VALID_AU ? valid DKIM signature means nothing by itself -- Matus UHLAR - fantomas,

Re: Gift Card Scam

2024-01-04 Thread Kirk Ismay
On 2024-01-04 1:57 p.m., Matija Nalis wrote: bodyGIFT_CARD /gift card/i score GIFT_CARD 1.5 metaFREEMAIL_GIFTCARDSGIFT_CARD && (FREEMAIL_FROM || !DKIM_VALID) score FREEMAIL_GIFTCARDS6.0 If you're not big on gift cards. Also, you might want to enable and train Bayes...

Re: Gift Card Scam

2024-01-04 Thread Noel
On 1/4/2024 3:19 PM, Kirk Ismay wrote: I'm wondering if anyone has any good ideas to catch gift card scam emails.  This latest version came from Gmail, and has valid DKIM records and the IPs are whitelisted. Thanks, Kirk Here's the hits from SpamAssassin: X-Spam-Status: No, score=0.3

Re: Gift Card Scam

2024-01-04 Thread Matija Nalis
bodyGIFT_CARD /gift card/i score GIFT_CARD 1.5 metaFREEMAIL_GIFTCARDSGIFT_CARD && (FREEMAIL_FROM || !DKIM_VALID) score FREEMAIL_GIFTCARDS6.0 If you're not big on gift cards. Also, you might want to enable and train Bayes... On Thu, Jan 04, 2024 at 01:19:28PM -0800,

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-04 Thread Andy Smith
Hello, On Wed, Jan 03, 2024 at 01:24:02PM -0600, Thomas Cameron via users wrote: > On 1/2/24 17:51, Andy Smith wrote: > > - Have your users collect their your-org email by some means other > >than SMTP, such as running an IMAP server and having them view > >both their gmail mailbox and

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-04 Thread Thomas Cameron
On 1/4/24 06:35, Matus UHLAR - fantomas wrote: On 03.01.24 20:36, Thomas Cameron wrote: Fair point. But I'm guessing that because it has two DKIM signatures, it's not passing the DKIM check. only one of those DKIM dignatures needs to pass, with the domain in From: Yup, and it seems to be

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-04 Thread Thomas Cameron
On 1/4/24 06:31, Matus UHLAR - fantomas wrote: On 03.01.24 19:30, Thomas Cameron wrote: Thanks for the advice on SRS - I have set it up and it's mostly working. At least GMail accepts the emails, although it seems to be failing DKIM and DMARC tests. I'm digging into what, if anything, can be

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-04 Thread Matus UHLAR - fantomas
Thomas Cameron writes: Yeah, the weird thing is, when I check the forwarded email on GMail, I see in the headers that both the original sending email server (call it mail.somedomain.com) and the relay server (call it mail.myassociation.org) put DKIM signatures in the message. On 1/3/24

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-04 Thread Matus UHLAR - fantomas
On 1/3/24 15:44, Bill Cole wrote: Indeed: your solution is known as "SRS" (Sender Rewriting Scheme) and it has multiple implementations. If you forward mail, you will break SPF unless you fix the envelope sender so that it uses a domain  that permits the example.org server to send for it.

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-03 Thread Thomas Cameron
On 1/3/24 19:45, Greg Troxel wrote: Thomas Cameron writes: Yeah, the weird thing is, when I check the forwarded email on GMail, I see in the headers that both the original sending email server (call it mail.somedomain.com) and the relay server (call it mail.myassociation.org) put DKIM

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-03 Thread Greg Troxel
Thomas Cameron writes: > Yeah, the weird thing is, when I check the forwarded email on GMail, I > see in the headers that both the original sending email server (call > it mail.somedomain.com) and the relay server (call it > mail.myassociation.org) put DKIM signatures in the message. That's

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-03 Thread Thomas Cameron
On 1/3/24 17:41, Greg Troxel wrote: You are overlooking that DKIM from the original From: is the responsibility of that domain and that if you do not modify the message then it should still pass. Domains sending without DKIM are going to be a mess. Yeah, the weird thing is, when I check the

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-03 Thread Thomas Cameron
On 1/3/24 15:44, Bill Cole wrote: Indeed: your solution is known as "SRS" (Sender Rewriting Scheme) and it has multiple implementations. If you forward mail, you will break SPF unless you fix the envelope sender so that it uses a domain  that permits the example.org server to send for it.

[SOLVED] Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-03 Thread Thomas Cameron
On 1/3/24 18:16, Michael Grant wrote: Here's what I have done in the past from my server to get around this situation you are having: 1. In my .procmailrc file :0c: !exam...@gmail.com This sends a copy (the c flag in first line) of the message to the gmail account and leaves a copy in your

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-03 Thread Michael Grant via users
Here's what I have done in the past from my server to get around this situation you are having: 1. In my .procmailrc file :0c: !exam...@gmail.com This sends a copy (the c flag in first line) of the message to the gmail account and leaves a copy in your inbox. 2. From your exam...@gmail.com

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-03 Thread Greg Troxel
"Thomas Cameron via users" writes: > I actually set up SPF, DMARC, and DKIM on the non-profit's email > server. It works fine if I send email from the server. > > The rub is, I want all emails to presid...@example.org to be forwarded > to presidents_real_addr...@gmail.com. Since the forward

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-03 Thread admin
Hello Thomas, This might help too: These failures are often due to SPFs that have a hard fail (meaning they end with ‘-all’). When I dealt with this in the past, the original sending domain was one where we could modify the SPF. So we had the email sender change “-all” to “~all” and since that

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-03 Thread Bill Cole
On 2024-01-03 at 14:17:11 UTC-0500 (Wed, 3 Jan 2024 13:17:11 -0600) Thomas Cameron via users is rumored to have said: The rub is, I want all emails to presid...@example.org to be forwarded to presidents_real_addr...@gmail.com. Since the forward happens at mail.example.org, the "from" is from

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-03 Thread Thomas Cameron via users
On 1/2/24 17:51, Andy Smith wrote: Hi Thomas, On Tue, Jan 02, 2024 at 04:24:37PM -0600, Thomas Cameron via users wrote: I built email servers for a non-profit I volunteer for. If email comes into the server for presid...@myassociation.org, I would normally just create an alias in /etc/aliases

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-03 Thread Thomas Cameron via users
On 1/3/24 01:21, Jared Hall wrote: On 1/2/2024 5:24 PM, Thomas Cameron via users wrote: The problem is, when I send email to presid...@myassociation.org, gmail rejects the forwarded email because it appears to come from my personal domain, not the mythical myassociation.org domain. DKIM,

Re: MS-relayed spam

2024-01-03 Thread Shawn Iverson
On Wed, Jan 3, 2024 at 5:06 AM Matus UHLAR - fantomas wrote: > What? > > If the message came from .outlook.com hosts, it should be reported to > ab...@outlook.com. > > You are right, it did come from an .outlook.com host. My mistake. I'm not sure why they blocked the user, then.

Re: MS-relayed spam

2024-01-03 Thread Matus UHLAR - fantomas
On Tue, Jan 2, 2024 at 3:11 PM Torpey List wrote: I started forwarding full headers and text to "ab...@outlook.com" and they blocked my IP. On 02.01.24 16:49, Shawn Iverson wrote: ab...@outlook.com is for reporting abuse on the freemail Outlook/Hotmail/MSN platforms, not Microsoft tenants.

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-02 Thread Jared Hall via users
On 1/2/2024 5:24 PM, Thomas Cameron via users wrote: The problem is, when I send email to presid...@myassociation.org, gmail rejects the forwarded email because it appears to come from my personal domain, not the mythical myassociation.org domain. DKIM, DMARC, and SPF all fail, which I

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-02 Thread Greg Troxel
"Thomas Cameron via users" writes: > I built email servers for a non-profit I volunteer for. If email comes > into the server for presid...@myassociation.org, I would normally just > create an alias in /etc/aliases so that emails to president@ get > forwarded to the president's "real" email

Re: Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-02 Thread Andy Smith
Hi Thomas, On Tue, Jan 02, 2024 at 04:24:37PM -0600, Thomas Cameron via users wrote: > I built email servers for a non-profit I volunteer for. If email comes into > the server for presid...@myassociation.org, I would normally just create an > alias in /etc/aliases so that emails to president@ get

Question about forwarding email (not specifically SA, pointers greatly appreciated)

2024-01-02 Thread Thomas Cameron via users
Howdy, all - This is not strictly SpamAssassin related, but y'all probably know where to point me to make this work. I built email servers for a non-profit I volunteer for. If email comes into the server for presid...@myassociation.org, I would normally just create an alias in /etc/aliases

Re: MS-relayed spam

2024-01-02 Thread Shawn Iverson
On Tue, Jan 2, 2024 at 3:11 PM Torpey List wrote: > I started forwarding full headers and text to "ab...@outlook.com" and > they > blocked my IP. > > ab...@outlook.com is for reporting abuse on the freemail Outlook/Hotmail/MSN platforms, not Microsoft tenants. https://msrc.microsoft.com/report/

Re: MS-relayed spam

2024-01-02 Thread Torpey List
I started forwarding full headers and text to "ab...@outlook.com" and they blocked my IP. -Original Message- From: David Jones via users Sent: Tuesday, January 2, 2024 1:07 PM To: Charles Sprickman Cc: SA Mailing list Subject: Re: MS-relayed spam I would report this to Microsoft

Re: MS-relayed spam

2024-01-02 Thread Bill Cole
On 2024-01-01 at 16:28:04 UTC-0500 (Mon, 1 Jan 2024 16:28:04 -0500) Charles Sprickman is rumored to have said: Hi all, Full headers are here as well: https://pastebin.com/wHNmnvtE I'm not really following what's going on here - a few things confuse me... - the empty from envelope, which

Re: MS-relayed spam

2024-01-02 Thread Matus UHLAR - fantomas
On 01.01.24 16:28, Charles Sprickman wrote: Full headers are here as well: https://pastebin.com/wHNmnvtE neither indicate that the mail was relayes by microsoft. Isn't this just backscatter, non-delivery notice on fake mail? I'm not really following what's going on here - a few things

Re: MS-relayed spam

2024-01-02 Thread David Jones via users
I would report this to Microsoft Abuse and setup local rules that add a point or two something like this: header BAD_O365_SENDER X-OriginatorOrg =~ /.*\.onmicrosoft\.com$/ With a threshold of 6.2, you might want to consider either lowering that a little or bumping up some default scores for

MS-relayed spam

2024-01-01 Thread Charles Sprickman
Hi all, Full headers are here as well: https://pastebin.com/wHNmnvtE I'm not really following what's going on here - a few things confuse me... - the empty from envelope, which I thought was more of a "bounce" thing - that it does seem formatted like a bounce - across multiple servers I'm

Re: Beginner Setting up Spam Assassin

2023-12-30 Thread Antony Stone
On Saturday 30 December 2023 at 11:54:33, FalconChristopher wrote: > The comment by Michael Grant ? Yes, the comment I quoted below. He is suggesting how you can deal with this problematic user you want to "eliminate spam coming in from". > On 12/30/2023 5:52 AM, Antony Stone wrote: > > On

Re: Beginner Setting up Spam Assassin

2023-12-30 Thread Loren Wilton
SpamAssassin cannot block or eliminate spam. It does not have the facilities to do that. SA can only score potential spam. Whatever method you used to glue SA into your mail path needs to parse the score SA assigned in the returned mail, and do whatever routing it thinks is appropriate. We

Re: Beginner Setting up Spam Assassin

2023-12-30 Thread FalconChristopher
The comment by Michael Grant ? On 12/30/2023 5:52 AM, Antony Stone wrote: On Saturday 30 December 2023 at 11:48:30, FalconChristopher wrote: Hi, can I not ask how to set up Spam Assassin in this mailing group it is a group for Spam Assassin. That comment was a recommendation of how you can

Re: Beginner Setting up Spam Assassin

2023-12-30 Thread Antony Stone
On Saturday 30 December 2023 at 11:48:30, FalconChristopher wrote: > Hi, can I not ask how to set up Spam Assassin in this mailing group it > is a group for Spam Assassin. That comment was a recommendation of how you can achieve what you want to. > On 12/30/2023 4:30 AM, Michael Grant wrote: >

Re: Beginner Setting up Spam Assassin

2023-12-30 Thread FalconChristopher
Hi, can I not ask how to set up Spam Assassin in this mailing group it is a group for Spam Assassin. On 12/30/2023 4:30 AM, Michael Grant wrote: Can you ban this user in whatever your equivalent of the access file is so instead of putting the messages into a spam folder, you reject messages

Re: Beginner Setting up Spam Assassin

2023-12-30 Thread Michael Grant via users
Can you ban this user in whatever your equivalent of the access file is so instead of putting the messages into a spam folder, you reject messages from that address at delivery time (SMTP)? On 30 December 2023 04:08:17 CET, FalconChristopher wrote: >ⓘ *No issues found, please report it if

Re: Beginner Setting up Spam Assassin

2023-12-30 Thread Matus UHLAR - fantomas
On 29.12.23 22:08, FalconChristopher wrote: Anyone know how I can check and setup SpamAssassin so that I can eliminate some spam from coming in from a email account ? do you mean if one of your users started spamming out? On 12/28/2023 2:24 AM, Matus UHLAR - fantomas wrote: On 27.12.23

Re: Beginner Setting up Spam Assassin

2023-12-29 Thread Jimmy
You can create rule something like this header BLOCK_EMAIL From:addr =~ /user\@domain\.com/ describe BLOCK_EMAIL Block email scoreBLOCK_EMAIL5.00 On Sat, Dec 30, 2023 at 10:08 AM FalconChristopher < falconchristop...@bell.net> wrote: > Anyone

Re: Beginner Setting up Spam Assassin

2023-12-29 Thread FalconChristopher
Anyone know how I can check and setup SpamAssassin so that I can eliminate some spam from coming in from a email account ? On 12/28/2023 2:24 AM, Matus UHLAR - fantomas wrote: On 27.12.23 16:53, FalconChristopher wrote: Hi, I want to setup Spam Assassin so that any email that Spam Assassin

Re: Spreadsheet::Excel ?

2023-12-29 Thread Bill Cole
On 2023-12-29 at 08:41:23 UTC-0500 (Fri, 29 Dec 2023 08:41:23 -0500) Alex is rumored to have said: Hi, Barracuda recently announced they've identified a vulnerability in the Spreadsheet::Excel library used by amavis in their appliances. I didn't realize they were still using amavis and open

Re: Spreadsheet::Excel ?

2023-12-29 Thread Benny Pedersen
Alex skrev den 2023-12-29 14:41: Hi, Barracuda recently announced they've identified a vulnerability in the Spreadsheet::Excel library used by amavis in their appliances. I didn't realize they were still using amavis and open source (and presumably spamassassin?).

Spreadsheet::Excel ?

2023-12-29 Thread Alex
Hi, Barracuda recently announced they've identified a vulnerability in the Spreadsheet::Excel library used by amavis in their appliances. I didn't realize they were still using amavis and open source (and presumably spamassassin?). https://www.barracuda.com/company/legal/esg-vulnerability I

Re: Bayes Stopword

2023-12-29 Thread Jimmy
This is what I believe: the words need to be trimmed or separated, and careful consideration is required to determine the language in order to perform accurate cutoffs. Jimmy On Fri, Dec 29, 2023 at 5:16 PM wrote: > "ทุก" is not considered a word because it's part of the token >

Re: Bayes Stopword

2023-12-29 Thread giovanni
"ทุก" is not considered a word because it's part of the token "ทุกวันพุธเล่นชนะรับเพิ่ม". Words must be separated by spaces, otherwise we should skip the word "theme" just because "the" is in english stopword list. No idea if this makes sense for asian languages. Giovanni On 12/29/23 11:04,

Re: Bayes Stopword

2023-12-29 Thread Jimmy
The sample email and word list should contain at least these words. ถูก เลย ทุก Jimmy On Fri, Dec 29, 2023 at 4:47 PM wrote: > I do not speak Thai but I cannot see any word in the sample email that > should match that list. > Which word do you think should match the regexp ? > Giovanni > >

Re: Bayes Stopword

2023-12-29 Thread giovanni
I do not speak Thai but I cannot see any word in the sample email that should match that list. Which word do you think should match the regexp ? Giovanni On 12/29/23 10:08, Jimmy wrote: You can use this word list

Re: Bayes Stopword

2023-12-29 Thread Jimmy
You can use this word list https://raw.githubusercontent.com/stopwords-iso/stopwords-th/master/stopwords-th.txt Jimmy On Fri, Dec 29, 2023 at 3:59 PM wrote: > To create the stopwords regexp I used the script I shared in a previous > email and a list of words one per line. > Could you share

Re: Bayes Stopword

2023-12-29 Thread giovanni
To create the stopwords regexp I used the script I shared in a previous email and a list of words one per line. Could you share the list you are using ? Giovanni On 12/29/23 09:22, Jimmy wrote: I use SpamAssassin 4.0.0 (2022-12-14) $ spamassassin -D --lint 2>&1 | grep bayes: Dec 29

Re: Bayes Stopword

2023-12-29 Thread Jimmy
I use SpamAssassin 4.0.0 (2022-12-14) $ spamassassin -D --lint 2>&1 | grep bayes: Dec 29 15:17:56.919 [17420] dbg: bayes: stopword found lang=en Dec 29 15:17:56.919 [17420] dbg: bayes: stopword found lang=th Dec 29 15:17:56.919 [17420] dbg: bayes: stopword found lang=ru Dec 29 15:17:56.919

<    1   2   3   4   5   6   7   8   9   10   >