Re: Multiple test failures

2024-04-24 Thread Sidney Markowitz
Hi Scott, Your question is timely. When you posted that, I wasn't aware of problems with t/spamd_client.t, but now I have enough examples that it is the next failure case I'm tracking down. Can you email me directly (don't have to do the detailed back and forth to the entire mailing list)

Re: Multiple test failures

2024-04-24 Thread Scott Ellentuch
Hi, Any updates on this ? Tnx, Tuc On Tue, Apr 9, 2024 at 6:24 PM Scott Ellentuch wrote: > Hi, > > Yes, as ec2-user running the make and then make test ends up failing. > There are no issues with the port as a previous tcpdump has shown, it > transfers data back and forth. It gets through

Re: Tips for improving bounce message deliverability?

2024-04-24 Thread Benny Pedersen
Bill Cole skrev den 2024-04-24 19:37: On 2024-04-24 at 12:27:01 UTC-0400 (Wed, 24 Apr 2024 18:27:01 +0200) Benny Pedersen is rumored to have said: For example, it matches on * 3.1 URI_IMG_CWINDOWSNET Non-MSFT image hosted by Microsoft Azure infra, possible phishing this is not in

Re: authres missing spf-helo ?

2024-04-24 Thread Benny Pedersen
Matus UHLAR - fantomas skrev den 2024-04-24 18:58: On 24.04.24 18:50, Benny Pedersen wrote: unsure so i ask :) try to explain your question a bit more perldoc Mail::SpamAssassin::Plugin::AuthRes EVAL FUNCTIONS header RULENAME eval:check_authres_result(method, result) Can be

Re: Tips for improving bounce message deliverability?

2024-04-24 Thread Bill Cole
On 2024-04-24 at 12:27:01 UTC-0400 (Wed, 24 Apr 2024 18:27:01 +0200) Benny Pedersen is rumored to have said: >> For example, it matches on >> * 3.1 URI_IMG_CWINDOWSNET Non-MSFT image hosted by Microsoft Azure >> infra, possible phishing > > this is not in spamassassin core rules Yes, it is:

Re: Tips for improving bounce message deliverability?

2024-04-24 Thread Matus UHLAR - fantomas
Alex skrev den 2024-04-24 15:45: I'm using SA 4.0.1 and amavisd with postfix. I've identified a few bounce messages in the quarantine because they weren't identified properly. Here's one: https://pastebin.com/RMNkcyhF 1.3 RDNS_NONE Delivered to internal network by a host with no

Re: authres missing spf-helo ?

2024-04-24 Thread Matus UHLAR - fantomas
On 24.04.24 18:50, Benny Pedersen wrote: unsure so i ask :) try to explain your question a bit more -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek

authres missing spf-helo ?

2024-04-24 Thread Benny Pedersen
unsure so i ask :)

Re: Tips for improving bounce message deliverability?

2024-04-24 Thread Benny Pedersen
Alex skrev den 2024-04-24 15:45: Hi, I'm using SA 4.0.1 and amavisd with postfix. I've identified a few bounce messages in the quarantine because they weren't identified properly. Here's one: https://pastebin.com/RMNkcyhF Content preview: Delivery has failed to these recipients or groups:

Tips for improving bounce message deliverability?

2024-04-24 Thread Alex
Hi, I'm using SA 4.0.1 and amavisd with postfix. I've identified a few bounce messages in the quarantine because they weren't identified properly. Here's one: https://pastebin.com/RMNkcyhF For example, it matches on * 3.1 URI_IMG_CWINDOWSNET Non-MSFT image hosted by Microsoft Azure infra,

Re: SA 4.0.1 - DMARC plugin

2024-04-20 Thread Sidney Markowitz
I was wrong about the severity. It does look like the error aborts the running of the DMARC plugin when it happens, so no DMARC result will be scored for that email. I've committed a fix to trunk. This bug only happens in perl versions less than 5.20.0. I see that this case was in CentOS 7

Re: SA 4.0.1 - DMARC plugin

2024-04-19 Thread Sidney Markowitz
As a practical matter, the message appears to be a warning in the log, but the results would be correct, so it can be ignored. Sidney Markowitz wrote on 20/04/24 9:55 am: I've open a bug in which I noted my suspicion of what is happening.

Re: SA 4.0.1 - DMARC plugin

2024-04-19 Thread Sidney Markowitz
I've open a bug in which I noted my suspicion of what is happening. https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8245 If you have a sanitized email that consistently causes this to happen, please attach it to the bug report. As I said in the bug report, I suspect that an email that

SA 4.0.1 - DMARC plugin

2024-04-19 Thread Mateusz Krawczyk
Hello, after updating SA 4.0.0 to 4.0.1, (CentOS 7 - Perl version 5.16.3) I get the following message in log regarding the DMARC plugin: plugin: eval failed: Can't use an undefined value as an ARRAY reference at /usr/share/perl5/Mail/SpamAssassin/Plugin/DMARC.pm line 336. File "DMARC.pm": my

Re: How to find why a mail is SPAM DROPPED ?

2024-04-18 Thread Benny Pedersen
Pierluigi Frullani skrev den 2024-04-18 20:23: It was simscan, that is compiled with enable-drop. with is fine The problem was a bad expression in blacklist_from section in local.cf [1] this is spam, not virus Sorry for the noise. if you like to reject all / drop all, why not pants ?

Re: How to find why a mail is SPAM DROPPED ?

2024-04-18 Thread Benny Pedersen
Pierluigi Frullani skrev den 2024-04-18 19:52: So could it be simscan ? super you wake up :) configure it to pass spam, and reject virus simscan is very old, btw

Re: How to find why a mail is SPAM DROPPED ?

2024-04-18 Thread Benny Pedersen
Pierluigi Frullani skrev den 2024-04-18 19:44: I'm really fighting with spamassasin as one ( legit ) mail get spam dropped with a 99.90 value, also if I have put, in local.cf [1] a required hit of 100. why is 100 required score ? spamassassin does only tag, it does not drop The mail is

Re: How to find why a mail is SPAM DROPPED ?

2024-04-18 Thread Pierluigi Frullani
It was simscan, that is compiled with enable-drop. The problem was a bad expression in blacklist_from section in local.cf Sorry for the noise. Pierluigi Il giorno gio 18 apr 2024 alle ore 19:56 Reindl Harald (privat) < ha...@rhsoft.net> ha scritto: > > > Am 18.04.24 um 19:52 schrieb Pierluigi

Re: How to find why a mail is SPAM DROPPED ?

2024-04-18 Thread Pierluigi Frullani
So could it be simscan ? I'm using qmail with simscan for clamav and spamassasin. Thanks ! Il giorno gio 18 apr 2024 alle ore 19:48 Reindl Harald (privat) < ha...@rhsoft.net> ha scritto: > > > Am 18.04.24 um 19:44 schrieb Pierluigi Frullani: > > Hello all, > > I'm really fighting with

How to find why a mail is SPAM DROPPED ?

2024-04-18 Thread Pierluigi Frullani
Hello all, I'm really fighting with spamassasin as one ( legit ) mail get spam dropped with a 99.90 value, also if I have put, in local.cf a required hit of 100. The mail is sent from a legit gmail account ( my daughter ) to me and contains some amazon links for stuff to buy. I have disabled

Re: spamassassin with gmail

2024-04-15 Thread Noel Butler
On 16/04/2024 08:24, Michael Grant via users wrote: I am not at all advocating people use gmail. Something like 68% of the planet already uses it and few people like I really wonder about that, or did they pull a trump... I ran this June last year, the results are somewhat surprising, of

Re[2]: spamassassin with gmail

2024-04-15 Thread Michael Grant via users
https://isbg.gitlab.io/isbg/index.html support gmail and spamassassin other then that i tryed to make a gentoo ebuild for it, have to retry now :) Yes that's kinda similar! I'll have to try that! Thanks.

Re: spamassassin with gmail

2024-04-15 Thread Benny Pedersen
Michael Grant via users skrev den 2024-04-15 12:55: Do any of you use spamassassin with a gmail account, and if so, how are people doing it? The reason to do this is gmail's spam filtering isn't perfect and you don't have the control you have with spamassassin. ...

Re[2]: spamassassin with gmail

2024-04-15 Thread Michael Grant via users
Matija Sorry, you have misunderstood what I posted. I am not at all advocating people use gmail. Something like 68% of the planet already uses it and few people like you and me have the skills to host our own email. It's not crazy for the people who use gmail or yahoo or other providers,

RE: Re[2]: spamassassin with gmail

2024-04-15 Thread Marc
> >Why not just forward messages? Register a domain put some mx servers in > front of gmails mx. I recently was testing with such relay/forward, works > perfectly, I am only changing the envelope nothing else. DKIM, spf > everyting perfectly working. > > > I'd be interested to know if anyone runs

Re: spamassassin with gmail

2024-04-15 Thread Matija Nalis
On Mon, Apr 15, 2024 at 01:48:53PM +, Michael Grant via users wrote: > > I don't like any daemon connecting to my mail storage. Can you imagine if > > your solution gets hacked, how much data would be compromised? I prefer > > messages being scanned/marked before stored. I wonder if this is

Re[2]: spamassassin with gmail

2024-04-15 Thread Michael Grant via users
From "Marc" You can add to this, that gmail actually is also losing email and annoying is that you can't send zip files. I am constantly asking people to give me a different email address. Yup! And it's not too difficult to pull messages out of the Spam folder and put them back into Inbox.

RE: spamassassin with gmail

2024-04-15 Thread Marc
> > Do any of you use spamassassin with a gmail account, and if so, how are > people doing it? The reason to do this is gmail's spam filtering isn't > perfect You can add to this, that gmail actually is also losing email and annoying is that you can't send zip files. I am constantly asking

spamassassin with gmail

2024-04-15 Thread Michael Grant via users
Do any of you use spamassassin with a gmail account, and if so, how are people doing it? The reason to do this is gmail's spam filtering isn't perfect and you don't have the control you have with spamassassin. We built some plumbing to do this using gmail's API, and also IMAP which can work

Re: Defining what the default welcomelist means

2024-04-14 Thread Bill Cole
I believe we are in solid agreement, a few notes below explaining how... On 2024-04-14 at 08:00:19 UTC-0400 (Sun, 14 Apr 2024 08:00:19 -0400) Greg Troxel is rumored to have said: > Bill Cole writes: > >> On 2024-04-12 at 18:56:15 UTC-0400 (Fri, 12 Apr 2024 18:56:15 -0400) >> Greg Troxel >>

Re: Defining what the default welcomelist means

2024-04-14 Thread Greg Troxel
Bill Cole writes: > On 2024-04-12 at 18:56:15 UTC-0400 (Fri, 12 Apr 2024 18:56:15 -0400) > Greg Troxel > >> Bill Cole writes: >> >>> 1. We serve our users: receivers, not senders. Senders claiming FPs >>> need the support of a corroborating would-be receiver. >> >> Agreed. Or maybe we take

Re: WARNING: Microsoft has earned removal from SA default welcomelist

2024-04-13 Thread Noel Butler
On 13/04/2024 19:27, Marc wrote: All nice and well, but a bit decades to late. There should never have been such default whitelist. Companies should take care not be on blacklists, and should maintain some Absolutely, no arguments there! After all spf -all exists already for a long time. So

Re: Defining what the default welcomelist means

2024-04-13 Thread Benny Pedersen
Bill Cole skrev den 2024-04-13 19:42: score USER_IN_DEF_DKIM_WL -2 score USER_IN_DEF_SPF_WL -2 By default those each score -7.5 so a doubly-confirmed message gets the same insane -15 as a legacy listing (def_whitelist_from_rcvd) that doesn't require authentication. No such listings still

Re: Defining what the default welcomelist means

2024-04-13 Thread Bill Cole
On 2024-04-12 at 19:26:59 UTC-0400 (Fri, 12 Apr 2024 16:26:59 -0700) jdow is rumored to have said: > On 20240412 16:14:44, Greg Troxel wrote: >> jdow writes: >> >>> One pesky detail still exists. There is a very broad fuzzy area where >>> my spam is your ham and vice versa. You could probably

Re: Defining what the default welcomelist means

2024-04-13 Thread Bill Cole
On 2024-04-12 at 19:01:21 UTC-0400 (Fri, 12 Apr 2024 19:01:21 -0400) Greg Troxel is rumored to have said: > Also, I'm not sure you said this, but I would say: > >default whitelist is dkim only No. Existing practice is that we trust both DKIM and SPF, and I think that's fine. There are no

Re: Defining what the default welcomelist means

2024-04-13 Thread Bill Cole
On 2024-04-12 at 18:56:15 UTC-0400 (Fri, 12 Apr 2024 18:56:15 -0400) Greg Troxel is rumored to have said: > I see it very slightly differently, but mostly agree > > Bill Cole writes: > >> 1. We serve our users: receivers, not senders. Senders claiming FPs >> need the support of a corroborating

Re: Dynamic blacklist ?

2024-04-13 Thread Pierluigi Frullani
Thanks Bill, I will give this a look ! Pierluigi Il giorno ven 12 apr 2024 alle ore 23:00 Bill Cole < sausers-20150...@billmail.scconsult.com> ha scritto: > On 2024-04-12 at 02:14:59 UTC-0400 (Fri, 12 Apr 2024 08:14:59 +0200) > Pierluigi Frullani > is rumored to have said: > > > Hello all, > >

RE: WARNING: Microsoft has earned removal from SA default welcomelist

2024-04-13 Thread Marc
All nice and well, but a bit decades to late. There should never have been such default whitelist. Companies should take care not be on blacklists, and should maintain some degree of standard implementation to send out email. After all spf -all exists already for a long time. So why are

Re: WARNING: Microsoft has earned removal from SA default welcomelist

2024-04-12 Thread Noel Butler
On 13/04/2024 03:20, Bill Cole wrote: In my opinion, this is an indication that the default welcomelist entries in the official I'm good with that, so long as likes of google are not in any whitelist either. I haven't been following all the anti spam stuff as much as I used to (I have

Re: Defining what the default welcomelist means

2024-04-12 Thread jdow
On 20240412 16:14:44, Greg Troxel wrote: jdow writes: One pesky detail still exists. There is a very broad fuzzy area where my spam is your ham and vice versa. You could probably drive yourself to an early grave trying to get the perfect Bayes training plus perfect rule set. spam is bulk and

Re: Defining what the default welcomelist means

2024-04-12 Thread Greg Troxel
jdow writes: > One pesky detail still exists. There is a very broad fuzzy area where > my spam is your ham and vice versa. You could probably drive yourself > to an early grave trying to get the perfect Bayes training plus > perfect rule set. spam is bulk and unsolicited. So yes the same

Re: Defining what the default welcomelist means

2024-04-12 Thread jdow
On 20240412 15:56:15, Greg Troxel wrote: I see it very slightly differently, but mostly agree Bill Cole writes: 1. We serve our users: receivers, not senders. Senders claiming FPs need the support of a corroborating would-be receiver. Agreed. Or maybe we take requests to add only from

Re: Defining what the default welcomelist means

2024-04-12 Thread Greg Troxel
Also, I'm not sure you said this, but I would say: default whitelist is dkim only This means All existing entries are converted to dkim as well as we can, not worrying if they break. We'll prune ones that don't work as dkim, and add a signing domain as we figure it out, as

Re: Defining what the default welcomelist means

2024-04-12 Thread Greg Troxel
I see it very slightly differently, but mostly agree Bill Cole writes: > 1. We serve our users: receivers, not senders. Senders claiming FPs > need the support of a corroborating would-be receiver. Agreed. Or maybe we take requests to add only from receivers. > 2. If senders have FPs on

Re: problems with Plugin::ASN and spam

2024-04-12 Thread Darrell Budic
> On Apr 11, 2024, at 5:51 PM, Darrell Budic wrote: > > On Apr 11, 2024, at 3:30 PM, Bill Cole > wrote: >> >> On 2024-04-10 at 21:19:48 UTC-0400 (Wed, 10 Apr 2024 20:19:48 -0500) >> Darrell Budic mailto:bu...@onholyground.com>> >> is rumored to have said: >> On Apr 10, 2024, at 2:52 

Re: Dynamic blacklist ?

2024-04-12 Thread Bill Cole
On 2024-04-12 at 02:14:59 UTC-0400 (Fri, 12 Apr 2024 08:14:59 +0200) Pierluigi Frullani is rumored to have said: Hello all, do you know if there is a way to have a blacklist, either for user or eventually for an entire server, that could be feeded via some scripts ? If you enable the AWL

Re: WARNING: Microsoft has earned removal from SA default welcomelist

2024-04-12 Thread Jared Hall via users
On 4/12/2024 1:20 PM, Bill Cole wrote: In my opinion, this is an indication that the default welcomelist entries in the official SpamAssassin rules for '*@*.microsoft.com' are inappropriate. Note that there is an entry for '*@accountprotection.microsoft.com' which is still justified as far

Defining what the default welcomelist means

2024-04-12 Thread Bill Cole
The de-welcomelisting of MS marketing raises the question: Why do we maintain a "default" welcomelist? Based on the documentation, the original purpose of the def_welcomelist* (then whitelist) feature set was to give a set of senders of purely legitimate mail from FPs, with a listing having

WARNING: Microsoft has earned removal from SA default welcomelist

2024-04-12 Thread Bill Cole
Yesterday I received marketing spam from "Microsoft " advertising something apparently called "Microsoft Build" which is either a website or a marketing event: IDGAF. Spam was sent via Marketo, which I gather is now part of the sewer we call Adobe. It was absolutely authentic. Fully authentic

Re: another problem in disable in spamassassin

2024-04-12 Thread Matus UHLAR - fantomas
On 12.04.24 10:50, natan wrote: I have problem with disabled spamhaus.org in spamassassin: In local.cf I disable check like: ... dns_query_restriction deny spamhaus.org dns_query_restriction deny zen.spamhaus.org dns_query_restriction deny dbl.spamhaus.org But in mail.log I fund still

another problem in disable in spamassassin

2024-04-12 Thread natan
Hi I have problem with disabled spamhaus.org in spamassassin: In local.cf I disable check like: ... dns_query_restriction deny spamhaus.org dns_query_restriction deny zen.spamhaus.org dns_query_restriction deny dbl.spamhaus.org ... But in mail.log I fund still checking RCVD_IN_PBL, URIBL_CSS_A,

RE: Dynamic blacklist ?

2024-04-12 Thread Marc
> do you know if there is a way to have a blacklist, either for user or > eventually for an entire server, that could be feeded via some scripts ? Yes create your own dns blacklist > A sort of auto_learn but only for addresses ( to or from ) ? No such thing as only for... You have to

Dynamic blacklist ?

2024-04-12 Thread Pierluigi Frullani
Hello all, do you know if there is a way to have a blacklist, either for user or eventually for an entire server, that could be feeded via some scripts ? A sort of auto_learn but only for addresses ( to or from ) ? I'll trying to explain: I maintain a couple of mail servers that have a very very

Re: problems with Plugin::ASN and spam

2024-04-11 Thread Darrell Budic
On Apr 11, 2024, at 3:30 PM, Bill Cole wrote: > > On 2024-04-10 at 21:19:48 UTC-0400 (Wed, 10 Apr 2024 20:19:48 -0500) > Darrell Budic mailto:bu...@onholyground.com>> > is rumored to have said: > >>> On Apr 10, 2024, at 2:52 PM, Benny Pedersen wrote: >>> >>> Darrell Budic skrev den

Re: problems with Plugin::ASN and spam

2024-04-11 Thread Bill Cole
On 2024-04-10 at 21:19:48 UTC-0400 (Wed, 10 Apr 2024 20:19:48 -0500) Darrell Budic is rumored to have said: >> On Apr 10, 2024, at 2:52 PM, Benny Pedersen wrote: >> >> Darrell Budic skrev den 2024-04-10 19:48: >> >>> Anything I’m missing? >> >> using amavisd ? >> >> then try this in

Captured tags

2024-04-10 Thread Jimmy
Hi, I'm aiming to extract the domain part from the To: address field, specifically targeting email addresses like i...@domain.com to capture just domain.com. However, the current rule consistently captures the string starting with @, such as @domain.com. header __TO_DOMAIN

Re: dcc on empty email

2024-04-10 Thread Henrik K via users
Perhaps just check your old notes? :-P https://lists.apache.org/thread/6fspd1my9xjdjbz16zp7dk66vn44xccz On Wed, Apr 10, 2024 at 10:42:35PM -0400, Alex wrote: > Hi, > > I'm noticing DCC is triggering on emails with an empty body. I'd like to > create a hash that matches messages with

Re: dcc on empty email

2024-04-10 Thread Alex
Hi, > I'm noticing DCC is triggering on emails with an empty body. I'd like to > create a hash that matches messages with an empty body and other simple > messages. > > What am I doing wrong? I've tried it with a zero-length file as well as > one with just a few characters. It looks like I don't

Re: problems with Plugin::ASN and spam

2024-04-10 Thread Darrell Budic
> On Apr 10, 2024, at 2:52 PM, Benny Pedersen wrote: > > Darrell Budic skrev den 2024-04-10 19:48: > >> Anything I’m missing? > > using amavisd ? > > then try this in amavisd.conf: > > > @spam_scanners = ( ># ['SpamAssassin', 'Amavis::SpamControl::SpamAssassin'], >['SpamdClient',

dcc on empty email

2024-04-10 Thread Alex
Hi, I'm noticing DCC is triggering on emails with an empty body. I'd like to create a hash that matches messages with an empty body and other simple messages. What am I doing wrong? I've tried it with a zero-length file as well as one with just a few characters. It looks like I don't understand

Re: problems with Plugin::ASN and spam

2024-04-10 Thread Benny Pedersen
Darrell Budic skrev den 2024-04-10 19:48: Anything I’m missing? using amavisd ? then try this in amavisd.conf: @spam_scanners = ( # ['SpamAssassin', 'Amavis::SpamControl::SpamAssassin'], ['SpamdClient', 'Amavis::SpamControl::SpamdClient'] ); 1; # insure a defined return value if

Re: problems with Plugin::ASN and spam

2024-04-10 Thread Darrell Budic
> On Apr 10, 2024, at 1:30 PM, Bill Cole > wrote: > > On 2024-04-10 at 13:48:47 UTC-0400 (Wed, 10 Apr 2024 12:48:47 -0500) > Darrell Budic mailto:bu...@onholyground.com>> > is rumored to have said: > >> Just checking in here that I’m not doing something wrong with the ASN plugin >> before I

Re: problems with Plugin::ASN and spam

2024-04-10 Thread Bill Cole
On 2024-04-10 at 13:48:47 UTC-0400 (Wed, 10 Apr 2024 12:48:47 -0500) Darrell Budic is rumored to have said: > Just checking in here that I’m not doing something wrong with the ASN plugin > before I file a bug on this. SpamAssassin 4.0.1 installed from cpan on Alma 9. > > I’ve got it configured

problems with Plugin::ASN and spam

2024-04-10 Thread Darrell Budic
Just checking in here that I’m not doing something wrong with the ASN plugin before I file a bug on this. SpamAssassin 4.0.1 installed from cpan on Alma 9. I’ve got it configured to use the local maxmind db files, and those show up in logs. Testing in spamassassin itself show that it finds the

Re: Multiple test failures

2024-04-09 Thread Scott Ellentuch
Hi, Yes, as ec2-user running the make and then make test ends up failing. There are no issues with the port as a previous tcpdump has shown, it transfers data back and forth. It gets through some of the tests and then it sends a RST. Amazon only goes as far as spamassassin-3.4.3 in Amazon Linux 2

Re: Multiple test failures

2024-04-09 Thread Sidney Markowitz
Scott Ellentuch wrote on 10/04/24 5:15 am: Apologies, but I don't understand. I am running "make test" as the AWS user "ec2-user" when getting these errors. Are you saying that its an acceptable error right now, and I can just do the "sudo make install"? If you ran "make test" as user

Re: Multiple test failures

2024-04-09 Thread Scott Ellentuch
Apologies, but I don't understand. I am running "make test" as the AWS user "ec2-user" when getting these errors. Are you saying that its an acceptable error right now, and I can just do the "sudo make install"? Thanks, Tuc On Fri, Apr 5, 2024 at 9:58 PM Sidney Markowitz wrote: > Scott

Re: OT: Trigger words in email addresses?

2024-04-09 Thread Bill Cole
On 2024-04-07 at 21:40:40 UTC-0400 (Sun, 7 Apr 2024 20:40:40 -0500) Jerry Malcolm is rumored to have said: But I have a co-worker that is convinced that "donotre...@xyz.com" is a trigger for gmail's spam filters and all spam filters will score the email higher as spam due simply to that word

https://metacpan.org/pod/Mail::SpamAssassin::Plugin::FromNameSpoof

2024-04-09 Thread Benny Pedersen
no rules set in default sa-update its unclear from perldoc Mail::SpamAssassin::Plugin::FromNameSpoof how to make a local config to use it could it be added one example config ? i like to catch when ReplyTo is same as From:addr users should stop add ReplyTo when not needed

Re: OT: Trigger words in email addresses?

2024-04-08 Thread Noel Butler
On 08/04/2024 11:40, Jerry Malcolm wrote: Now here's my question (at least one of them)... I send the validation email from DoNotReply So... recommendations, please... should I change donotre...@.com to something else, and if so, what is Typically, noreply@... is used Have you tried

Re: OT: Trigger words in email addresses?

2024-04-08 Thread Thomas Cameron
GMail just... sucks. I have an email server in EC2 that also passes all tests, but they insist on dumping our emails into users' spam folders. Good luck trying to get anyone at GMail to actually do their jobs and change whatever is causing them to mark your emails as spam. In my case, they are

Re: OT: Trigger words in email addresses?

2024-04-08 Thread Grant Taylor via users
On 4/8/24 5:44 AM, Antony Stone wrote: - make your systems transparent so that people feel they understand what's happening and when at different stages in the process - don't create a "corporate black box" which customers can't understand I'll add to this and say that URLs that include

Re: Weird whitelist

2024-04-08 Thread natan
Hi Jimmy in SA like: There might be some Spam/Phishing emails with null sender so spamassassin will help you block it if you configured them correctly.. header    SPAM_FROM_NO_DOMAIN    Return-Path =~ /<>/ describe  SPAM_FROM_NO_DOMAIN    spamik score SPAM_FROM_NO_DOMAIN             

Re: Weird whitelist

2024-04-08 Thread natan
Hi Problem solved: user in wbl sql add in amavis_recipients his domain W dniu 8.04.2024 o 12:50, Jimmy pisze: According to RFC 2298, the envelope sender address (SMTP MAIL FROM) of the Message Disposition Notification (MDN) must be null (<>). This specification indicates that no Delivery

Re: Weird whitelist

2024-04-08 Thread Jimmy
According to RFC 2298, the envelope sender address (SMTP MAIL FROM) of the Message Disposition Notification (MDN) must be null (<>). This specification indicates that no Delivery Status Notification (DSN) messages or other notifications about successful or unsuccessful delivery should be sent in

Re: OT: Trigger words in email addresses?

2024-04-08 Thread Antony Stone
On Monday 08 April 2024 at 05:15:58, Grant Taylor via users wrote: > Below is my opinion, it's worth everything you paid for it. But I do > suggest you read it and think about it for a few minutes. For what it's worth, I thoroughly agree with these opinions. - don't alienate people by sending

Re: Weird whitelist

2024-04-08 Thread natan
W dniu 8.04.2024 o 12:38, Benny Pedersen pisze: natan skrev den 2024-04-08 12:31: Apr  6 01:15:09 amavis3 amavis[3887068]: (3887068-17) Passed BAD-HEADER-7 {RelayedInbound}, [34.23.17.0]:38582 [34.23.17.0] <> -> , Queue-ID: 4VBDq04Bn7z1Q9qQ, mail_id: 6LRhEwtUmP7u, Hits: -, size: 10888,

Re: Weird whitelist

2024-04-08 Thread Benny Pedersen
natan skrev den 2024-04-08 12:31: Apr 6 01:15:09 amavis3 amavis[3887068]: (3887068-17) Passed BAD-HEADER-7 {RelayedInbound}, [34.23.17.0]:38582 [34.23.17.0] <> -> , Queue-ID: 4VBDq04Bn7z1Q9qQ, mail_id: 6LRhEwtUmP7u, Hits: -, size: 10888, queued_as: 4VBDq06n69z1Q9q1, 358 ms I check and I not

Re: Weird whitelist

2024-04-08 Thread natan
W dniu 8.04.2024 o 12:26, Matus UHLAR - fantomas pisze: On 08.04.24 12:09, natan wrote: I use amavis+SA and In log I get "whitlisted" ... Apr  6 01:15:08 amavis3 amavis[3887068]: (3887068-17) wbl: whitelisted sender <>, ... Log: Apr  6 01:15:08 amavis3 amavis[3887068]: (3887068-17)

Re: Weird whitelist

2024-04-08 Thread Matus UHLAR - fantomas
On 08.04.24 12:09, natan wrote: I use amavis+SA and In log I get "whitlisted" ... Apr  6 01:15:08 amavis3 amavis[3887068]: (3887068-17) wbl: whitelisted sender <>, ... Log: Apr  6 01:15:08 amavis3 amavis[3887068]: (3887068-17) Checking: 6LRhEwtUmP7u [34.23.17.0] <> -> Apr  6 01:15:08

Weird whitelist

2024-04-08 Thread natan
Hi I use amavis+SA and In log I get "whitlisted" ... Apr  6 01:15:08 amavis3 amavis[3887068]: (3887068-17) wbl: whitelisted sender <>, ... Log: Apr  6 01:15:08 amavis3 amavis[3887068]: (3887068-17) Checking: 6LRhEwtUmP7u [34.23.17.0] <> -> Apr  6 01:15:08 amavis3 amavis[3887068]:

Re: OT: Trigger words in email addresses?

2024-04-07 Thread Grant Taylor via users
Below is my opinion, it's worth everything you paid for it. But I do suggest you read it and think about it for a few minutes. On 4/7/24 20:40, Jerry Malcolm wrote: I send the validation email from donotre...@xyz.com. I absolutely hate the do not reply type email addresses as you're trying

Re: OT: Trigger words in email addresses?

2024-04-07 Thread Matija Nalis
On Sun, Apr 07, 2024 at 08:40:40PM -0500, Jerry Malcolm wrote: > The problem is that gmail, in particular continues to insist on > putting these in spam folders and (theoretically) discarding some > of them completely.  Some of users swear they never get them and And did you check that claim?

OT: Trigger words in email addresses?

2024-04-07 Thread Jerry Malcolm
Slightly off-topic from SpamAssassin specifically.  But I have a question about certain email addresses triggering spam filter scores.  I know anybody can create any rule they want to.  I just want to understand best practices and recommendations. I work for a medium size but growing company

Re: Multiple test failures

2024-04-05 Thread Sidney Markowitz
Scott Ellentuch wrote on 4/04/24 9:43 am: File attached. However, I don't see any smoking gun. I've verified the problem. I ran sudo make test in a directory tree in /tmp with world r-x access, and got the error in t/spamd_client.t as well as in t/spamc_optL.t. I don't know why you didn't

Upcoming KAM.cf Ruleset 20th Anniversary

2024-04-05 Thread Giovanni Bechis
Hi, very soon we will celebrate KAM.cf Ruleset 20th Anniversary, are there any stories about how you use the ruleset, any products that include the rules you are aware of, or other info about how it has helped with spam and email security ? Glad to receive any info or story about KAM.cf

Spamassassin 4.0.x Corpus - 25-dmarc.cf

2024-04-04 Thread Armin Tüting
Hello, 25-dmarc.cf from corpus reads ># Requires the Mail::SpamAssassin::Plugin::DMARC plugin be loaded. > ># Backwards compatible name (was renamed to DMARC in trunk before 4.0.0) >ifplugin Mail::SpamAssassin::Plugin::Dmarc The above statement evaluates to false which won't load the header

Re: Syslog local3

2024-04-04 Thread Emmanuel Seyman
* Bill Cole [03/04/2024 10:54] : > > If you are using something else to > call Spamassassin, e.g. Amavis, MIMEDefang, etc., that other software > controls the logging. Ah, that must be it. I'm using spamass-milter to allow postfix to call spamassassin

Re: Multiple test failures

2024-04-04 Thread Sidney Markowitz
Loren Wilton wrote on 4/04/24 9:26 pm: Would it be worth adding some sort of test for this kind of thing I started to look at where in SATest.pm it ought to go, and I found https://bz.apache.org/SpamAssassin/show_bug.cgi?id=5529 I think from the comments I left there 17 years ago that is is

Re: Multiple test failures

2024-04-04 Thread Loren Wilton
I haven't had a chance yet to read this thread carefully, but spamd when run as root in tests will, at least in some cases, set itself to run as user "nobody". If you do that in a subdirectory of your non-nobody user's HOME, the usual permission configuration will not provide read access to

Re: Multiple test failures

2024-04-03 Thread Sidney Markowitz
I haven't had a chance yet to read this thread carefully, but spamd when run as root in tests will, at least in some cases, set itself to run as user "nobody". If you do that in a subdirectory of your non-nobody user's HOME, the usual permission configuration will not provide read access to

Re: Multiple test failures

2024-04-03 Thread Scott Ellentuch
File attached. However, I don't see any smoking gun. Nothing in t/log [ec2-user@ip-172-31-131-251 Mail-SpamAssassin-4.0.1]$ ls -lR t/log t/log: total 0 Nothing big in iptables [ec2-user@ip-172-31-131-251 Mail-SpamAssassin-4.0.1]$ sudo iptables -L Chain INPUT (policy ACCEPT) target prot opt

Re: Multiple test failures

2024-04-03 Thread Bill Cole
On 2024-04-03 at 14:01:44 UTC-0400 (Wed, 3 Apr 2024 14:01:44 -0400) Scott Ellentuch is rumored to have said: Hi, Ok, deleted the directory and started again. Test Summary Report --- t/spamd_client.t(Wstat: 26624 Tests: 4 Failed: 0) Non-zero exit status: 104

Re: Multiple test failures

2024-04-03 Thread Scott Ellentuch
Hi, Ok, deleted the directory and started again. Test Summary Report --- t/spamd_client.t(Wstat: 26624 Tests: 4 Failed: 0) Non-zero exit status: 104 Parse errors: Bad plan. You planned 52 tests but ran 4. Files=217, Tests=3765, 890 wallclock secs ( 1.21 usr

Re: Syslog local3

2024-04-03 Thread Bill Cole
On 2024-04-03 at 05:49:20 UTC-0400 (Wed, 3 Apr 2024 11:49:20 +0200) Emmanuel Seyman is rumored to have said: Hello, all. It's taken me nearly a year to realize this but spamassassin sends to syslog with the local3 facility, not 'mail' as I had assumed. The spamd daemon logs as mail as

Re: Multiple test failures

2024-04-03 Thread Bill Cole
On 2024-04-02 at 18:18:09 UTC-0400 (Tue, 2 Apr 2024 18:18:09 -0400) Scott Ellentuch is rumored to have said: Hi, Trying to install SA 4.0.1 from scratch. Tried via CPAN, that didn't go well, so trying from tarball. (Enabled SSL when doing Makefile.PL) NEVER run 'make' as root except when

Re: disable URIBL_ and spamhaus.net

2024-04-03 Thread natan
W dniu 3.04.2024 o 15:25, Matus UHLAR - fantomas pisze: On 03.04.24 11:18, natan wrote: Where in  pdns-recursor? I use pdns-recursor /etc/powerdns/recursor.conf W dniu 3.04.2024 o 13:17, Matus UHLAR - fantomas pisze: This is not about pdns-recursor itself. It's about using own recursing

Participate in the ASF 25th Anniversary Campaign

2024-04-03 Thread Brian Proffitt
Hi everyone, As part of The ASF’s 25th anniversary campaign[1], we will be celebrating projects and communities in multiple ways. We invite all projects and contributors to participate in the following ways: * Individuals - submit your first contribution:

Re: disable URIBL_ and spamhaus.net

2024-04-03 Thread Matus UHLAR - fantomas
On 03.04.24 11:18, natan wrote: Where in  pdns-recursor? I use pdns-recursor /etc/powerdns/recursor.conf W dniu 3.04.2024 o 13:17, Matus UHLAR - fantomas pisze: This is not about pdns-recursor itself. It's about using own recursing DNS server - you you don't use DNS server of your ISP,

Re: disable URIBL_ and spamhaus.net

2024-04-03 Thread natan
W dniu 3.04.2024 o 13:17, Matus UHLAR - fantomas pisze: On 03.04.24 11:18, natan wrote: Where in  pdns-recursor? I use pdns-recursor /etc/powerdns/recursor.conf This is not about pdns-recursor itself. It's about using own recursing DNS server - you you don't use DNS server of your ISP,

  1   2   3   4   5   6   7   8   9   10   >