Re: NO_RELAYS spam

2010-07-01 Thread Randy Ramsdell
Karsten Bräckelmann wrote: On Fri, 2010-06-18 at 23:54 +0200, Karsten Bräckelmann wrote: Your issue is kind of weird and far less than common. Read, I cannot recall coming across such a report *ever* on this list. Thus, the collective list's lack of pin-pointing the cause with the info

Re: NO_RELAYS spam

2010-06-25 Thread Karsten Bräckelmann
On Fri, 2010-06-18 at 23:54 +0200, Karsten Bräckelmann wrote: Your issue is kind of weird and far less than common. Read, I cannot recall coming across such a report *ever* on this list. Thus, the collective list's lack of pin-pointing the cause with the info given. The very reason we need

Re: NO_RELAYS spam

2010-06-21 Thread Matus UHLAR - fantomas
On Thu, 17 Jun 2010, Randy Ramsdell wrote: The original email did not hit the NO_RELAYS rule but subsequent runs through do hit this rule and it isn't on all email. On 17.06.10 12:13, Randy Ramsdell wrote: Hmmm, this mail came in and went straight to the users inbox. 1. Postfix --- 2.

Re: NO_RELAYS spam

2010-06-21 Thread Noel Jones
On Thu, Jun 17, 2010 at 11:13 AM, Randy Ramsdell rramsd...@activedg.com wrote: Charles Gregory wrote: On Thu, 17 Jun 2010, Randy Ramsdell wrote: The original email did not hit the NO_RELAYS rule but subsequent runs through do hit this rule and it isn't on all email. This sounds to me like

Re: NO_RELAYS spam

2010-06-20 Thread David Morton
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 6/17/10 11:13 AM, Randy Ramsdell wrote: Postfix --- 2. Amavis ( Spamd/Clamd) --- 3. Postfix --- 4. Dovecot-deliver No, I run a script on the mail server manually that simply moves the files. Then I check with spamassassin. I wonder about

Re: NO_RELAYS spam

2010-06-20 Thread Martin Gregorie
On Sun, 2010-06-20 at 08:22 -0500, David Morton wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 6/17/10 11:13 AM, Randy Ramsdell wrote: Postfix --- 2. Amavis ( Spamd/Clamd) --- 3. Postfix --- 4. Dovecot-deliver No, I run a script on the mail server manually that simply

Re: NO_RELAYS spam

2010-06-19 Thread Joseph Brennan
Randy Ramsdell rramsd...@activedg.com wrote: Using sendmail without certain areguments will cause the To: field to show up as undisclosed recipients:. Nothing would make sendmail write a bogus header like that one. That is not a valid email address. This is valid: To: undisclosed

Re: NO_RELAYS spam

2010-06-18 Thread Matus UHLAR - fantomas
On Thu, 17 Jun 2010, Randy Ramsdell wrote: The original email did not hit the NO_RELAYS rule but subsequent runs through do hit this rule and it isn't on all email. Charles Gregory wrote: This sounds to me like you are 'resending' the mail from a local address to your mail server, rather

Re: NO_RELAYS spam

2010-06-18 Thread Randy Ramsdell
Michelle Konzack wrote: Hello Randy Ramsdell, Am 2010-06-17 10:38:08, hacktest Du folgendes herunter: We are getting a ton of this type and it scores low because there are no received headers. What is this type of mail? I do not recall seeing these in the past. Hehehe... sounds like

Re: NO_RELAYS spam

2010-06-18 Thread Randy Ramsdell
David B Funk wrote: On Thu, 17 Jun 2010, Randy Ramsdell wrote: get us added to lists, but Michael stated then, check the blacklists to see how to get removed. as if we are already on a list. We are not. Back to the main issue. Here is an example pastbin. http://pastebin.com/mJqRPzkv I

Re: NO_RELAYS spam

2010-06-18 Thread Randy Ramsdell
Matus UHLAR - fantomas wrote: On Thu, 17 Jun 2010, Randy Ramsdell wrote: The original email did not hit the NO_RELAYS rule but subsequent runs through do hit this rule and it isn't on all email. Charles Gregory wrote: This sounds to me like you are 'resending' the

Re: [sa] Re: NO_RELAYS spam

2010-06-18 Thread Charles Gregory
On Fri, 18 Jun 2010, Randy Ramsdell wrote: I have no problem going over there but I am not convinced that the Amavis program is the problem. The header field is changed by spamassassin. Doesn't the email simply get handed to Spamassasin by Amavis where the headers are modified by spam report

Re: [sa] Re: NO_RELAYS spam

2010-06-18 Thread Randy Ramsdell
Charles Gregory wrote: On Fri, 18 Jun 2010, Randy Ramsdell wrote: I have no problem going over there but I am not convinced that the Amavis program is the problem. The header field is changed by spamassassin. Doesn't the email simply get handed to Spamassasin by Amavis where the headers are

Re: NO_RELAYS spam

2010-06-18 Thread Karsten Bräckelmann
On Fri, 2010-06-18 at 13:33 -0400, Randy Ramsdell wrote: Charles Gregory wrote: On Fri, 18 Jun 2010, Randy Ramsdell wrote: I have no problem going over there but I am not convinced that the Amavis program is the problem. The header field is changed by spamassassin. Doesn't the email

NO_RELAYS spam

2010-06-17 Thread Randy Ramsdell
We are getting a ton of this type and it scores low because there are no received headers. What is this type of mail? I do not recall seeing these in the past. Thanks, RCR

Re: NO_RELAYS spam

2010-06-17 Thread Michael Scheidell
On 6/17/10 10:38 AM, Randy Ramsdell wrote: We are getting a ton of this type and it scores low because there are no received headers. What is this type of mail? I do not recall seeing these in the past. its coming from you then :-( or, your mail server is stripping out or not adding

Re: NO_RELAYS spam

2010-06-17 Thread Randy Ramsdell
Michael Scheidell wrote: On 6/17/10 10:38 AM, Randy Ramsdell wrote: We are getting a ton of this type and it scores low because there are no received headers. What is this type of mail? I do not recall seeing these in the past. its coming from you then :-( or, your mail server is stripping

Re: NO_RELAYS spam

2010-06-17 Thread Randy Ramsdell
Michael Scheidell wrote: On 6/17/10 10:38 AM, Randy Ramsdell wrote: We are getting a ton of this type and it scores low because there are no received headers. What is this type of mail? I do not recall seeing these in the past. its coming from you then :-( or, your mail server is stripping

Re: NO_RELAYS spam

2010-06-17 Thread Michael Scheidell
On 6/17/10 11:31 AM, Randy Ramsdell wrote: I just checked our spam reports and this rule never hits. It is not locally generated email either or I can not find any coming from us. This is an strange issue and I am not where to begin to determine what is doing this. if you have an insecure

Re: NO_RELAYS spam

2010-06-17 Thread Randy Ramsdell
Michael Scheidell wrote: On 6/17/10 11:31 AM, Randy Ramsdell wrote: I just checked our spam reports and this rule never hits. It is not locally generated email either or I can not find any coming from us. This is an strange issue and I am not where to begin to determine what is doing this.

Re: NO_RELAYS spam

2010-06-17 Thread Charles Gregory
On Thu, 17 Jun 2010, Randy Ramsdell wrote: The original email did not hit the NO_RELAYS rule but subsequent runs through do hit this rule and it isn't on all email. This sounds to me like you are 'resending' the mail from a local address to your mail server, rather than 'feeding' the original

Re: NO_RELAYS spam

2010-06-17 Thread Randy Ramsdell
Charles Gregory wrote: On Thu, 17 Jun 2010, Randy Ramsdell wrote: The original email did not hit the NO_RELAYS rule but subsequent runs through do hit this rule and it isn't on all email. This sounds to me like you are 'resending' the mail from a local address to your mail server, rather

Re: NO_RELAYS spam

2010-06-17 Thread Charles Gregory
On Thu, 17 Jun 2010, Randy Ramsdell wrote: Hmmm, this mail came in and went straight to the users inbox. 1. Postfix --- 2. Amavis ( Spamd/Clamd) --- 3. Postfix --- 4. Dovecot-deliver So the problem is somewhere during the 2 --- 3 or step 3 or 4. Step 4 it is unlikely since Deliver simply

Re: NO_RELAYS spam

2010-06-17 Thread David B Funk
On Thu, 17 Jun 2010, Randy Ramsdell wrote: get us added to lists, but Michael stated then, check the blacklists to see how to get removed. as if we are already on a list. We are not. Back to the main issue. Here is an example pastbin. http://pastebin.com/mJqRPzkv I found this message in

Re: NO_RELAYS spam

2010-06-17 Thread Michelle Konzack
Hello Randy Ramsdell, Am 2010-06-17 10:38:08, hacktest Du folgendes herunter: We are getting a ton of this type and it scores low because there are no received headers. What is this type of mail? I do not recall seeing these in the past. Hehehe... sounds like a new customer of me... His