Re: New Install - Tons of Spam Getting Through

2016-08-19 Thread RW
On Thu, 18 Aug 2016 20:59:29 -0500 Jerry Malcolm wrote: > understood why I can't get a report headers at all. I could modify > james to get the modified msg returned with the headers and replace > the original msg with the updated msg. But I don't see that as > necessary. In other words, this

Re: New Install - Tons of Spam Getting Through

2016-08-19 Thread Groach
On 19/08/2016 11:58, Axb wrote: Question: Does it also support adding 3rd party (native Perl) plugins? or are you tied to the precomplied collection delivered by JAM? Jams product runs with Perl - so any perl plugins provided for Spamassassin should work on the windows versions too. FYI:

Re: New Install - Tons of Spam Getting Through

2016-08-19 Thread Axb
Question: Does it also support adding 3rd party (native Perl) plugins? or are you tied to the precomplied collection delivered by JAM? As to the list's hostility, imo, most of the beginner's questions could be answered by reading the docs or using a search machine. Instead, many new users

Re: New Install - Tons of Spam Getting Through

2016-08-19 Thread Groach
FYI I and many others use Jam's windows port of Spamassassin. It is exactly the same as the linux version in what it can and cant do. Users can modify with plugins, rules, scoring overrides etc just the same as you do on linux. Spamd, spamc, spamassassin... all the same. The only thing

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Jerry Malcolm
On 8/18/2016 8:34 PM, jdow wrote: On 2016-08-18 17:11, RW wrote: On Thu, 18 Aug 2016 18:14:47 -0500 Jerry Malcolm wrote: I'm still trying to see why I'm not getting the report back. I've gone all the way back to the source code that does the streaming of the spamd invocation on port 783.

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread jdow
On 2016-08-18 17:11, RW wrote: On Thu, 18 Aug 2016 18:14:47 -0500 Jerry Malcolm wrote: I'm still trying to see why I'm not getting the report back. I've gone all the way back to the source code that does the streaming of the spamd invocation on port 783. I can't seem to find the

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread RW
On Thu, 18 Aug 2016 18:14:47 -0500 Jerry Malcolm wrote: > I'm still trying to see why I'm not getting the report back. I've > gone all the way back to the source code that does the streaming of > the spamd invocation on port 783. I can't seem to find the > documentation anywhere on the format

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Jerry Malcolm
On 8/18/2016 2:15 PM, Bowie Bailey wrote: On 8/18/2016 3:05 PM, Jerry Malcolm wrote: On 8/18/2016 1:45 PM, Bowie Bailey wrote: On 8/18/2016 2:21 PM, li...@rhsoft.net wrote: Am 18.08.2016 um 20:18 schrieb Jerry Malcolm: This is the X-Spam-Status header I got back on an uncaught spam. No,

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Jerry Malcolm
On 8/18/2016 5:39 PM, Benny Pedersen wrote: On 2016-08-18 21:08, Jerry Malcolm wrote: Hmm. I do not have any forwarding statements. Is there a way via command line (e.g. nslookup, etc) that I can determine if BIND is recursing or forwarding? I assume that might be in the SA report header.

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Benny Pedersen
On 2016-08-18 21:08, Jerry Malcolm wrote: Hmm. I do not have any forwarding statements. Is there a way via command line (e.g. nslookup, etc) that I can determine if BIND is recursing or forwarding? I assume that might be in the SA report header. But see my previous response that I can't

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Benny Pedersen
On 2016-08-18 20:48, Jerry Malcolm wrote: |allow-recursion { any; }; |But it lists other options such as allow-query, allow-query-cache, etc. Is recursion the only one that might be affecting SA? Or should I enable other options? this is safe if you only listen to 127.0.0.1 if you use it

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Benny Pedersen
On 2016-08-18 20:36, Jerry Malcolm wrote: ok, I discovered the hidden ctrl-u fn in Tbird to show the full source. Updated pastebin: http://pastebin.com/eRurR7Mv DBL_SPAM: 6.50 URIBL_SBL_CSS: 6.50 URIBL_BLACK: 7.50 ABUSE_SURBL: 5.50 FUZZY_DENIED: 8.54 ONCE_RECEIVED: 0.10 DCC_BULK: 2.00

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Bill Cole
On 18 Aug 2016, at 15:08, Jerry Malcolm wrote: On 8/18/2016 1:50 PM, li...@rhsoft.net wrote: Am 18.08.2016 um 20:48 schrieb Jerry Malcolm: This is encouraging. I looked up how to set recursion in Bind. It looks like it's just requires adding a field to the options: |allow-recursion { any;

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Bowie Bailey
On 8/18/2016 3:05 PM, Jerry Malcolm wrote: On 8/18/2016 1:45 PM, Bowie Bailey wrote: On 8/18/2016 2:21 PM, li...@rhsoft.net wrote: Am 18.08.2016 um 20:18 schrieb Jerry Malcolm: This is the X-Spam-Status header I got back on an uncaught spam. No, hits=0.3 required=5.0. The spam was selling

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Axb
On 08/18/2016 08:48 PM, Jerry Malcolm wrote: On 8/18/2016 1:35 PM, Joe Quinn wrote: On 8/18/2016 2:27 PM, Jerry Malcolm wrote: I haven't figured out a way to get Thunderbird to allow me to copy/paste the headers. But I did look at all of the headers. There are no headers in the email with

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread li...@rhsoft.net
Am 18.08.2016 um 21:08 schrieb Jerry Malcolm: On 8/18/2016 1:50 PM, li...@rhsoft.net wrote: Am 18.08.2016 um 20:48 schrieb Jerry Malcolm: This is encouraging. I looked up how to set recursion in Bind. It looks like it's just requires adding a field to the options: |allow-recursion { any;

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread John Hardin
On Thu, 18 Aug 2016, Jerry Malcolm wrote: On 8/18/2016 12:16 PM, John Hardin wrote: There are also potential DNS issues that may contribute. In addition to describing your environment, perhaps you could post the X-Spam-Status header from a couple of the low-scoring spams. John, This is

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread li...@rhsoft.net
Am 18.08.2016 um 21:05 schrieb Jerry Malcolm: I see the local.cf file, it is already configured with 'all report'. But I looked at a msg that was flagged a spam. It doesn't have a report header either. I guess it's possible that the JAMES invoker mailet is stripping the headers. But I don't

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Jerry Malcolm
On 8/18/2016 1:50 PM, li...@rhsoft.net wrote: Am 18.08.2016 um 20:48 schrieb Jerry Malcolm: This is encouraging. I looked up how to set recursion in Bind. It looks like it's just requires adding a field to the options: |allow-recursion { any; }; |But it lists other options such as

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Jerry Malcolm
On 8/18/2016 1:45 PM, Bowie Bailey wrote: On 8/18/2016 2:21 PM, li...@rhsoft.net wrote: Am 18.08.2016 um 20:18 schrieb Jerry Malcolm: This is the X-Spam-Status header I got back on an uncaught spam. No, hits=0.3 required=5.0. The spam was selling an all-in-one charger we need the *report*

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread li...@rhsoft.net
Am 18.08.2016 um 20:48 schrieb Jerry Malcolm: This is encouraging. I looked up how to set recursion in Bind. It looks like it's just requires adding a field to the options: |allow-recursion { any; }; |But it lists other options such as allow-query, allow-query-cache, etc. Is recursion the

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Jerry Malcolm
On 8/18/2016 1:35 PM, Joe Quinn wrote: On 8/18/2016 2:27 PM, Jerry Malcolm wrote: I haven't figured out a way to get Thunderbird to allow me to copy/paste the headers. But I did look at all of the headers. There are no headers in the email with names like you mentioned. There is only the

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Bowie Bailey
On 8/18/2016 2:21 PM, li...@rhsoft.net wrote: Am 18.08.2016 um 20:18 schrieb Jerry Malcolm: This is the X-Spam-Status header I got back on an uncaught spam. No, hits=0.3 required=5.0. The spam was selling an all-in-one charger we need the *report* header By default, the report header is

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread li...@rhsoft.net
Am 18.08.2016 um 20:27 schrieb Jerry Malcolm: On 8/18/2016 1:17 PM, li...@rhsoft.net wrote: Am 18.08.2016 um 20:10 schrieb Jerry Malcolm: Here is a pastebin.com link to an example uncaught spam message. SA scored it a 4.7. http://pastebin.com/T1CfVgP4 useless without any headers which

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread John Hardin
On Thu, 18 Aug 2016, Jerry Malcolm wrote: Thanks for the quick response. I'll try to reply with what I know. But I purchased a package "SpamAssassin In A Box" from JAM Software. I hate to say this, but - perhaps you should be asking JAM *first*... Here is a pastebin.com link to an example

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Jerry Malcolm
On 8/18/2016 1:23 PM, Benny Pedersen wrote: On 2016-08-18 20:10, Jerry Malcolm wrote: Here is a pastebin.com link to an example uncaught spam message. SA scored it a 4.7. http://pastebin.com/T1CfVgP4 MISSING_DATE: 1.00 DCC_BULK: 2.00 MISSING_TO: 2.00 MISSING_MID: 2.50 MISSING_SUBJECT: 2.00

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Joe Quinn
On 8/18/2016 2:27 PM, Jerry Malcolm wrote: I haven't figured out a way to get Thunderbird to allow me to copy/paste the headers. But I did look at all of the headers. There are no headers in the email with names like you mentioned. There is only the X-Spam-Status header and X-Spam-Flag header

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Jerry Malcolm
On 8/18/2016 1:17 PM, li...@rhsoft.net wrote: Am 18.08.2016 um 20:10 schrieb Jerry Malcolm: Here is a pastebin.com link to an example uncaught spam message. SA scored it a 4.7. http://pastebin.com/T1CfVgP4 useless without any headers which would show the matching rules including major

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Benny Pedersen
On 2016-08-18 20:10, Jerry Malcolm wrote: Here is a pastebin.com link to an example uncaught spam message. SA scored it a 4.7. http://pastebin.com/T1CfVgP4 MISSING_DATE: 1.00 DCC_BULK: 2.00 MISSING_TO: 2.00 MISSING_MID: 2.50 MISSING_SUBJECT: 2.00 was what it scored as in pastebin, rspamd

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread li...@rhsoft.net
Am 18.08.2016 um 20:18 schrieb Jerry Malcolm: This is the X-Spam-Status header I got back on an uncaught spam. No, hits=0.3 required=5.0. The spam was selling an all-in-one charger we need the *report* header What kind of DNS issues? I lease a server from Peer1 and use their name

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Rick Macdougall
On 2016-08-18 2:10 PM, Jerry Malcolm wrote: Thanks for the quick response. I'll try to reply with what I know. But I purchased a package "SpamAssassin In A Box" from JAM Software. I ran the installer, and that's it. I'm sorry that I don't know more. But I don't know much about the inner

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Jerry Malcolm
On 8/18/2016 12:16 PM, John Hardin wrote: On Thu, 18 Aug 2016, Jerry Malcolm wrote: I installed the latest SpamAssassin In a Box yesterday (Win Server 2008 r2). I kept all of the defaults. It is up and running. But I'm getting a huge amount of spam, and I mean 'obvious' spam mentioning

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread li...@rhsoft.net
Am 18.08.2016 um 20:10 schrieb Jerry Malcolm: Here is a pastebin.com link to an example uncaught spam message. SA scored it a 4.7. http://pastebin.com/T1CfVgP4 useless without any headers which would show the matching rules including major mistakes like URIBL_BLOCKED but even passing that

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Jerry Malcolm
Thanks for the quick response. I'll try to reply with what I know. But I purchased a package "SpamAssassin In A Box" from JAM Software. I ran the installer, and that's it. I'm sorry that I don't know more. But I don't know much about the inner workings. I was just hoping it would work. I

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread John Hardin
On Thu, 18 Aug 2016, Jerry Malcolm wrote: I installed the latest SpamAssassin In a Box yesterday (Win Server 2008 r2). I kept all of the defaults. It is up and running. But I'm getting a huge amount of spam, and I mean 'obvious' spam mentioning body parts in the subject line that are

Re: New Install - Tons of Spam Getting Through

2016-08-18 Thread Axb
On 08/18/2016 06:47 PM, Jerry Malcolm wrote: I installed the latest SpamAssassin In a Box yesterday (Win Server 2008 r2). I kept all of the defaults. It is up and running. But I'm getting a huge amount of spam, and I mean 'obvious' spam mentioning body parts in the subject line that are

New Install - Tons of Spam Getting Through

2016-08-18 Thread Jerry Malcolm
I installed the latest SpamAssassin In a Box yesterday (Win Server 2008 r2). I kept all of the defaults. It is up and running. But I'm getting a huge amount of spam, and I mean 'obvious' spam mentioning body parts in the subject line that are getting low scores (averaging about 15