Re: problems with TVD_SPACE_RATIO

2009-05-27 Thread mouss
Karsten Bräckelmann a écrit : On Tue, 2009-05-26 at 22:12 +0200, mouss wrote: Karsten Bräckelmann a écrit : Bug 6119 has been opened already. Please attach additional samples there, rather than opening a new bug for every sample. Thanks! https://issues.apache.org/SpamAssassin

Re: problems with TVD_SPACE_RATIO

2009-05-27 Thread mouss
Karsten Bräckelmann a écrit : On Wed, 2009-05-27 at 09:21 +0200, Michael Monnerie wrote: On Mittwoch 27 Mai 2009 mouss wrote: and 4454 is a one line message, but the signature causes the hit. The fact that mailing-list footer is forced onto the message with no newline causes

Re: RBL triggered?

2009-05-27 Thread mouss
Charles Gregory a écrit : Hello! Quick question: Does Spamassassin's RCVD tests also check headers labelled X-Originating-IP? yes. In particular, I received the below message from hotmail with hits on RCVD_IN_BL_SPAMCOP_NET and RCVD_IN_SORBS_WEB. Neither of the hotmail IP's is found in

Re: RBL triggered?

2009-05-28 Thread mouss
:) mouss mo...@ml.netoyen.net said: Quick question: Does Spamassassin's RCVD tests also check headers labelled X-Originating-IP? yes. (nod) Certainly makes sense of the unexpected scores. But I am wondering if I have made some wrong presumptions about the behaviour of tests for dynamic IP's

Re: Barracuda Blacklist

2009-05-28 Thread mouss
Neil Schwartzman a écrit : On 28/05/09 9:35 AM, Matt lm7...@gmail.com wrote: Is there a reason the Barracuda blacklist is not in the official checks by Spamassassin yet? I keep thinking sometime sa-update -D will add it but have yet to see it. I would like to add some perspective

Re: Filtering through mailing lists

2009-05-29 Thread mouss
Garik a écrit : I have a situation where by mail passes through a mailing list and then goes on to the destination mailbox that's subscribed in the mailing list. Here's my problem: SpamAssasin checks the emails going through the mailing list for SPAM and adds the subject [**SPAM**] to the

LET'S KILL THIS THREAD (Was: whitelists (was Re: Barracuda Blacklist)

2009-06-02 Thread mouss
ANTICOM-STINGER a écrit : On Fri, 2009-05-29 at 12:16 -0600, J.D. Falk wrote: Rob McEwen wrote: Additionally, I'd like to ask, other than being a superb cash-generating machine, what good is a whitelist built upon pay-to-enter and NOT based on editorial decisions made by non-biased e-mail

Re: New method to bypass SA?

2009-06-03 Thread mouss
fchan a écrit : I recently was checking on servers that were sending out spam and found one of them had the hostname called localhost which I think is a attempt to bypass SA. The IP address is 222.252.188.181 which maps back to Vietnam. SA will not use localhost unless your MTA is borked.

Re: FCrDNS and localhost

2009-06-05 Thread mouss
Adam Katz a écrit : Matus UHLAR - fantomas wrote: 181.188.252.222.in-addr.arpa domain name pointer localhost. That is why FcRDNS is being used everywhere... localhost has address 127.0.0.1 = fail. Actually, localhost doesn't resolve via DNS; I don't know where you're taking this from: $

Re: FCrDNS and localhost

2009-06-05 Thread mouss
Adam Katz a écrit : John Hardin wrote: So that data comes from /etc/hosts. How does that materially affect the FCrDNS sanity test? By definition, FCrDNS uses DNS lookups. Unless you're using dnsmasq, the entries in /etc/hosts are ignored during DNS lookups. This is wrong. FCrDNS lookup

Re: FCrDNS and localhost

2009-06-06 Thread mouss
Matus UHLAR - fantomas a écrit : On 05.06.09 23:55, mouss wrote: localhost.netoyen.net has address 127.0.0.1 oh, I didn't even realize it was the .$domain one! old habit to avoid nslookup barking and then lusers asking what's the problem... Actually, I think this is not good. localhost

List headers and footers [Re: Unsubscribe]

2009-06-14 Thread mouss
David Gibbs a écrit : LuKreme wrote: The unsubscribe link is right there in plain sight. Whether Gmail conceals it from you has nothing to do with it. Few consumer mail clients (Gmail, Yahoo, Thunderbird, OE, Outlook, Lotus/Domino, etc) show the user headers by default. This means they

Re: List headers and footers [Re: Unsubscribe]

2009-06-14 Thread mouss
David Gibbs a écrit : mouss wrote: - this modifies the body, thus breaking signatures. when mail gets back to the same domain (sender and final recipient in same domain), this may cause problems. I agree that many lists do break signatures so the receiving site should cope with this, but I am

Re: some URIBL accidentally listed .org?

2009-06-14 Thread mouss
Yet Another Ninja a écrit : On 6/14/2009 10:48 PM, Justin Mason wrote: http://log.perl.org/2009/06/email-issues-org-blocked-now-fixed.html anyone know what URIBL provider this was? --j. Wouldn't we all have noticed if this would have been the case? not if they use some unknown uri

Re: backscatter from dnswl

2009-06-14 Thread mouss
a...@ibcsolutions.de a écrit : Excerpts from Charles Gregory's message of Thu Jun 11 07:13:02 -0700 2009: How many accounts are we talking about here? If it is just one or two addresses, and the user(s) being 'spoofed' have distinctive *names* on their genuine 'From' headers, then you can

Re: [sa] Re: BOTNET timeouts?

2009-06-15 Thread mouss
Bill Landry a écrit : Res wrote: On Sat, 13 Jun 2009, Charles Gregory wrote: On Sun, 14 Jun 2009, Res wrote: Though now its Sunday, I have socialising to do, and none of that includes sitting on mailing lists listening to cry babies who expect people involved in OSSP's to drop everything

Re: List headers and footers [Re: Unsubscribe]

2009-06-15 Thread mouss
David Gibbs a écrit : Bill Landry wrote: This may be true if the sender were adding the footer before signing and sending the message to the list. However, not true if it's the mailing list that is adding the footer after the original sender has already signed the message. As I understand

Re: List headers and footers [Re: Unsubscribe]

2009-06-15 Thread mouss
RW a écrit : On Sun, 14 Jun 2009 13:20:21 +0200 mouss mo...@ml.netoyen.net wrote: I am not as convinced as you: - this modifies the body, thus breaking signatures. when mail gets back to the same domain (sender and final recipient in same domain), this may cause problems. I agree

Re: [sa] Re: BOTNET timeouts?

2009-06-15 Thread mouss
Bill Landry a écrit : Bill Landry a écrit : Res wrote: On Sat, 13 Jun 2009, Charles Gregory wrote: On Sun, 14 Jun 2009, Res wrote: Though now its Sunday, I have socialising to do, and none of that includes sitting on mailing lists listening to cry babies who expect people involved in

Re: Hostkarma whitelist problem

2009-06-17 Thread mouss
Bowie Bailey a écrit : I couldn't find any place on junkmailfilter website to report this, so I'll put it here. I received a 419 scam email with this whitelist hit: so what? I keep getting 419 from google, yahoo, ... but they are still whitelisted. and anyway, fighting 419 is not easy.

Re: interesting phish for yahoo credentials or stupid spammer

2009-06-21 Thread mouss
Michael Scheidell a écrit : spam, with a url link in it that opens up a yahoo.com web mail page and asks for yahoo.com credentials. don't know how that can help spammer, unless spammer is looking to only get email from yahoo.com users. see line 119 (highighted)

Re: New www.medsXX.net spam

2009-06-21 Thread mouss
John Hardin a écrit : On Fri, 2009-06-19 at 09:24 -0700, John Hardin wrote: On Fri, 2009-06-19 at 16:21 +0200, Paweł Tęcza wrote: body AE_MEDS35 /w{2,4}\s{0,4}meds\d{1,4}\s{0,4}(?:net|com|org)/ I've just noticed missing 'i' switch for your rule regexp. Is it a bug or a feature? :) That

Re: SORBS bites the dust

2009-06-22 Thread mouss
Charles Gregory a écrit : On Mon, 22 Jun 2009, rich...@buzzhost.co.uk wrote: Really? Personally I find the PBL just kicks its ass. When I did my research for setting up RBL's, I found old comparisons between RBL's that seemed to indicate that the spamhaus PBL and the spamcop lists had

Re: SORBS bites the dust

2009-06-22 Thread mouss
Gary Smith a écrit : If you follow the unlisting proceedure and meet all of the requirements, then you get unlisted. As with all things, it just takes a little patients. After converting my IP's over from my ISP to my DNS servers, I was listed (because the ISP no longer listed us a

Re: SORBS bites the dust

2009-06-23 Thread mouss
Res a écrit : On Tue, 23 Jun 2009, mouss wrote: payment were only needed for spam, not for dul not really :) despite what their site said/says.. its kind of a detterent i think sunno we never paid This is wrong. if you have evidence, show it. if not, stop spreading rumours. I have

Re: [sa] Re: SORBS bites the dust

2009-06-24 Thread mouss
Charles Gregory a écrit : On Wed, 24 Jun 2009, Matus UHLAR - fantomas wrote: somewhat hesitant to use spamcop as our own servers once had a brief listing with them (and it wasn't due to spam). Got more info? Sadly, we're dealing with my aging memory. :) While I cannot remember precisely,

Re: SORBS bites the dust

2009-06-25 Thread mouss
James Wilkinson a écrit : mouss wrote (about the PBL): stop spreading FUD. if you know of false positives, show us so that we see what you exactly mean. a lot of people, including $self, use the PBL at smtp time. As usual, it depends on your definition of “false positive”. fully agreed

Re: SA RegEx Rules

2009-06-28 Thread mouss
Cory Hawkless a écrit : Hi all, Been doing some reading on RegEx and even coming from a programming background it is a bit intimidating, my problem is I haven’t been able to find a good source of information on exactly what\how SpamAssassin matches the RegEx rules when scanning and

Re: trusted_networks and internal_networks

2009-07-13 Thread mouss
MrGibbage a écrit : I have read the help pages for those two settings over and over, and I guess I'm just not smart enough. I can't figure out what I should put for those two settings. Can one of you give me a hand by looking at the headers from an email? I can tell you that my SA

Re: trusted_networks and internal_networks

2009-07-13 Thread mouss
Jari Fredriksson a écrit : MrGibbage a écrit : #ps11651.dreamhostps.com and pelorus.org internal_networks 75.119.219.171 trusted_networks 75.119.219.171 #I think this is wrong no, it is not wrong. the documentation says: Every entry in internal_networks must appear in trusted_net-

Re: trusted_networks and internal_networks

2009-07-14 Thread mouss
Jari Fredriksson a écrit : I tried with this: -(local.cf)--- internal_networks 10.0.0.0/8 trusted_networks 10.0.0.0/8 127.0.0.1 trusted_networks 212.16.98.0/24 212.16.100.0/24 62.142.0.0/16 195.197.172.98 trusted_networks 195.74.0.0/16 213.192.189.2/24 217.30.188.0/24

Re: trusted_networks and internal_networks

2009-07-14 Thread mouss
Jari Fredriksson a écrit : [snip] when I put your lines in my config, I only seethe 127.0.0.1/32 warning. It looks like SA itself configured the trusted. I removed both the 127.0.0.1 AND 10/8 and this is happy again. It seems to configure the internal networks as trusted

Re: copy spam mail to separate mailbox

2009-07-18 Thread mouss
Evan Platt a écrit : At 11:22 AM 7/16/2009, you wrote: I have a postfix/SA setup and I was wondering if anyone knew how to COPY an email marked as spam instead of redirecting. Not this: /^X-Spam-Flag: YES/ REDIRECT spam...@example.com if you use amavisd-new, configure it to add a +spam

Re: Spamassassin rules in a mysql database

2009-07-19 Thread mouss
Martin Gregorie a écrit : put any custom rules in the database, and modify the spamd? start scripts to write the custom rules to flat files. modify your update program to signal a spamd reload every time you modify the rules, or, use unison. we use unison (not for our VPS spam clusters) but

Re: Avoid processing of email with specific headers

2009-07-25 Thread mouss
Pietro a écrit : In my installation, SA is called by Postfix. Any idea? Thanks in advance. This is really a postfix question. Follow up on the postfix-users list if needed. you can skip filtering using header_checks. for example /^X-Spam-Status: Yes/ FILTER smtp:[127.0.0.1]:10025 assuming

Re: anchor forgery

2009-07-25 Thread mouss
Mike Cardwell a écrit : Just checking through my Spam folder and I came across a message that contained this in the html: a target=_blank href=http://www.kanotiser.se/images/logo.html;https://www.paypal.co/us/webscr.php?cmd=_login-runcmd=_secure /a Yet, there was no mention of this

Re: Avoid processing of email with specific headers

2009-07-25 Thread mouss
Jari Fredriksson a écrit : snip did you see this: This is really a postfix question. Follow up on the postfix-users list if needed. did you see that? [snip] Got the following error, when tried that. I'm using stock postfix on Debian Lenny w/ backports. postfix/cleanup[1602]:

Re: United-MAP spam flood

2009-07-26 Thread mouss
Paweł Tęcza a écrit : Hello Folks, Did you also get many spams from United-MAP, a dynamic company with rapid development, with a united team of professionals in its core.? :) Or maybe this new spam flood is only Poland targeted? or maybe we don't see them because they come from clients

Re: Catch-22 unsubscribing from this list.

2009-07-28 Thread mouss
Steven W. Orr a écrit : On 07/26/09 20:01, quoth RW: On Sat, 25 Jul 2009 18:07:12 -0400 Michael W. Cocke cocke.mich...@gmail.com wrote: There doesn't seem to be a web interface to subscribe/unscribe from this list. The email address users-unsubscr...@spamassassin.apache.org complains

Re: Any one interested in using a proper forum?

2009-07-28 Thread mouss
snowweb a écrit : I don't know about anyone else, but I'm getting a bit hacked of with this 1980's style forum. I'm trying to get to the bottom of an SA issue and this list/forum thing is giving me a bigger headache than SA! Spamassassin has more than one or two users now and I personally

Re: [OT] Re: Any one interested in using a proper forum?

2009-07-28 Thread mouss
Mike Cardwell a écrit : Henrik K wrote: Good for you. I've signed up for many mailing lists AND forums. There is nothing inherently better or worse in either of them, No that's wrong, they're quite different and both have advantages and disadvantages. so, it's YES, not NO. Henrik said

Re: Reply to:

2009-08-01 Thread mouss
twofers a écrit : So what makes a spammer want to use a valid email address as a return or reply-to address to catch all the undeliverable, failure and bounced email that occures when sending UBE spam. this is to beat those who use sender verification/sender callout/(whatever you name it).

Re: blacklisting a forger

2009-08-02 Thread mouss
Terry Carmen a écrit : On Sat, 1 Aug 2009 19:33:40 -0400 Terry Carmen te...@cnysupport.com wrote: The backscatter would not have been received, since the sender is on a number of RBLs. It's the IP address of the botnet PC that's on the RBLs, the backscatter doesn't come from there, it comes

Re: received-header: unparseable:

2009-08-16 Thread mouss
Chris a écrit : I keep seeing this when running some messages throught spamassassin -D -t. Is this having an effect on whether or not short circuit works? received-header: unparseable: from spam01.embarq.synacor.com (LHLO smtpout01.embarq.synacor.com) (10.50.1.1) by md29.embarq.synacor.com

Re: received-header: unparseable:

2009-08-17 Thread mouss
LuKreme a écrit : On 16-Aug-2009, at 18:03, Chris wrote: Received: from spam05.embarq.synacor.com (LHLO smtpout01.embarq.synacor.com) (10.50.1.5) by md29.embarq.synacor.com with LMTP; Sun, 16 Aug 2009 19:19:56 -0400 (EDT) LMTP? Seriously? Does anyone use that? Well, yes, evidently. of

Re: HELO_DYNAMIC_IPADDR false positive

2009-08-18 Thread mouss
Bob Proulx a écrit : The following header line: Received: from static-96-254-126-11.tampfl.fios.verizon.net [96.254.126.11] by windows12.uvault.com with SMTP; Wed, 12 Aug 2009 08:26:40 -0400 Hits the HELO_DYNAMIC_IPADDR rule. I tested it this way: $ perl -le 'if

Re: Barracuda RBL in first place

2009-08-18 Thread mouss
Marc Perkel a écrit : http://www.sdsc.edu/~jeff/spam/cbc.html It appears from Jeff's Blacklists Compared list the Barracuda has overtaken spamhaus for the #1 position. Not sure about the accuracy of the list as compared to spamhaus but seams reasonably good to me. I don't really count apews

Re: HELO_DYNAMIC_IPADDR false positive

2009-08-19 Thread mouss
pattern to me. On 19.08.09 00:48, mouss wrote: The name of the rule is worng, but the result is ok. Instead of dynamic, I suggest: UMO for Unidentifiable Mailing Object. whether static-ip- is static or not doesn't matter. a lot of junk comes from such hosts, and we can't report/complain

Re: HELO_DYNAMIC_IPADDR false positive

2009-08-20 Thread mouss
Matus UHLAR - fantomas a écrit : On 19.08.09 00:48, mouss wrote: The name of the rule is worng, but the result is ok. Instead of dynamic, I suggest: UMO for Unidentifiable Mailing Object. whether static-ip- is static or not doesn't matter. a lot of junk comes from such hosts, and we can't

Re: i need your indulgence

2009-08-21 Thread mouss
Dan Schaefer a écrit : Karsten Bräckelmann wrote: On Fri, 2009-08-21 at 08:06 -0400, Dan Schaefer wrote: Any ideas about this one, besides adding a score to match the subject? Probably not a smart idea, since you insist on re-using that very subject for your list post... That

Re: sare channels

2009-08-21 Thread mouss
Gary Smith a écrit : Read the top of the rulesemporium site: http://www.rulesemporium.com/ SARE rules aren't being updated. Hence, sa-updating them is pointless. Is it still recommended to run the SARE rules? you should use 90_2tld_cf_sare_sa-update_dostech_net to avoid querying

Re: Rule PTR != localhost

2009-09-03 Thread mouss
Clunk Werclick a écrit : On Thu, 2009-09-03 at 01:36 -0400, Sahil Tandon wrote: On Thu, 03 Sep 2009, Clunk Werclick wrote: I'm starting to see plenty of these and they are new to us: zgrep address not listed /var/log/mail.info Sep 3 05:26:59 : warning: 222.252.239.56: address not

Re: Rule PTR != localhost

2009-09-06 Thread mouss
LuKreme a écrit : On 3-Sep-2009, at 15:33, mouss wrote: check_helo_hostname_access hash:/etc/postfix/access_host If but this in my smtpd_helo_restrictions (with a warn_if_reject for right now), but where in the smtpd_recipient_restrictions do you recommend putting

Re: antispam comparison by virus bulletin

2009-09-06 Thread mouss
Justin Mason a écrit : In fairness, they got in touch to ask for help in setting up a more recent SA, but none of us (ie the PMC) had the spare cycles to help out. Comparative third-party tests like this always take a lot of hand-holding. We don't have the same kind of marketing budget as

Re: DNSWL and JMF White false positives, what to do exactly?

2009-09-30 Thread mouss
Warren Togami wrote: I scanned my spam folders and found a few false positives that hit on either DNSWL FP with DNSWL? FP = False Positive = legitimaite mail tagged as spam DNSWL = Whitelist if your system adds points because of dnswl, you have a serious problem. .. or do you mean FN

Re: DNSWL and JMF White false positives, what to do exactly?

2009-10-01 Thread mouss
Karsten Bräckelmann wrote: On Wed, 2009-09-30 at 23:35 +0200, mouss wrote: Warren Togami wrote: I scanned my spam folders and found a few false positives that hit on either DNSWL FP with DNSWL? FP = False Positive = legitimaite mail tagged as spam DNSWL = Whitelist False positive

Re: DNSWL and JMF White false positives, what to do exactly?

2009-10-01 Thread mouss
RW wrote: On Wed, 30 Sep 2009 23:35:31 +0200 mouss mo...@ml.netoyen.net wrote: Warren Togami wrote: I scanned my spam folders and found a few false positives that hit on either DNSWL FP with DNSWL? FP = False Positive = legitimaite mail tagged as spam DNSWL = Whitelist The term

Re: DNSWL and JMF White false positives, what to do exactly?

2009-10-02 Thread mouss
RW wrote: On Fri, 02 Oct 2009 00:14:52 +0200 mouss mo...@ml.netoyen.net wrote: RW wrote: The term false-positive can apply to any test. A test for ham that matches a spam is a false-positive, it's a matter of context. spam too can be (re)defined. and actually any term. but it is assumed

Re: DNSWL and JMF White false positives, what to do exactly?

2009-10-02 Thread mouss
Karsten Bräckelmann wrote: On Fri, 2009-10-02 at 00:08 +0200, mouss wrote: Karsten Bräckelmann wrote: False positive. Something, that matches (positive) the criterion for a certain test, but should not (false). I stand to what I said. I'm not surprised:) you can certainly devise

Re: New spamhaus list not included

2009-10-04 Thread mouss
RW a écrit : On Sun, 04 Oct 2009 15:53:34 +0200 Yet Another Ninja sa-l...@alexb.ch wrote: why lastexternal ? would you expect ham traffic from those IPs? and want to loose deeper header parsing? Right, although I doubt this list is going to be much use for SpamAssassin. With zen

Re: OT bad news

2009-10-05 Thread mouss
Thomas Mullins a écrit : We have been running Spamassassin for maybe eight years now. But, my coworkers do not like OpenSource. So they have finally complained enough that my boss is going to replace our reliable FreeBSD/Spamassassin boxes. They are planning on purchasing something that

Re: OT bad news

2009-10-06 Thread mouss
Quanah Gibson-Mount a écrit : --On Monday, October 05, 2009 11:50 PM +0200 mouss mo...@ml.netoyen.net wrote: Thomas Mullins a écrit : We have been running Spamassassin for maybe eight years now. But, my coworkers do not like OpenSource. So they have finally complained enough that my boss

Re: spam from noave.net 74.63.109.*

2009-10-08 Thread mouss
Steve Prior a écrit : I started getting spam that was distinctive for having two boxes - one Email Security Information and one Privacy Policy and viewing source indicated the mails came from a server at noave.net 74.63.109.*. I blocked 74.63.109.* and the spam stopped for a while, but I

Re: Postfix Received header FP's and masscheck

2009-10-11 Thread mouss
Warren Togami a écrit : I am trying to reconfigure my postfix server to get rid of false positives in the masschecks. * I run my own postfix server at example.com. * Several of my users have IMAP accounts on my server. They send their outgoing mail via my server with SMTP-after-IMAP. This

Re: Good reasons to dont use RBLs

2009-11-15 Thread mouss
Luis Daniel Lucio Quiroz a écrit : Hi all, Again me, Well, in the security scope i use a principle that states that you souldnt use a lower layer solution to fix a higher one. So SPAM is a Layer 7 problem that is used to fixed with a Layer 3 solution (RBL). I'd like a brainstorm to

Re: emailreg.org - pretty good white list

2009-12-14 Thread mouss
jdow a écrit : [snip] Per a discussion off the list the $20 is, as mentioned, pretty much a captcha and as the web site declares, an inoculation against domain tasting or 10 for a dollar .cn domains. The thousands of names registration isn't going to get through either ReturnPath or

Re: emailreg.org - tainted white list

2009-12-14 Thread mouss
Bill Landry a écrit : Christian Brel, AKA rich...@buzzhost.co.uk (among other aliases), is back... Bill he switched MUA, but forgot to switch helo and get a different IP range... Received-SPF: softfail (nike.apache.org: transitioning domain of

Re: The other side of whitelists - arbitrary blacklists

2009-12-21 Thread mouss
jdow a écrit : http://isc.sans.org/diary.html?storyid=7780 It can be quite frustrating to run an ISP and comply with the often arbitrary, strange, and I suspect contradictory demands of the likes of SORBS and Trend Micro. An ISP Abuse handler vents in this article. from the text, there is

Re: The other side of whitelists - arbitrary blacklists

2009-12-22 Thread mouss
jdow a écrit : At least one well respected ninja sort from this list is also a volunteer SANS Internet Storm Cellar operator. These folks do not seem to be in the least inexperienced in the ways of malware and malware delivery. That is why I take that diary entry at face value. maybe I'm

Re: How to tell if sa-update is actually running

2010-01-08 Thread mouss
clem...@dwf.com a écrit : How do I tell if sa-update is actually running? I mean, yes, I can run it by hand and get no error messages, and with -D I dont see any problems, still I feel that my stuff isnt current, and that there should be an update. Should I be getting a message in

Re: How to tell if sa-update is actually running

2010-01-10 Thread mouss
R P Herrold a écrit : On Fri, 8 Jan 2010, mouss wrote: you can query DNS to get the version of the rules. for example: $ host -t txt *.2.3.updates.spamassassin.org *.2.3.updates.spamassassin.org descriptive text 895075 (2.3 is the reverse of 3.2, which corresponds to the SA version you

Re: Faked _From_ field using our domain - how to filter/score?

2010-01-17 Thread mouss
Callum Millard a écrit : I'm sure there's a straight forward way of doing this, but after several of hours searching, I can't find it. The problem is spam with a faked 'From:' field. Spammers are sending e-mails to our domain with the 'From:' field set to a valid e-mail address from our

Re: [Fwd: Delivery Status Notification (Failure)]

2010-01-18 Thread mouss
jdow a écrit : From: Christian Brel brel.spamassassin091...@copperproductions.co.uk Sent: Wednesday, 2010/January/13 07:40 On Wed, 13 Jan 2010 16:17:31 +0100 Matus UHLAR - fantomas uh...@fantomas.sk wrote: On Wed, 13 Jan 2010 09:39:34 -0500 Jason Bertoch ja...@i6ix.com wrote: Can a

Re: [Fwd: Delivery Status Notification (Failure)]

2010-01-18 Thread mouss
David B Funk a écrit : On Wed, 13 Jan 2010, Jason Bertoch wrote: Can a list admin disable the spamassas...@hundredacrewood.willspc.net account as we're still getting bounces? Original Message Subject: Delivery Status Notification (Failure) Date: Wed, 13 Jan 2010

Re: [Fwd: Delivery Status Notification (Failure)]

2010-01-19 Thread mouss
Jason Bertoch a écrit : On 1/18/2010 6:38 PM, mouss wrote: David B Funk a écrit : On Wed, 13 Jan 2010, Jason Bertoch wrote: Can a list admin disable the spamassas...@hundredacrewood.willspc.net account as we're still getting bounces? Original Message Subject: Delivery

Re: MTX plugin functionally complete? Re: Spam filtering similar to SPF, less breakage

2010-02-13 Thread mouss
dar...@chaosreigns.com a écrit : On 02/13, Matus UHLAR - fantomas wrote: So the only effect of MTX should be confirmation that a machine may send mail? Yes. So why the complicated check for DNS record combining DNS name and IP? Why not simply requesting that machine has a mail or smtp

Re: Rewriting header fields help please

2007-09-19 Thread mouss
Brian S. Meehan wrote: Hi, There's the option rewrite_header Subject in the local.cf file, however, I've been observing when looking through the spam folder that sorting by subject is more helpful when looking for incorrectly caught emails since many emails often have the same subject and

Re: Q about mail proxy servers and setups

2007-09-23 Thread mouss
Michael Scheidell wrote: Sometimes a large company will have a proxy server set up in the DMZ and then send it to their internal mail server. I understand that ideally, the proxy server would be replaces with a SpamAssassin/MTA setup. However, sometimes, client, security and company policy

Re: Forwarding and spamassassin...

2007-09-23 Thread mouss
James Lay wrote: On 9/23/07 8:53 AM, mel goldberg [EMAIL PROTECTED] wrote: I¹m new to the list, apologize in advance if I should be posting this somewhere else. I am attempting to SPAM filter and forward from my server to another. Spamassassin filters but the server will not forward.

Re: OT - massive newsletter

2007-09-23 Thread mouss
mizzio wrote: hello everybody, I apologize to ask an off-topic question, and feel free to point me to any other resources on the net. I'm setting up an SMTP server (centos + qmail) on a dell quad core machine for sending out a periodic newsletter (10 millions a month). In order to avoid

Re: OT - massive newsletter

2007-09-23 Thread mouss
Kris Deugau wrote: Ralf Hildebrandt wrote: * Randal, Phil [EMAIL PROTECTED]: If you don't want to annoy a lot of people your spamming (oops, newsletter sending) software needs to deal with NDRs back from recipient's domains and either put their subscription on hold after a small number of

Re: Q about mail proxy servers and setups

2007-09-24 Thread mouss
Michael Scheidell wrote: -Original Message- From: David B Funk [mailto:[EMAIL PROTECTED] Sent: Monday, September 24, 2007 12:07 AM To: Michael Scheidell Cc: users@spamassassin.apache.org; Amavis-Users Subject: RE: Q about mail proxy servers and setups On Sun, 23 Sep 2007, Michael

Re: Marc: use SPF to prevent backscatter? Was RE: [AMaViS-user] Q about mail proxy servers and setups

2007-09-24 Thread mouss
Michael Scheidell wrote: One thing I would like to see (and this is a different subject: Marc: take note: Id like to NOT BOUNCE an email back to the victim of backscatter if they bothered to publish SPF or SENDER ID records that don't match the incoming. It's the other way around. you

Re: Discarding RBL-Mails, forwarding others

2007-09-26 Thread mouss
Dietmar Braun wrote: DJM http://www.postfix.org/postconf.5.html#always_bcc Hm, I tried that, but it doesn't work, because it the configuration should be dependent of the recipient domain... [please ask on the postfix users list, instead of here] then you should say what exactly you want

Re: looking into spamassassin mail proxy solution

2007-09-28 Thread mouss
tuxbeagle wrote: Thanks, Knowing what to search for helps. The first document I started reading has an installation where spam is filtered to a specific user 'spammy'. I hope that there is a way to just tag the spam in the header and let the user filter locally. visit the postfix and

Re: A belly laugh is a *good* way to start the day

2007-09-30 Thread mouss
John D. Hardin wrote: Has somebody subscribed paypal customer support to the SA list? This highly amusing form letter just dropped into my mailbox... (Yes, it *was* received from a paypal MTA.) either that, or somebody is forwarding mail to them. yet another broken auto-responder: it

Re: Discarding RBL-Mails, forwarding others

2007-10-01 Thread mouss
Dietmar Braun wrote: Wednesday, September 26, 2007, 12:12:13 PM, you wrote: m then you should say what exactly you want to achieve. we could spend a month at guess games. I think I said all you have to know - the one missing was just the domain dependent thing. Additionally, this rejects

Re: New domains

2007-10-01 Thread mouss
Jonas Eckerman wrote: (The idea below is not mine, someone else (I'm sorry, but I forgot who) wrote about it here (I think) before.) Giampaolo Tomassoni wrote: brand-new domains, Something that could work for this without the problems inherent in using whois or registry databases is to

Re: SSO's RHSBL

2007-10-08 Thread mouss
Giampaolo Tomassoni wrote: -Original Message- From: Micah Anderson [mailto:[EMAIL PROTECTED] Sent: Monday, October 08, 2007 6:30 PM Well, it may be, but I believe it is not more than a week I'm getting these log entries. This is right, these error only

Re: Advice on MTA blacklist

2007-10-09 Thread mouss
Chris Edwards wrote: On Tue, 9 Oct 2007, Jo Rhett wrote: | Both Crackberry and Verizon force you to use their mail servers. Some other | data providers are now doing transparent proxy on outbound e-mail. In short, | the user can't always control that. True, to an extent. I don't know

Re: Advice on MTA blacklist

2007-10-10 Thread mouss
R.Smits wrote: Jeff Chan wrote: Quoting Richard Smits [EMAIL PROTECTED]: Thanks for all the advice.. I think we will be using spamhaus. I am running a test and it blocks a lot of spam. Currently I use the sbl.spamhaus and pbl.spamhaus Is this wise, or should I also use the xbl and

Re: Advice on MTA blacklist

2007-10-10 Thread mouss
Leon Kolchinsky wrote: Hello, Which spam blacklists do you use in your MTA config. (postfix) smptd_client_restrictions Currently we only use : reject_rbl_client list.dsbl.org We let spamassassin fight the rest of the spam. But the load of spam is getting to high for our organisation. Wich

Re: Advice on MTA blacklist

2007-10-11 Thread mouss
David B Funk wrote: Jo you didn't read Chris's statement closely. A conscientious mail server administrator will configure the SERVER to -ONLY- accept encrypted connections for SMTP-AUTH transactions; the server should enforce the encryption requirements. This is a religious war

Re: 8bit encoding in mail header by SpamAssassin

2007-10-11 Thread mouss
Mark Martinec wrote: This is not a default behaviour, normally such errors in header are only flagged/logged as a warning, but a message is delivered nevertheless. There is no particularly good reason to block such messages, but you can if you want to. In countries like here, that would

Re: Deleting Spam (Linux Procmail)

2007-10-11 Thread mouss
Matus UHLAR - fantomas wrote: On Thursday 11 October 2007, Mark wrote: I'm new to the list, so I hope this is the right place. I am running my mail through procmail and separating my spamassassin into 3 groups depending on score: X-Spam-Status: Yes, score=[2-9][0-9]

Re: Can't locate Net/DNS/RR/PTR.pm in @INC

2007-10-13 Thread mouss
Jose Mario Pires wrote: Hi, Please excuse me if this isn't the appropriate place to report this issue and asking for help. I have installed the last available version of Qmailtoaster and things apparently are all OK. It has some hundred email accounts and processes thousands of emails

Re: unsubscribed

2007-10-17 Thread mouss
Rob Sterenborg wrote: Steve Ingraham wrote: I cannot help but comment on this post. Neither can I. I am one of those ignorant people that is subscribed to this list (along with several others) for the purpose of asking questions of you experts out there because I do not fully

Re: spam scores for reverse DNS

2007-10-19 Thread mouss
YMGT wrote: Hi Guys, I am sending two emails from the same system. One of these emails is giving me extra spam penalty scores for failed reverse DNS tests. The header of that email is: I have no idea what these REVDNS_* rules come from. can you grep your config files to find them?

Re: Disabling URIDNSBL plugin

2007-10-20 Thread mouss
Micah Anderson wrote: * Daryl C. W. O'Shea [EMAIL PROTECTED] [071019 14:59]: Justin Kim wrote: I don't know what is causing my postfix server to defer messages couple of times daily. By looking at the logs, I can only tell there is something that keeps one spam checking

Re: Disabling URIDNSBL plugin

2007-10-21 Thread mouss
Micah Anderson wrote: * mouss [EMAIL PROTECTED] [071020 09:38]: Micah Anderson wrote: Do you think running a bayes expire via cronjob is necessary if you are running a INNOdb based bayes DB (with this patch[1])? Also, if you postpone the bayes expire to instead run it via cron

  1   2   3   4   5   6   7   8   9   10   >