Loren Wilton schrieb:
How can I see in mail header about if network tests run?
You would see tests like SURBL and other net tests hitting. For instance:
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
<http://www.spamcop.net/bl.shtml?222.100.230.130>]
3.1 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[222.100.230.130 listed in sbl-xbl.spamhaus.org]
1.6 DNS_FROM_RFC_POST RBL: Envelope sender in
postmaster.rfc-ignorant.org
1.0 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: iprohealth.info]
0.4 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
[URIs: iprohealth.info]
4.0 URIBL_JP_SURBL Has URI in JP at http://www.surbl.org/lists.html
[URIs: iprohealth.info]
1.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
[URIs: iprohealth.info]
3.2 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
[URIs: iprohealth.info]
4.3 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
[URIs: iprohealth.info]
All of those are network tests. There are also more than that.
Is it enough to not post the mail bodies, only the headers here to get
helped to set better rules?
We can tell you what hit from the headers and possibly suggest things from
that. To be definitive we would need to see the body also.
However, as a general rule if you get net tests working and perhaps pick up
some rules from rulesemporium, you should be doing pretty well.
Loren
Well, header I have on detected spams like these (possibly I need to
reconfigure something) to get the above lists:
From - Fri Jul 8 23:49:19 2005
X-UIDL: 1120816053.M599315P13835051595651358838.host1
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 8304 invoked by uid 567); 8 Jul 2005 09:47:23 -0000
Received: from 212.244.155.196 by host1 (envelope-from <[EMAIL PROTECTED]>, uid 502) with qmail-scanner-1.25
(clamdscan: 0.86.1/971. spamassassin: 3.0.4.
Clear:RC:0(212.244.155.196):SA:0(-1.8/1.5):.
Processed in 1.2544 secs); 08 Jul 2005 09:47:23 -0000
Received: from unknown (HELO freesulf.de) (212.244.155.196)
by 0 with SMTP; 8 Jul 2005 09:47:21 -0000
Message-ID: <[EMAIL PROTECTED]>
Date: Fri, 08 Jul 2005 11:26:35 -0200
Reply-To: "[EMAIL PROTECTED]" <[EMAIL PROTECTED]>
From: "[EMAIL PROTECTED]" <[EMAIL PROTECTED]>
User-Agent: Mozilla 4.78 [en] (Windows NT 5.0; U)
X-Accept-Language: en-us
MIME-Version: 1.0
To: "Brett Koehler" <[EMAIL PROTECTED]>
Subject: Jetzt bewerben USA Green-Cards Leben und Arbeiten in USA / Live and
work in the United States
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Spam-Status: No, score=-1.8 required=1.5 tests=BAYES_00,
DATE_IN_FUTURE_03_06 autolearn=ham version=3.0.4
X-Spam-Level:
X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on host1.booms-edv.de
-- Deutsch hier-German here /English see 2 nd part --
Die US Regierung vergibt wieder 50,000 GreenCards.
Leben und Arbeiten in den USA
Nehmen Sie am diesjaehrigen Green Card Programm der US-Regierung teil
und verschaffen Sie sich das Leben und die Freiheit, die Sie verdienen.
Green-Card Program 2005! Jetzt bewerben!
Verpassen Sie nicht Ihre Chance!
hier klicken:
http://register-usa.com/de/application.htm
Seems I have only a conclusion of tests.
Thomas
--
Booms EDV
- hosting & more -
Herrenstrasse 10
D-59073 Hamm
www.booms-edv.de
[EMAIL PROTECTED]
