Hi Chris,
thanks for that tip!
I will use your rule and also I have done this:
Incremented the score of these tests including DUL tests:
score SPF_FAIL 3.0
score SPF_HELO_FAIL 2.0
score DNS_FROM_RFC_BOGUSMX 2.0
score RCVD_IN_SORBS_DUL 3.0
score RCVD_IN_NJABL_DUL 3.0
score RCVD_IN_DSBL 2.0
score DNS_FROM_RFC_POST 2.0
Incremented the timout since I have high pings:
rbl_timeout 25
And used this option too:
internal_networks 192.168.1.0/24
Regards,
Oliver
--
Oliver Schulze L.
Get my e-mail after a captcha test in: http://tinymailto.com/oliver
Chris Santerre wrote:
> -----Original Message-----
> From: Oliver Schulze L. [mailto:[EMAIL PROTECTED]
> Sent: Thursday, August 17, 2006 2:24 PM
> To: users@spamassassin.apache.org
> Subject: Dealing with spam bots and dialup/dsl spammers
>
>
> HI,
> I'm getting a very high Spam volume lately.
> I noticed that the most common source of spam are dial-up and
> A/DSL users.
>
> I wonder if there is a test that I can raise the score, when
> an IP/hostname
> send me and email and that IP/hostname is not a MX server for
> that domain.
>
Well most of these are better to deal with at the MTA level. Use an
RBL. But I have this older rule for SA I still use today:
Mind the wordwrap!
header MY_DSL Received =~
/\.atlantabroadband\.com|customer|ppp|poole?s?|modem|cable|node|adsl|dial|dsl|client|(insight|tampabay|maine|nyc|nc|cinci)\.rr\.com|vc\.shawcable\.net|se\.client..?\.attbi\.com|\.(east|west)\.verizon\.net|(nj|sc)\.comcast\.net|\.dis.net|\.charter.com|metropolis\-inter\.com/i
describe MY_DSL Contains likely dsl address in header
score MY_DSL 3.0
Thanks,
Chris Santerre
SysAdmin and Spamfighter
www.rulesemporium.com
www.uribl.com
--
Oliver Schulze L.
Get my e-mail after a captcha test in: http://tinymailto.com/oliver
