mouss wrote:
Drew Tomlinson a écrit :
[snip]
OK, I think I understand now. uribl is a way to check mail content for
domains that *appear* in spam, not from where the mail is sent. Good
idea! I will see about adding that to SpamAssassin.
It appears that SpamAssassin 3.2.5 with sa-update rules from yesterday
is already using uribl in its default rules. I see lines like this in
SpamAssassin checks:
2.0 URIBL_BLACK Contains an URL listed in the URIBL blacklist
[URIs: dreamsperverseusually.net]
yes. and also consider adding the BRBL (Barracuda DNSBL) to your
spamassassin setup.
header RCVD_IN_BRBL eval:check_rbl('brbl-lastexternal',
'bb.barracudacentral.org.')
describe RCVD_IN_BRBL Received via a relay in Barracuda BRBL
tflags RCVD_IN_BRBL net
score RCVD_IN_BRBL 3
Thanks. I'll look at this too.
can you show the headers of the spam you cited in your OP? (don't
include the body). you can remove all Received headers and recipient
headers (Delivered-To, To, Cc, ...).
Here's the headers from one of the offenders:
Return-Path: <[email protected]>
X-Spam-DCC: _DCCB_: _DCCR_
X-Spam-Level:
X-Spam-Status: No, score=0.0 required=5.0 tests=none autolearn=unavailable
version=3.2.5
X-Spam-Pyzor: _PYZOR_
X-Spam-Report:
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=default; d=mycouponsavingsmail.com;
h=Message-ID:Date:From:Reply-To:To:Subject:Mime-Version:Content-Type:Content-Transfer-Encoding:list-unsubscribe;
[email protected];
bh=Kv0NXnokx7cTc4dWUV0dFQ8qMOw=;
b=qUVtMolVujmDJ+MiwM991yJAEq3bLHV2SjfsxQ+betnMhlQhMLtTh0tuc53cUZ5cmqC+OqqKHeA9
1aYYyJ8q/w==
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=default;
d=mycouponsavingsmail.com;
b=nNAZ3L0TFEyWzudi7mKSog4FjvNMP9RuZqWL/tbm684uQsga7w6ZNXKi2ds/uCaMCFbr5ymW5dSz
F2lIymAl/A==;
Message-ID: <[email protected]>
Date: Mon, 11 May 2009 06:33:23 -0500 (CDT)
From: Airline ticket voucher <[email protected]>
Reply-To: My Coupon Savings <[email protected]>
To: "[email protected]" <[email protected]>
Subject: American Airlines ticket voucher - please review
Mime-Version: 1.0
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
X-WBC: kwwwwbmrkwmpvjvpqmjsjwlrr vjmbljvjwvpblmsvsqvjpvsmljv vkqmqbbbjr
list-unsubscribe: mailto:[email protected]
X-Antivirus: avast! (VPS 090515-0, 05/15/2009), Inbound message
X-Antivirus-Status: Clean
Thanks,
Drew
