Re: spamhaus' PBL is now *active* (in beta ... but still active). now what?

2007-01-06 Thread hamann . w
>> >> reading at the spamhaus site abt PBL i note, >> >> "WARNING! Some post-delivery filters use "full Received line >> traversal" or "deep parsing", where the filter reads all the IPs in >> the Received lines. Legitimate users, correctly sending good mail out >> through their ISP's smartho

Re: Spamassassin leaving directories behind in my tmpdir

2007-01-06 Thread John Andersen
On Thursday 04 January 2007 18:36, Andy Dills wrote: > I'm running amavisd (2.4.4) and spamassassin (3.1.7), and I'm finding that > SA is leaving behind directories with names like > .spamassassin88507SeaMbitmp. And these are Where? How old? How many? -- _ J

Re: spam header shows received from localhost always?

2007-01-06 Thread John Andersen
On Wednesday 03 January 2007 23:27, vertito wrote: > that works with sendmail, any advise? Yes. Don't send HTML mail to this mailing list. Its not uncommon to see headers showing received from local host. Several modern MTAs use dual pass architecture where mail passes thru the MTA twice, once

Re: spamhaus' PBL is now *active* (in beta ... but still active). now what?

2007-01-06 Thread Panagiotis Christias
On 1/7/07, snowcrash+spamassassin <[EMAIL PROTECTED]> wrote: > The recent 3.1 updates include the ZEN rules. If you're asking what files are > changed by sa-update, please see "man sa-update" and the other documentation > referenced therein. no, i was asking what files need to be changed in ord

Re: spamhaus' PBL is now *active* (in beta ... but still active). now what?

2007-01-06 Thread snowcrash+spamassassin
The recent 3.1 updates include the ZEN rules. If you're asking what files are changed by sa-update, please see "man sa-update" and the other documentation referenced therein. no, i was asking what files need to be changed in order for the referenced 'warning' abt PBL usages w/ filtering/scannin

Re: spamhaus' PBL is now *active* (in beta ... but still active). now what?

2007-01-06 Thread Phil Barnett
On Saturday 06 January 2007 23:05, Theo Van Dinter wrote: > On Sat, Jan 06, 2007 at 05:24:35PM -0800, snowcrash+spamassassin wrote: > > i regularly run updates via cron on the hour. > > > :) > : > > running it again, or at all, will change what/where? > > The recent 3.1 updates include the ZEN rule

Re: spamhaus' PBL is now *active* (in beta ... but still active). now what?

2007-01-06 Thread Theo Van Dinter
On Sat, Jan 06, 2007 at 05:24:35PM -0800, snowcrash+spamassassin wrote: > i regularly run updates via cron on the hour. :) > running it again, or at all, will change what/where? The recent 3.1 updates include the ZEN rules. If you're asking what files are changed by sa-update, please see "man s

Re: spamhaus' PBL is now *active* (in beta ... but still active). now what?

2007-01-06 Thread Daryl C. W. O'Shea
snowcrash+spamassassin wrote: In any case, why the fuss? You've had three SA developers tell you the rules that are published are fine how they are. wow. what "fuss" ? i've been polite in my intent and in my asking. this *is* the "users" list after all. Nah, I'm probably just in a really p

Re: spamhaus' PBL is now *active* (in beta ... but still active). now what?

2007-01-06 Thread snowcrash+spamassassin
In any case, why the fuss? You've had three SA developers tell you the rules that are published are fine how they are. wow. what "fuss" ? i've been polite in my intent and in my asking. this *is* the "users" list after all. i'm asking questions so that i understand. contrary to what you may

Re: "Dear Homeowner" spam

2007-01-06 Thread John Andersen
On Wednesday 03 January 2007 03:59, Sietse van Zanen wrote: > Can you post (a link to) an example mesage? > > I am pretty sure they are caught in my setup. > I wonder if these are the "your credit rating doesn't matter to us" messages. That person is on this list and studies things very carefully

Re: spamhaus' PBL is now *active* (in beta ... but still active). now what?

2007-01-06 Thread Daryl C. W. O'Shea
snowcrash+spamassassin wrote: now, given John Rudd's comment of > ah, I didnt' know about notfirsthop. That addresses it completely. i still see no instance, % grep -rlni notfirsthop Updates/ % is notfirsthop *necessary*, or just the _right_way_ for that specific example? Nec

Re: spamhaus' PBL is now *active* (in beta ... but still active). now what?

2007-01-06 Thread snowcrash+spamassassin
Specifically, nothing. The updates already include it: updates_spamassassin_org/20_dnsbl_tests.cf:header __RCVD_IN_ZEN eval:check_rbl('zen', 'zen.spamhaus.org.') updates_spamassassin_org/20_dnsbl_tests.cf:header RCVD_IN_XBL eval:check_rbl('zen-lastexternal', 'zen.spamhaus.org.', '127.0.0.[456]')

Re: spamhaus' PBL is now *active* (in beta ... but still active). now what?

2007-01-06 Thread Daryl C. W. O'Shea
snowcrash+spamassassin wrote: i'm asking what *specifically* needs to change, if anything, in SA ... i'd prefer NOT to be blind about it. Specifically, nothing. The updates already include it: updates_spamassassin_org/20_dnsbl_tests.cf:header __RCVD_IN_ZEN eval:check_rbl('zen', 'zen.spamhau

Re: spamhaus' PBL is now *active* (in beta ... but still active). now what?

2007-01-06 Thread snowcrash+spamassassin
run sa-update. i regularly run updates via cron on the hour. running it again, or at all, will change what/where? again, i see no traces of "zen"/"pbl" anywhere other than in my local.cf, atm. i'm asking what *specifically* needs to change, if anything, in SA ... i'd prefer NOT to be blind ab

Re: spamhaus' PBL is now *active* (in beta ... but still active). now what?

2007-01-06 Thread Theo Van Dinter
On Sat, Jan 06, 2007 at 04:48:12PM -0800, snowcrash+spamassassin wrote: > is there something we "normal, non-sa-godlike humans" need to do to > distro (sa, sare, etc) files? or *just* make said mod in our local.cf > rules? run sa-update. -- Randomly Selected Tagline: "Besides, I wasn't envisioni

Re: spamhaus' PBL is now *active* (in beta ... but still active). now what?

2007-01-06 Thread snowcrash+spamassassin
That would be the case if the PBL rule looked like: header RCVD_IN_PBL eval:check_rbl('zen', 'zen.spamhaus.org.', '127.0.0.1[01]') instead of header RCVD_IN_PBL eval:check_rbl('zen-notfirsthop', 'zen.spamhaus.org.', '127.0.0.1[01]') grep'ing in my dist files & rules, t

Re: spamhaus' PBL is now *active* (in beta ... but still active). now what?

2007-01-06 Thread John Rudd
Justin Mason wrote: That would be the case if the PBL rule looked like: header RCVD_IN_PBL eval:check_rbl('zen', 'zen.spamhaus.org.', '127.0.0.1[01]') instead of header RCVD_IN_PBL eval:check_rbl('zen-notfirsthop', 'zen.spamhaus.org.', '127.0.0.1[01]') note "notfirsth

Re: spamhaus' PBL is now *active* (in beta ... but still active). now what?

2007-01-06 Thread Justin Mason
John Rudd writes: > Justin Mason wrote: > > snowcrash+spamassassin writes: > >> reading at the spamhaus site abt PBL i note, > > > > wow dude, that's quick -- I hear it went live only a few hours > > ago ;) > > > >>"WARNING! Some post-delivery filters use "full Received line > >> traversal"

Re: spamhaus' PBL is now *active* (in beta ... but still active). now what?

2007-01-06 Thread snowcrash+spamassassin
wow dude, that's quick -- I hear it went live only a few hours ago ;) i've waited long with baited breath for "[EMAIL PROTECTED]" et. al. to leave me the fsck alone :-) As long as "trusted_networks" and "internal_networks" are configured correctly "correctly" ?! oh heck ... here we go again

Re: spamhaus' PBL is now *active* (in beta ... but still active). now what?

2007-01-06 Thread John Rudd
Justin Mason wrote: snowcrash+spamassassin writes: reading at the spamhaus site abt PBL i note, wow dude, that's quick -- I hear it went live only a few hours ago ;) "WARNING! Some post-delivery filters use "full Received line traversal" or "deep parsing", where the filter reads all

Re: spamhaus' PBL is now *active* (in beta ... but still active). now what?

2007-01-06 Thread Justin Mason
snowcrash+spamassassin writes: > reading at the spamhaus site abt PBL i note, wow dude, that's quick -- I hear it went live only a few hours ago ;) > "WARNING! Some post-delivery filters use "full Received line > traversal" or "deep parsing", where the filter reads all the IPs in > the Rec

spamhaus' PBL is now *active* (in beta ... but still active). now what?

2007-01-06 Thread snowcrash+spamassassin
reading at the spamhaus site abt PBL i note, "WARNING! Some post-delivery filters use "full Received line traversal" or "deep parsing", where the filter reads all the IPs in the Received lines. Legitimate users, correctly sending good mail out through their ISP's smarthost, will have PBL-

Re: BAYES_ tags not appearing, but bayes seems to be set up correctly

2007-01-06 Thread Andy Balaam
Hi Theo, Theo Van Dinter wrote: > Run with -D, or -D bayes, and see what it says. > > Your mail seems to indicate that you're running spamc/spamd, but tried debug > with spamassassin, which may tell you something, or it may not, since > spamassassin != spamd. Thanks for the suggestion - at least

Re: BAYES_ tags not appearing, but bayes seems to be set up correctly

2007-01-06 Thread Theo Van Dinter
On Sat, Jan 06, 2007 at 02:59:40PM +, Andy Balaam wrote: > Any ideas on this, anyone? Thanks, Andy Run with -D, or -D bayes, and see what it says. Your mail seems to indicate that you're running spamc/spamd, but tried debug with spamassassin, which may tell you something, or it may not, since

Re: BAYES_ tags not appearing, but bayes seems to be set up correctly

2007-01-06 Thread Andy Balaam
Any ideas on this, anyone? Thanks, Andy Andy Balaam wrote: > Hi everyone, > > I think I've got everything set up correctly for postfix + spamassassin > spam filtering, but I'm not getting any BAYES_ tags in the emails I am > receiving. I'd appreciate any help you can give me. Thanks in advance.

Re: remove known-postmaster entries from AWL?

2007-01-06 Thread Sander Holthaus
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dan Mahoney, System Admin wrote: > Hey all, > > The subject line says it all. I've got a lot of users complaining > about bounce spam, and while there's an 0.1 scoring "Vbounce" > ruleset, I notice that more often than not "postmaster" scores > somet

Re: [sa-list] Re: DNS timeouts on almost all queries

2007-01-06 Thread Jeff Chan
See if your ISP is rate limiting or denying DNS service for excessive queries. That's if you're using their nameservers of course. Either way you're much better off setting up your own local caching nameserver. Jeff C. -- Jeff Chan mailto:[EMAIL PROTECTED] http://www.surbl.org/