Re: where does include include from?

2007-10-10 Thread Per Jessen
Per Jessen wrote: > I have spamd running with > > --nouser-config --virtual-config-dir= > > When scanning, it'll pick up 'user_prefs' from , but when I > have an 'include ' in user_prefs, where will it look for ? > I guess an strace will tell me, but I'm amazed that nobody knows where 'include

8bit encoding in mail header by SpamAssassin

2007-10-10 Thread Lars Ippich
Hello list, I actually have problems with mails coming from a server where they already have been checked by SpamAssassin and have been added headers. Amavisd, which I am running on my server, rejects these messages because they are not obeying RFC 2822, which forbids 8bit encoding in mails: Oct

Re: [sa-list] Re: Advice on MTA blacklist

2007-10-10 Thread Dan Mahoney, System Admin
On Wed, 10 Oct 2007, David B Funk wrote: On Tue, 9 Oct 2007, Jo Rhett wrote: On Oct 9, 2007, at 4:22 PM, Chris Edwards wrote: Your server then enforces encryption and SMTP-AUTH, and the SSL will (hopefully) defeat any man-in-the-middle attacks by trans-proxies. That's exactly the problem I

Re: Advice on MTA blacklist

2007-10-10 Thread David B Funk
On Tue, 9 Oct 2007, Jo Rhett wrote: > On Oct 9, 2007, at 4:22 PM, Chris Edwards wrote: > > Your server then enforces encryption and SMTP-AUTH, and the SSL will > > (hopefully) defeat any man-in-the-middle attacks by trans-proxies. > > That's exactly the problem I am reporting. A lot of mail clien

LashBack URL / BL?

2007-10-10 Thread Dave Koontz
Does anyone use the LashBack URL as an MTA BL block or SA rule? I just discovered them and they sound intriguing. Any feedback on their reliability and FP rate would be appreciated. I am a little concerned that I've never heard of them before.. http://www.lashback.com/support/UnsubscribeBlac

Re: [sa-list] RE: Auto-RBL was: Why did this not hit more? (SPF, DKIM, Ironport, X-originating-ip)

2007-10-10 Thread Dan Mahoney, System Admin
On Wed, 10 Oct 2007, Bret Miller wrote: sa-update does NOT feed a local blocklist generated by *my* particular corpus of spam emails. Think of it as the RBL equivalent of sitewide-bayes. Or think of it as a way of SA saying "when I get twelve spams of score 10+ from ip 208.23.118.172...I w

Re: Purpose for SpamAssassin using MySQL

2007-10-10 Thread Michal Jeczalik
On Wed, 3 Oct 2007, Rob Mangiafico wrote: On Tue, 2 Oct 2007, [iso-8859-2] Micha? J?czalik wrote: There are many. It allows you to share data between user accounts (IMHO it doesn't make much sense to have separate bayes databases for each account, at least they are of a 'massive' sort and users

A compound bounce/(spf/dk/dkim) rule I'd like to see.

2007-10-10 Thread Dan Mahoney, System Admin
In pseudocode... IF (message is a recognizable bounce || message is from <>)... AND (we can guess the domain being sent to (can't trust the "to" header, but maybe the X-Envelope-To or some MTA token?) AND the domain being sent TO supports SPF and/or DKIM...(i.e. implying a misdirected bounce

Updated patch on async events handling and DNS lookup completions for SA 3.2.3

2007-10-10 Thread Mark Martinec
I prepared a new version of the async timeout handlings patch for SpamAssassin 3.2.3, to include the more recent feedback and findings on compatibility. The issue is decribed at: http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5589 I would appreciate if anyone is willing to give it a try.

Re: Advice on MTA blacklist

2007-10-10 Thread Jeff Chan
Quoting mouss <[EMAIL PROTECTED]>: > If they really run a "normal" MTA, and if that is authorized by their > ISP, then they should ask to be unlisted. (They should also get a > meaningful reverse DNS so that they can be "identified"). > Otherwise, they should relay via their ISP... Indeed, one o

RE: Auto-RBL was: Why did this not hit more? (SPF, DKIM, Ironport, X-originating-ip)

2007-10-10 Thread Bret Miller
> > sa-update does NOT feed a local blocklist generated by *my* > particular > > corpus of spam emails. Think of it as the RBL equivalent of > > sitewide-bayes. Or think of it as a way of SA saying "when > I get twelve > > spams of score 10+ from ip 208.23.118.172...I will feed the > > auto

Re: Advice on MTA blacklist

2007-10-10 Thread mouss
Leon Kolchinsky wrote: >> Hello, >> >> Which spam blacklists do you use in your MTA config. (postfix) >> smptd_client_restrictions >> >> Currently we only use : reject_rbl_client list.dsbl.org >> >> We let spamassassin fight the rest of the spam. But the load of spam is >> getting to high for our o

Re: Advice on MTA blacklist

2007-10-10 Thread mouss
R.Smits wrote: > Jeff Chan wrote: > >> Quoting Richard Smits <[EMAIL PROTECTED]>: >> >> >>> Thanks for all the advice.. I think we will be using spamhaus. I am >>> running a test and it blocks a lot of spam. Currently I use the >>> sbl.spamhaus and pbl.spamhaus >>> Is this wise, or should I

Re: Advice on MTA blacklist

2007-10-10 Thread Chris Edwards
On Wed, 10 Oct 2007, R.Smits wrote: | We use : sbl-xbl.spamhaus.org now. It does not include the PBL (policy | Block List) | | We serve a big university and we cannot afford False Positives. | I can imagine that someone one the PBL (home user) runs a small | mailserver and cannot connect to our s

RE: Advice on MTA blacklist

2007-10-10 Thread Leon Kolchinsky
> Hello, > > Which spam blacklists do you use in your MTA config. (postfix) > smptd_client_restrictions > > Currently we only use : reject_rbl_client list.dsbl.org > > We let spamassassin fight the rest of the spam. But the load of spam is > getting to high for our organisation. Wich list is saf

Re: Advice on MTA blacklist

2007-10-10 Thread Jeff Chan
Quoting "R.Smits" <[EMAIL PROTECTED]>: > Jeff Chan wrote: > > Quoting Richard Smits <[EMAIL PROTECTED]>: > > > >> Thanks for all the advice.. I think we will be using spamhaus. I am > >> running a test and it blocks a lot of spam. Currently I use the > >> sbl.spamhaus and pbl.spamhaus > >> Is this

Re: Advice on MTA blacklist

2007-10-10 Thread R.Smits
Jeff Chan wrote: > Quoting Richard Smits <[EMAIL PROTECTED]>: > >> Thanks for all the advice.. I think we will be using spamhaus. I am >> running a test and it blocks a lot of spam. Currently I use the >> sbl.spamhaus and pbl.spamhaus >> Is this wise, or should I also use the xbl and switch to zen

Re: header lines being folded into one?

2007-10-10 Thread Mark Martinec
On Tuesday October 9 2007 20:19:36 Loren Wilton wrote: > > To me it looks like a misfeature. > > I think I would agree that it may be a misfeature in the case of this > specific header. In general though it may not be. Consider the case of > two separate Subject: headers, often with completely di

Re: What I want to see in SA RBL support

2007-10-10 Thread Mark Martinec
On Wednesday October 10 2007 09:58:35 John Rudd wrote: > >> I want: > >> use_rbls zen.spamhaus.org list.dsbl.org foo.bar.baz A concept of per-zone settings (not per-rule) would also allow other similar configurations, such as specifying timeouts individually for each zone, allowing to quickly gi

Re: What I want to see in SA RBL support

2007-10-10 Thread John Rudd
Matus UHLAR - fantomas wrote: On 08.10.07 14:56, John Rudd wrote: I see in another thread a discussion about what people want to see in SA RBL support. I thought I'd throw in my $.02. I want a non-binary setting for "use RBLs or not". I want: use_rblszen.spamhaus.org list.dsbl.org

Re: the IT job boarrd spam?

2007-10-10 Thread Matus UHLAR - fantomas
> John D. Hardin wrote: > > > Encoding the entire HTML body in base-64 is terribly > > wasteful given how much it will expand the size of the content. On 10.10.07 09:41, Per Jessen wrote: > I agree, but being wasteful is not a distinctive sign of spam :-( no, but it scores, which is what SA does

Re: the IT job boarrd spam?

2007-10-10 Thread Per Jessen
John D. Hardin wrote: > Encoding the entire HTML body in base-64 is terribly > wasteful given how much it will expand the size of the content. I agree, but being wasteful is not a distinctive sign of spam :-( /Per Jessen, Zürich

Re: What I want to see in SA RBL support

2007-10-10 Thread Matus UHLAR - fantomas
On 08.10.07 14:56, John Rudd wrote: > I see in another thread a discussion about what people want to see in SA > RBL support. I thought I'd throw in my $.02. > > I want a non-binary setting for "use RBLs or not". > I want: > > use_rbls zen.spamhaus.org list.dsbl.org foo.bar.baz AFAIK you

Re: the IT job boarrd spam?

2007-10-10 Thread Per Jessen
Loren Wilton wrote: > Base-64 encoding of HTML strikes me as a little odd. I wonder if it > would make a good spam sign. Outlook uses base64 quite often when the sender uses UTF8. I'm sure it can be changed, but I see HTML+UTF8 and base64 quite frequently from e.g. EU staff. The fact that the

RE: Advice on MTA blacklist

2007-10-10 Thread Jeff Chan
Quoting Skip <[EMAIL PROTECTED]>: > I am not certain how anyone can claim that they have no FPs running through > those services unless they have prior knowledge of every inbound email. > That is impossible. My company deals with on the order of thousands of > companies and multiple times that in

Re: Advice on MTA blacklist

2007-10-10 Thread Jeff Chan
Quoting Richard Smits <[EMAIL PROTECTED]>: > Thanks for all the advice.. I think we will be using spamhaus. I am > running a test and it blocks a lot of spam. Currently I use the > sbl.spamhaus and pbl.spamhaus > Is this wise, or should I also use the xbl and switch to zen.spamhaus? Please do