Re: Looking for hosts to white list

2008-04-23 Thread Henrik K
On Tue, Apr 22, 2008 at 09:38:13PM -0400, James Pratt wrote: -Original Message- From: Michael Scheidell [mailto:[EMAIL PROTECTED] Sent: Tuesday, April 22, 2008 9:00 PM To: spamassassin-users Subject: Re: Looking for hosts to white list I don't know if you noticed but I'm

Re: Looking for hosts to white list

2008-04-23 Thread Henrik K
On Tue, Apr 22, 2008 at 07:50:33PM -0700, Marc Perkel wrote: What I'm looking to do with host name base white lists is use forward confirmed RDNS to keep certian domain from being accidentally blacklisted. What's funny is that you already mentioned this a bunch of times, but it seems people

mass bounced emails

2008-04-23 Thread Obantec Support
Hi Running SA3.2.3 but seeing a lot of bounced emails being sent to my customers. (not emails they are sending out but faked returns) various subjects From: [EMAIL PROTECTED] (Mail Delivery System) Subject: Undelivered Mail Returned to Sender From: [EMAIL PROTECTED] Subject: Delivery Status

Re: mass bounced emails

2008-04-23 Thread Matus UHLAR - fantomas
On 23.04.08 08:42, Obantec Support wrote: Running SA3.2.3 but seeing a lot of bounced emails being sent to my customers. (not emails they are sending out but faked returns) various subjects From: [EMAIL PROTECTED] (Mail Delivery System) Subject: Undelivered Mail Returned to Sender

Re: Looking for hosts to white list

2008-04-23 Thread Rob McEwen
Henrik K wrote: What's funny is that you already mentioned this a bunch of times, but it seems people ignore you, since they didn't seem to get it. ;) While Marc is a bit eccentric, it would be nice to see what would be the result if someone actually worked with him to better the stuff. How

RE: Looking for hosts to white list

2008-04-23 Thread James Pratt
-Original Message- From: Henrik K [mailto:[EMAIL PROTECTED] Sent: Wednesday, April 23, 2008 2:45 AM To: users@spamassassin.apache.org Subject: Re: Looking for hosts to white list On Tue, Apr 22, 2008 at 09:38:13PM -0400, James Pratt wrote: -Original Message- From:

Re: Looking for hosts to white list

2008-04-23 Thread Benny Pedersen
On Wed, April 23, 2008 02:03, Theo Van Dinter wrote: fwiw, generally speaking, a uribl whitelist is just a list of domains that shouldn't be blacklisted. it does not imply a list of domains that should be considered non-spam and therefore gain negative points from SA via some

FROM_LOCAL_HEX fps

2008-04-23 Thread Joseph Brennan
I noticed that FROM_LOCAL_HEX scores more often on legit mail than on spam. Specifically it hits on Myspace invitations and some type of group mail from Gmail, which are both common. It also hits on a few verp sender addresses from random sites that appear to be legit, and verp may become

Re: Looking for hosts to white list

2008-04-23 Thread Marc Perkel
Henrik K wrote: On Tue, Apr 22, 2008 at 07:50:33PM -0700, Marc Perkel wrote: What I'm looking to do with host name base white lists is use forward confirmed RDNS to keep certian domain from being accidentally blacklisted. What's funny is that you already mentioned this a bunch of

Re: FROM_LOCAL_HEX fps

2008-04-23 Thread Matus UHLAR - fantomas
On 23.04.08 09:27, Joseph Brennan wrote: I noticed that FROM_LOCAL_HEX scores more often on legit mail than on spam. Specifically it hits on Myspace invitations and some type of group mail from Gmail, which are both common. It also hits on a few verp sender addresses from random sites that

Re: Looking for hosts to white list

2008-04-23 Thread Justin Mason
Marc Perkel writes: Yep - one of the ideas I originated here is this list is the idea of blocking spam based on linking to spam sites. It took almost 1 1/2 tears of talking about it before others picked up on the idea and turned it into URI blacklists. If you can find old message from around

Re: Looking for hosts to white list

2008-04-23 Thread Jon Armitage
Justin Mason wrote: sorry Marc, you weren't the first to come up with that idea. He didn't say that he was, just that he was the first to raise it on the list. Jon

Re: Looking for hosts to white list

2008-04-23 Thread Marc Perkel
Jon Armitage wrote: Justin Mason wrote: sorry Marc, you weren't the first to come up with that idea. He didn't say that he was, just that he was the first to raise it on the list. Jon It may have been 2001. But at the time I remember saying that all spam wants you to do something

RE: Looking for hosts to white list

2008-04-23 Thread Chris Santerre
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: 2008-04-23 10:48 To: Marc Perkel Cc: users@spamassassin.apache.org Subject: Re: Looking for hosts to white list Marc Perkel writes: Yep - one of the ideas I originated here is this list is the idea

Re: Looking for hosts to white list

2008-04-23 Thread Marc Perkel
Chris Santerre wrote: -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: 2008-04-23 10:48 To: Marc Perkel Cc: users@spamassassin.apache.org Subject: Re: Looking for hosts to white list Marc Perkel writes: Yep - one of the ideas I originated here is

how to confirm that compiled rules are being used

2008-04-23 Thread Chris Hoogendyk
So, when I used sa-update to grab additional rule sets, I could tell they were being used by scanning my mail logs for references to them. Yup, they're hitting. Now, I have sa-compile implemented. I understand that spamassassin automatically sees alternate rules and uses them rather than the

Re: Looking for hosts to white list

2008-04-23 Thread Adam Stephens
Henrik K wrote: Marc Perkel. Marc is a leader in the spam filtering industry and was behind Has/Does anyone use his sa rules he has posted on his site? if so how, how was the accuracy? http://marc.info/?l=spamassassin-usersm=120611144819910w=2 I tried the hostkarma lists,

Re: Re: Looking for hosts to white list

2008-04-23 Thread Dallas Engelken
Benny Pedersen wrote: On Tue, April 22, 2008 23:47, Marc Perkel wrote: I'm looking for people who are running URI blacklists, but I'm more interested in your whitelist information. I have an extensive list myself and looking for partners to swap data with. but uribl.com have a hidded

Sudden VBounce-Evading Backscatter Upsurge

2008-04-23 Thread Carlo Graziani
Dear Spamassassin Users list: I'm running version 3.2.4. A couple of weeks ago, in response to a blowback storm, I turned on the VBounce ruleset, setting whitelist_bounce_relays as described on the wiki. I filtered ANY_BOUNCE_MESSAGE to its own folder, so I could keep an eye on it. This

RE: Looking for hosts to white list

2008-04-23 Thread Robert - elists
Snip If anyone has tested HostKarma already... and found it promising, but a little lacking... I suggest testing it again. It is even better now. In fact, most DNSBLs do not suddenly come on the scene perfect. Most have had MUCH growing pains. Therefore, all newer DNBSLs shouldn't

Re: Looking for hosts to white list

2008-04-23 Thread Marc Perkel
Robert - elists wrote: Snip If anyone has tested HostKarma already... and found it promising, but a little lacking... I suggest testing it again. It is even better now. In fact, most DNSBLs do not suddenly come on the scene perfect. Most have had MUCH growing pains. Therefore,

Re: can we make AWL ignore mail from self to self?

2008-04-23 Thread Matt Kettler
Jo Rhett wrote: Matt Kettler wrote: There's nothing in trusted networks, I don't trust anything... Jo, that's impossible in spamassasin. You cannot have an empty trust, it doesn't make any logical sense, and would cause spamassassin to fail miserably. I should rather have said trust is

RE: Looking for hosts to white list

2008-04-23 Thread Robert - elists
Yes Marc Please start a JMF general support maillist for those that want to be part of it. Make sure it cannot become a spam forum in itself and is truly opt in with verify I highly suggest that you post to it frequently, before any major or minor changes to JMF hardware or software

Extra long domain names rule?

2008-04-23 Thread Bookworm
I'm starting to see some new phishing/scam attempts. What I was thinking was that it might be worthwhile to add a rule to not so much check links, but count periods. I was going to put in the web address that I received as an example, but I think that's why this is a second attempt - the

MIME_BASE64_TEXT FPs growing

2008-04-23 Thread Jason Haar
Hi there I'm getting more and more valid email from Windows environments that have been totally encoded in BASE64. Mixtures of Unicode and forwarding/replying seems to trigger things like Exchange to just re-encode the whole thing as Base64. Looking through our logs I can see a fair amount