Fremail Plugin Suggestion

2008-06-30 Thread Marc Perkel
I'd like to suggest an additional feature for the freemail plugin. If you test the sending host through FCrDNS and determine that the sending host is a freemail hostname (like google.com) then you should consider it a freemail sender. Thus if the sending host is Google, but the reply-to or an

Re: Fremail Plugin Suggestion

2008-06-30 Thread Henrik K
On Sun, Jun 29, 2008 at 11:37:13PM -0700, Marc Perkel wrote: I'd like to suggest an additional feature for the freemail plugin. If you test the sending host through FCrDNS and determine that the sending host is a freemail hostname (like google.com) then you should consider it a freemail

Re: Fremail Plugin Suggestion

2008-06-30 Thread Marc Perkel
Henrik K wrote: On Sun, Jun 29, 2008 at 11:37:13PM -0700, Marc Perkel wrote: I'd like to suggest an additional feature for the freemail plugin. If you test the sending host through FCrDNS and determine that the sending host is a freemail hostname (like google.com) then you should

Re: Fremail Plugin Suggestion

2008-06-30 Thread mouss
Marc Perkel wrote: Henrik K wrote: On Sun, Jun 29, 2008 at 11:37:13PM -0700, Marc Perkel wrote: I'd like to suggest an additional feature for the freemail plugin. If you test the sending host through FCrDNS and determine that the sending host is a freemail hostname (like google.com)

Re: Fremail Plugin Suggestion

2008-06-30 Thread Henrik K
On Mon, Jun 30, 2008 at 09:21:32AM +0200, mouss wrote: and it may be interesting to look in the body as well. some spam comes from google (infected pc) but shows yahoo and hotmail as contact addresses (the last I have seen has 3 addresses in the body: hotmail.com, yahoo.com and yahoo.cn

SARE Rules problem?

2008-06-30 Thread Arthur Dent
Hello all. I have just upgraded from SA 3.2.4 to 3.2.5 and ran sa-update to get the latest rulesets (which also happens every night via a cronjob). I got the following errors: [EMAIL PROTECTED] ~]# sa-update --channelfile /etc/mail/spamassassin/sare-sa-update-channels.txt --gpgkey 856AA88A

Re: SARE Rules problem?

2008-06-30 Thread Duane Hill
On Mon, 30 Jun 2008, Arthur Dent wrote: Hello all. I have just upgraded from SA 3.2.4 to 3.2.5 and ran sa-update to get the latest rulesets (which also happens every night via a cronjob). I got the following errors: [errors chopped] Stopping spamd:

How to capitalise X-Spam headers?

2008-06-30 Thread mjb-is
This is something that is probably so simple, but I'm tearing my hair out trying to find how to do it. At present I have a header line added as X-Spam-Flag: YES where SA has scored over the threshold. I want this in upper case as X-SPAM-FLAG: YES, rather than lower case X-Spam-Flag: YES The

Re: SARE Rules problem?

2008-06-30 Thread Arthur Dent
On Mon, Jun 30, 2008 at 10:46:13AM +, Duane Hill wrote: On Mon, 30 Jun 2008, Arthur Dent wrote: Hello all. I have just upgraded from SA 3.2.4 to 3.2.5 and ran sa-update to get the latest rulesets (which also happens every night via a cronjob). I got the following errors: [errors

Re: IP country plugin - can we look for two countries?

2008-06-30 Thread McDonald, Dan
On Sat, 2008-06-28 at 01:40 +0200, mouss wrote: mouss wrote: Is there some way to grab the metadata from IPCountry to count the number of countries that were involved in sending a mail, and set a score based on that? you mean catching the Junkman traveller? you can try header

VBounce FPs

2008-06-30 Thread Christopher Bort
Neither of the two messages at http://pastebin.com/m76e8b461 are bounce messages. They're both legitimate messages from the CommuniGate Pro mailing list, yet they both hit ANY_BOUNCE_MESSAGE and BOUNCE_MESSAGE. Comments? -- Christopher Bort [EMAIL PROTECTED] http://www.thehundredacre.net/

Re: VBounce FPs

2008-06-30 Thread Matus UHLAR - fantomas
On 30.06.08 09:55, Christopher Bort wrote: Neither of the two messages at http://pastebin.com/m76e8b461 are bounce messages. They're both legitimate messages from the CommuniGate Pro mailing list, yet they both hit ANY_BOUNCE_MESSAGE and BOUNCE_MESSAGE. Comments? The From: is set to

Re: VBounce FPs

2008-06-30 Thread Christopher Bort
On 06/30/08 10:46, [EMAIL PROTECTED] (Matus UHLAR - fantomas) wrote: On 30.06.08 09:55, Christopher Bort wrote: Neither of the two messages at http://pastebin.com/m76e8b461 are bounce messages. They're both legitimate messages from the CommuniGate Pro mailing list, yet they both hit

Re: IP country plugin - can we look for two countries?

2008-06-30 Thread mouss
McDonald, Dan wrote: On Sat, 2008-06-28 at 01:40 +0200, mouss wrote: mouss wrote: Is there some way to grab the metadata from IPCountry to count the number of countries that were involved in sending a mail, and set a score based on that? you mean catching the Junkman

Re: IP country plugin - can we look for two countries?

2008-06-30 Thread McDonald, Dan
On Mon, 2008-06-30 at 22:04 +0200, mouss wrote: McDonald, Dan wrote: On Sat, 2008-06-28 at 01:40 +0200, mouss wrote: mouss wrote: Is there some way to grab the metadata from IPCountry to count the number of countries that were involved in sending a mail, and set a score

Lots of spam with the following snip

2008-06-30 Thread Steven W. Orr
pGod dag,strong /strong/pspan /span a name=#qppp /abrbr***br Warning!br This letter contains a virus which has beenbr successfully detected and cured. br***br The part that's noteworthy is this: br***br Warning!br This letter contains a virus which has beenbr successfully detected and cured.

Re: Lots of spam with the following snip

2008-06-30 Thread Chris
On Monday 30 June 2008 6:04 pm, Steven W. Orr wrote: pGod dag,strong /strong/pspan /span a name=#qppp /abrbr***br Warning!br This letter contains a virus which has beenbr successfully detected and cured. br***br The part that's noteworthy is this: br***br Warning!br This letter

Re: Lots of spam with the following snip

2008-06-30 Thread Chris
On Monday 30 June 2008 6:04 pm, Steven W. Orr wrote: pGod dag,strong /strong/pspan /span a name=#qppp /abrbr***br Warning!br This letter contains a virus which has beenbr successfully detected and cured. br***br The part that's noteworthy is this: br***br Warning!br This letter

ways to check reason/error of rejected/bounced emails with calling customers

2008-06-30 Thread NGSS
Many of our clients started to have problem sending emails to us after I inserted more strict SA rules . Previously our system was flooded with spams. So I decided to inserted them to the Existing emails. After this the spams had reduced significantly. But I know more worry about false Positive

Spam Rate

2008-06-30 Thread howard chen
Hello, I am new to SA, I have read through some of the faq and wiki, so far can't find the average spam rate % detected by SA. I know it is not the same for everyone, but I want to get the feel of general statistics (If you don't mind to share) 1. How many Spam detection rate if I am using