Re: Implementing SPF

2008-12-30 Thread Bijayant
>From all the discussions and reading all the replies in this thread I have understood many things like 1) We use smtp-auth for sending the mails. So, I can reject all mails which are not generating from my mail server, right? This will be a good tactics. Now the SPF parts, 2) If the SPF records i

Re: Implementing SPF

2008-12-30 Thread Bijayant
>From all the discussions and reading all the replies in this thread I have understood many things like 1) We use smtp-auth for sending the mails. So, I can reject all mails which are not generating from my mail server, right? This will be a good tactics. Now the SPF parts, 2) If the SPF records i

Re: what did fail?

2008-12-30 Thread Luis Daniel Lucio Quiroz
Ja tanks befor make rules, i've forgotten to use sa-update :-D Let us try this first. LD On Tuesday 30 December 2008 18:54:42 John Hardin wrote: > On Tue, 30 Dec 2008, John Hardin wrote: > > You might make a rule for that type of URI obfuscation. Start with: > > > > body URI_OBFU_ES /\w{5,30}\s

Re: what did fail?

2008-12-30 Thread Luis Daniel Lucio Quiroz
Yes, Pyzor and DCC are working well. On Tuesday 30 December 2008 19:28:49 Matus UHLAR - fantomas wrote: > On 30.12.08 17:41, Luis Daniel Lucio Quiroz wrote: > > After stunning and stopping spam I got that this email was not mark as > > spam: I wonder to know what test should I turn on to stop it.

Re: what did fail?

2008-12-30 Thread Matus UHLAR - fantomas
On 30.12.08 17:41, Luis Daniel Lucio Quiroz wrote: > After stunning and stopping spam I got that this email was not mark as spam: > I wonder to know what test should I turn on to stop it. have you enabled network checks like razor, dcc, uridnsbl? Do they work? -- Matus UHLAR - fantomas, uh...@fan

Re: Blocking sender spoofing [Was: Implementing SPF]

2008-12-30 Thread mouss
Kai Schaetzl a écrit : >> good planning is >> needed > > This is a platitude. In theory, yes. In practice, not always... > And I don't mean that rude. > > Kai >

Re: what did fail?

2008-12-30 Thread John Hardin
On Tue, 30 Dec 2008, John Hardin wrote: You might make a rule for that type of URI obfuscation. Start with: body URI_OBFU_ES /\w{5,30}\s{,10}\(punto\)\s{,10}(?:com|net|org|info)/i Oops. Try: body URI_OBFU_ES /\w{5,30}\s{0,10}\(punto\)\s{0,10}(?:com|net|org|info)/i -- John Hardin KA7OHZ

Re: what did fail?

2008-12-30 Thread John Hardin
On Tue, 30 Dec 2008, Luis Daniel Lucio Quiroz wrote: After stunning and stopping spam I got that this email was not mark as spam: I wonder to know what test should I turn on to stop it. X-Spam-Status: No, score=0.6 required=3.0 tests=BAYES_40,L_P0F_UNKN BAYES_40? Review your bayes training (

Re: Blocking sender spoofing [Was: Implementing SPF]

2008-12-30 Thread Kai Schaetzl
> good planning is > needed This is a platitude. And I don't mean that rude. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com

what did fail?

2008-12-30 Thread Luis Daniel Lucio Quiroz
After stunning and stopping spam I got that this email was not mark as spam: I wonder to know what test should I turn on to stop it. TIA Return-Path: X-Original-To: dlu...@okay.com.mx Delivered-To: dlu...@okay.com.mx Received: from soekris.okay.com.mx (soekris [192.168.203.18]) by ferna

Re: workaround for DNS "search service"

2008-12-30 Thread Blaine Fleming
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Arvid Ephraim Picciani wrote: >> By any chance, didn't your ISP start "providing search service" for any >> web name that does not exist? > > btw, whats the workaround for this? opendns didnt work for me as they have > similar "features". > do you

Re: Blocking sender spoofing [Was: Implementing SPF]

2008-12-30 Thread mouss
Kai Schaetzl a écrit : > Mouss wrote on Tue, 30 Dec 2008 19:01:12 +0100: > >> the problem is > > Frankly, problems are there to be overcome. It depends on what is more > painful, the current implementation or the way to change it. > I am not saying one shouldn't do it. just saying that good pl

Re: Blocking sender spoofing [Was: Implementing SPF]

2008-12-30 Thread Matus UHLAR - fantomas
> On Tue, 2008-12-30 at 13:38 +, Ned Slider wrote: > > Restrict $mynetworks to only allow 127.0.0.0/8 so anyone *not* on > > localhost *has* to authenticate. On 30.12.08 19:32, ram wrote: > And what if your Boss ( or your client ) yells at you , "How dare my > mails get rejected at your ser

Re: workaround for DNS "search service"

2008-12-30 Thread Matus UHLAR - fantomas
> >By any chance, didn't your ISP start "providing search service" for any > >web name that does not exist? On 29.12.08 15:14, Arvid Ephraim Picciani wrote: > btw, whats the workaround for this? opendns didnt work for me as they have > similar "features". > do you simply query the bl's dns s

Re: Blocking sender spoofing [Was: Implementing SPF]

2008-12-30 Thread Kai Schaetzl
Mouss wrote on Tue, 30 Dec 2008 19:01:12 +0100: > the problem is Frankly, problems are there to be overcome. It depends on what is more painful, the current implementation or the way to change it. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.cona

Re: Blocking sender spoofing [Was: Implementing SPF]

2008-12-30 Thread mouss
Kai Schaetzl a écrit : > Ram wrote on Tue, 30 Dec 2008 19:32:16 +0530: > >> "I always used my Outlook > > and Outlook always supported SMTP AUTH. Even grandgrandmothers can use it. > It's a standard procedure. So, please stop exaggerating. > the problem is that users have long forgotten, how t

Re: humour [Was: FW by mailer-dae...@apache.org : failure notice]

2008-12-30 Thread Michelle Konzack
Am 2008-12-30 14:01:53, schrieb mouss: > I was tempted to CC both of you "for once" :-) It would be bounded back to you... > happy (holidays|xmas|$whateveryouwant) everybody! Fröhliche Ostern, Pfingsten, Sommerferien Herbstferien Winterferien... Thanks, Greetings and nice Day/Evening Michel

Re: From: and To: Spamers

2008-12-30 Thread Michelle Konzack
Am 2008-12-29 20:39:46, schrieb ram: > You could reject mailfrom your domain at the MTA (if your real mail > never arrives there ) Unfortunately this does not work for me. > One of the other ways is set up an SPF record and give a high score for > SPF-FAIL for your domain, that is what I do and

Re: From: and To: Spamers

2008-12-30 Thread Michelle Konzack
Hello Sahil, Am 2008-12-29 17:59:09, schrieb Sahil Tandon: > id=EQUAL_001; action=REJECT sender is recipient; sender==$$recipient I will forward this line to my Hosting Provider, since the postfix is out of my control. Thanks, Greetings and nice Day/Evening Michelle Konzack Systemadmini

Re: Blocking sender spoofing [Was: Implementing SPF]

2008-12-30 Thread Kai Schaetzl
Ram wrote on Tue, 30 Dec 2008 19:32:16 +0530: > "I always used my Outlook and Outlook always supported SMTP AUTH. Even grandgrandmothers can use it. It's a standard procedure. So, please stop exaggerating. > And Worse, there are still some archaic smtp relay servers in use that > dont support

Re: SAGrey plugin...when?

2008-12-30 Thread Luis Daniel Lucio Quiroz
OK, So this means my SPAM grade should be 1.0+ because of this. For an enterprise with non-tech users do you recomend this? On Tuesday 30 December 2008 02:23:12 Benny Pedersen wrote: > On Tue, December 30, 2008 01:34, Luis Daniel Lucio Quiroz wrote: > > After reading how SAGrey plug works, I w

Re: Implementing SPF

2008-12-30 Thread Martin Gregorie
On Tue, 2008-12-30 at 15:36 +0100, Arvid Ephraim Picciani wrote: > On Tuesday 30 December 2008 12:44:09 Bijayant wrote: > > Hi, > > > > I am a newbie so please excuse me if its a very silly question. I have been > > searching the forums and Internet about my query but could not found > > satisfacto

Re: Implementing SPF

2008-12-30 Thread Arvid Ephraim Picciani
On Tuesday 30 December 2008 12:44:09 Bijayant wrote: > Hi, > > I am a newbie so please excuse me if its a very silly question. I have been > searching the forums and Internet about my query but could not found > satisfactory answer. I am using Postfix+amavisd-new+spam-assassin on my > mail server.

Re: Blocking sender spoofing [Was: Implementing SPF]

2008-12-30 Thread ram
On Tue, 2008-12-30 at 13:38 +, Ned Slider wrote: > ram wrote: > > On Tue, 2008-12-30 at 04:11 -0800, Bijayant wrote: > >> Thanks, but I do not want to reject those mails. > > Why not? > > I agree - this is by far the simplest method of tackling this problem. > SPF is meant as a mechanism f

Re: Blocking sender spoofing [Was: Implementing SPF]

2008-12-30 Thread mouss
Bijayant a écrit : >> >> It means that if the mails are not SPAM it will not add the headers or it >> will not check for SPF. it will always add SPF headers when appropriate. this has nothing to do with the fact that the message is spam or not. The message that I am replying to has: X-Spam-Statu

Re: Blocking sender spoofing [Was: Implementing SPF]

2008-12-30 Thread Ned Slider
ram wrote: On Tue, 2008-12-30 at 04:11 -0800, Bijayant wrote: Thanks, but I do not want to reject those mails. Why not? I agree - this is by far the simplest method of tackling this problem. SPF is meant as a mechanism for *others* to block mail spoofed from your domain. The only reaso

Re: Blocking sender spoofing [Was: Implementing SPF]

2008-12-30 Thread ram
On Tue, 2008-12-30 at 04:11 -0800, Bijayant wrote: > Thanks, but I do not want to reject those mails. Why not? The only reason I see is that legitimate senders also send to the same mail server. Get them to use smtp-auth and send the messages. (I know its easier said than done ) > I wan

Re: Blocking sender spoofing [Was: Implementing SPF]

2008-12-30 Thread Benny Pedersen
On Tue, December 30, 2008 14:00, Bijayant wrote: >> To insert SPF headers so that SA can understand that it has to >> apply SPF tests. no you must NOT insert any header at all in mta all you need to do is tell spamassassin what envelope header your mta use for postfix i do this put this in a f

Re: Serious problem with scores file for todays rule update?

2008-12-30 Thread Michael Alan Dorman
On Tue, 30 Dec 2008 09:55:52 + "Justin Mason" wrote: > Does the sa-compile step complete with an exit code of 0? If there > are problems with re2c (which has happened in the past) it should exit > with !=0. There were no errors visible in the output, but the script I was using to do the upd

Re: Blocking sender spoofing [Was: Implementing SPF]

2008-12-30 Thread Bijayant
mouss-2 wrote: > > Bijayant a écrit : >> Thanks, but I do not want to reject those mails. > > you can replace "REJECT" with "PREPEND X-Suspected: blah blah" and use > this in an SA rule. but it looks like you really want SPF ;-p > >> I want only some scores to be added if it fails the SPF te

Re: Blocking sender spoofing [Was: Implementing SPF]

2008-12-30 Thread mouss
Bijayant a écrit : > > But if a genuine sender who does not have SPF records might gets blocked, > right? Or I misunderstood something. the config I posted blocks mail claiming to be from _your_ domain. it has nothing to do with SPF. I don't implement SPF and the checks won't block me. >> >> I a

humour [Was: FW by mailer-dae...@apache.org : failure notice]

2008-12-30 Thread mouss
Benny Pedersen a écrit : > On Tue, December 30, 2008 13:33, Michelle Konzack wrote: > > lets top post for once, hope postmasters is not on vacation here :) > I was tempted to CC both of you "for once" :-) happy (holidays|xmas|$whateveryouwant) everybody!

Re: Blocking sender spoofing [Was: Implementing SPF]

2008-12-30 Thread Bijayant
Benny Pedersen wrote: > > > On Tue, December 30, 2008 13:11, Bijayant wrote: >> Thanks, but I do not want to reject those mails. > > but you should > > But if a genuine sender who does not have SPF records might gets blocked, > right? Or I misunderstood something. > >> I want only some scor

Re: Blocking sender spoofing [Was: Implementing SPF]

2008-12-30 Thread mouss
Bijayant a écrit : > Thanks, but I do not want to reject those mails. you can replace "REJECT" with "PREPEND X-Suspected: blah blah" and use this in an SA rule. but it looks like you really want SPF ;-p > I want only some scores to be added if it fails the SPF test. > So, should I have to config

Re: FW by mailer-dae...@apache.org : failure notice

2008-12-30 Thread Benny Pedersen
On Tue, December 30, 2008 13:33, Michelle Konzack wrote: lets top post for once, hope postmasters is not on vacation here :) > Hello *, > > I have tried to contact the listmaster or owner of this list but > without > success... > > Whenever I write to the list, I get messages like the attached o

FW by mailer-dae...@apache.org : failure notice

2008-12-30 Thread Michelle Konzack
Hello *, I have tried to contact the listmaster or owner of this list but without success... Whenever I write to the list, I get messages like the attached one back. This is a result of a missconfigured M$ Server and the offending E-Mail is Can someone unsubscribe this gui? Any message I send

Re: Blocking sender spoofing [Was: Implementing SPF]

2008-12-30 Thread Benny Pedersen
On Tue, December 30, 2008 13:11, Bijayant wrote: > Thanks, but I do not want to reject those mails. but you should > I want only some scores to be added if it fails the SPF test. default in spamassassin if spf fails, you can add more to the default score if you want it, but spf fails mail mostl

Re: Blocking sender spoofing [Was: Implementing SPF]

2008-12-30 Thread Bijayant
Thanks, but I do not want to reject those mails. I want only some scores to be added if it fails the SPF test. So, should I have to configure postfix also for this settings. mouss-2 wrote: > > Bijayant a écrit : >> Hi, >> >> I am a newbie so please excuse me if its a very silly question. I hav

Blocking sender spoofing [Was: Implementing SPF]

2008-12-30 Thread mouss
Bijayant a écrit : > Hi, > > I am a newbie so please excuse me if its a very silly question. I have been > searching the forums and Internet about my query but could not found > satisfactory answer. I am using Postfix+amavisd-new+spam-assassin on my mail > server. We get many spam mails from our

Implementing SPF

2008-12-30 Thread Bijayant
Hi, I am a newbie so please excuse me if its a very silly question. I have been searching the forums and Internet about my query but could not found satisfactory answer. I am using Postfix+amavisd-new+spam-assassin on my mail server. We get many spam mails from our own emails. Then we came to kn

Re: white listing sendmail authenticated users

2008-12-30 Thread Justin Mason
On Tue, Dec 30, 2008 at 00:16, John Hardin wrote: > On Mon, 29 Dec 2008, Bazooka Joe wrote: > >> I am trying (unsuccessfully) to write a rule to pickup if the >> "authenticated bits=0" in the Received line of the header and give it >> -100 >> >> Does anyone know if that works? Or a better way to d

Re: Serious problem with scores file for todays rule update?

2008-12-30 Thread Justin Mason
On Mon, Dec 29, 2008 at 23:41, Michael Alan Dorman wrote: > On Mon, 29 Dec 2008 23:21:48 + > j...@jmason.org (Justin Mason) wrote: > >> hmm. What do you have in /var/lib/spamassassin for the scores files? >> they should look like this: >> >> : 183...; ls >> -l /var/lib/spamassassin/3.002006/u

Re: SAGrey plugin...when?

2008-12-30 Thread Benny Pedersen
On Tue, December 30, 2008 01:34, Luis Daniel Lucio Quiroz wrote: > After reading how SAGrey plug works, I wonder to know of you in what > scenarios do you recomed it? amavisd have penpal, spamassassin have sagrey, both do nearly the same, hits random senders for the first email that means if send