does MIME_QP_LONG_LINE applies to email headers?

2009-05-18 Thread Gabriel Sosa
Hi all I've been looking on the archives about this but I couldn't find anything about. Any email that goes out trough my server is being marked as spam, one of the reason I see is the email got the MIME_QP_LONG_LINE flag. Reading [1] I've checked my email bodies and all of them looks to be insid

Re: SA: what do SPF_SOFTFAIL SPF_NEUTRAL mean++ThankYou

2009-05-18 Thread Dennis German
Sahil Tandon wrote: On Sun, 17 May 2009, Dennis German wrote: Could someone discuss or add a wiki page about? SPF_SOFTFAIL http://www.openspf.org/RFC_4408#op-result-softfail SPF_NEUTRAL http://www.openspf.org/RFC_4408#op-result-neutral

Re: EmailBL hit count

2009-05-18 Thread LuKreme
On 18-May-2009, at 19:02, Michael Monnerie wrote: I didn't mean that the final result be a FP, just this one ruleset. Shouldn't the goal be to have no FPs and lots of corrects? In a word? No. Test are designed to be cumulative. Something that is seen 75% of the time in spam and 25% of the t

Re: Bombed by PNG spam and spamassassin say its HAM

2009-05-18 Thread LuKreme
On 18-May-2009, at 18:45, Karsten Bräckelmann wrote: Now, what's the proper term for archive in "forum" context rather than mailing lists...? Lame? :D -- Nothing gold can stay -- Robert Frost Stay gold -- Johnny Cade

Re: Another yukky email

2009-05-18 Thread Henrik K
On Mon, May 18, 2009 at 01:19:20PM -0400, Adam Katz wrote: > > On Fri, May 15, 2009 at 06:59:17PM -0400, Adam Katz wrote: > >> score ANY_BOUNCE_MESSAGE0.1 0.1 0.3 0.3 # def: 0.1 > >> score BOUNCE_MESSAGE0.4 0.5 0.9 1.0 # def: 0.1 > >> score VBOUNCE_MESSAGE

Re: EmailBL hit count

2009-05-18 Thread Karsten Bräckelmann
On Tue, 2009-05-19 at 03:02 +0200, Michael Monnerie wrote: > On Sonntag 17 Mai 2009 Yet Another Ninja wrote: > > > That said, I'll implement and test it, and hopefully it's good, > > > with no FPs. > > > > How can score of 0.001 cause a false positive? > > I didn't mean that the final result be a

Re: learning from IMAP spam collection

2009-05-18 Thread Michael Monnerie
On Sonntag 17 Mai 2009 Jari Fredriksson wrote: > >Why is there no mode -L spam -C report to spamc? Could do both at > > once. > > I think -C report does > > a) remove markup > b) sent reports to ALL > c) learn as spam > > All with the same command. Hm. And where would the output without markup go?

Re: learning from IMAP spam collection

2009-05-18 Thread Michael Monnerie
On Sonntag 17 Mai 2009 Chris wrote: > Here's a script I've been using for years now on my imap folders. > Works great. I've left some of the information in so you can see how > it's formated. Reports to Razor, Pyzor, DCC and, if setup, to > Spamcop. > > http://pastebin.com/m39ad4cf9 Thank you Chri

Re: learning from IMAP spam collection

2009-05-18 Thread Michael Monnerie
On Montag 18 Mai 2009 Martin Gregorie wrote: > Switch to using spamc/spamd and this way of using SA is OK. > > Start the spamd daemon as part of your boot sequence. Replace > "spamassassin -d " with "spamc" in your fetchmail command. This way > there's no spamassassin per-message startup overhead.

Re: learning from IMAP spam collection

2009-05-18 Thread Michael Monnerie
On Sonntag 17 Mai 2009 Andrzej Adam Filip wrote: > Do you access the IMAP on the same host/via unecrypted LAN > connection? [Translated: Can you use Net::IMAP::Simple module to > access the folder? Do you use Dovecot IMAP on the same host? No. The spambox is different from the IMAP store, working

Re: learning from IMAP spam collection

2009-05-18 Thread Michael Monnerie
On Sonntag 17 Mai 2009 Rick Macdougall wrote: > Why not use > http://www.sonologic.nl/pub/Projects/ImapSaLearn/imap-sa-learn.pl.txt Oh, looks interesting. But there's comment missing in the header, it says: # Feed mail from an imap mail folder to sa-learn. Options: and then nothing. Are there no

Re: EmailBL hit count

2009-05-18 Thread Michael Monnerie
On Sonntag 17 Mai 2009 Yet Another Ninja wrote: > > I generally like the idea. But this project is in the beginners > > phase, and a whole lot of people will want to wait until others > > report it's benefits. After all, who wishes to put it in production > > and then maybe it causes a lot of FPs?

Re: Bombed by PNG spam and spamassassin say its HAM

2009-05-18 Thread Karsten Bräckelmann
On Mon, 2009-05-18 at 17:01 -0700, John Hardin wrote: > On Mon, 18 May 2009, an anonymous Nabble user wrote: > > > 2) and i reject all emails with png image files (body containing: > > Content-Type: image/png;) > > That's a little harsh by itself. Agreed, definitely. Makes one wonder if he knows

Re: Bombed by PNG spam and spamassassin say its HAM

2009-05-18 Thread John Hardin
On Mon, 18 May 2009, fatuglymoomoo wrote: 2) and i reject all emails with png image files (body containing: Content-Type: image/png;) That's a little harsh by itself. conclusion:- i think emails with only a PNG are 99.999% spam We agree, and we've posted some rules that check for that. It

Re: Bombed by PNG spam and spamassassin say its HAM

2009-05-18 Thread fatuglymoomoo
Hi, I am using account level filtering thru CPANEL. Check if you have similar functions at your admin level for your mail server 1) I currently sieve out emails with subject containing words with sexual references 2) and i reject all emails with png image files (body containing: Content-Type: im

Re: EmailBl Stats

2009-05-18 Thread Jason Haar
Well since we're all doing show-and-tell, so far in the past 24 hours 2310 email have triggered the EMAILBL* rules, of which (with the default 0.5 score) 70 were FN i.e. if I increased the score to 2, all those 70 would have been marked as spam (and I checked: they were spam) -- Cheers Jason Ha

Re: EmailBl Stats

2009-05-18 Thread DAve
Karsten Bräckelmann wrote: On Mon, 2009-05-18 at 10:50 -0400, DAve wrote: I will see about the update, for now the last five days stats are as follows. Total mail through SA = 208,498 Total spam messages tagged with EMAILBL = 1471 Total non spam messages tagged with EMAILBL = 128 What exactl

Re: EmailBl Stats

2009-05-18 Thread Karsten Bräckelmann
On Mon, 2009-05-18 at 10:50 -0400, DAve wrote: > I will see about the update, for now the last five days stats are as > follows. > > Total mail through SA = 208,498 > Total spam messages tagged with EMAILBL = 1471 > Total non spam messages tagged with EMAILBL = 128 What exactly are these? > FP

Re: I want MORE SPAM - MORE SPAM

2009-05-18 Thread Adam Katz
Rob McEwen wrote: > For example, in my own spam filtering, I recently started seeing > far too many FPs where legit hand-typed messages were hit on by two > of the DNSBLs I mentioned above (not talking about hostkarma, btw). > I had each of them scoring "below threshold"--but both together had > a

Re: Another yukky email

2009-05-18 Thread Adam Katz
> On Fri, May 15, 2009 at 06:59:17PM -0400, Adam Katz wrote: >> score ANY_BOUNCE_MESSAGE0.1 0.1 0.3 0.3 # def: 0.1 >> score BOUNCE_MESSAGE0.4 0.5 0.9 1.0 # def: 0.1 >> score VBOUNCE_MESSAGE 0.4 0.5 0.9 1.0 # def: 0.1 >> >> header __VACATION Subj

Re: I want MORE SPAM - MORE SPAM

2009-05-18 Thread Rob McEwen
Aaron Wolfe wrote: > +1 for the invaluement lists. they are excellent, sad that they > aren't listed in that comparison. we seem to get better results with > barracuda than you've seen, many of our clients choose to use the > barracuda list to block. we offer the hostkarma lists as well but > pr

Re: EmailBl Stats

2009-05-18 Thread Steve Freegard
Henrik K wrote: > On Sat, May 16, 2009 at 08:25:58AM -0500, Chris wrote: >> Started running the plug-in Thursday and though I don't get much spam a >> day I am getting hits: >> >> Ham: 232 >> Spam: 113 >> (thats a total count since 3 May) >> >> EmailBL.cf: >> Rule Name Score Ha

Re: I want MORE SPAM - MORE SPAM

2009-05-18 Thread Marc Perkel
Aaron Wolfe wrote: +1 for the invaluement lists. they are excellent, sad that they aren't listed in that comparison. we seem to get better results with barracuda than you've seen, many of our clients choose to use the barracuda list to block. we offer the hostkarma lists as well but probab

Re: I want MORE SPAM - MORE SPAM

2009-05-18 Thread Marc Perkel
Chris Owen wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On May 18, 2009, at 10:36 AM, DAve wrote: Those results differ wildly with my stats over the past year. Barracuda throws far too many FP for me to use on the MTA, I have to use it in SA and let the better tests pull the score u

Re: An SMTP transaction, SpamAssassin interface

2009-05-18 Thread Mark Martinec
Mike, > One of SpamAssassins weaknesses is that it only has access to the > message body of the email. It can't create rules to detect certain > behaviours of the connecting host during delivery. [...] > I was thinking along the lines of an interface where the mta connects to > SpamAssassin when a

Re: I want MORE SPAM - MORE SPAM

2009-05-18 Thread Aaron Wolfe
On Mon, May 18, 2009 at 11:36 AM, DAve wrote: > Marc Perkel wrote: >> >> Hi Everyone, >> >> My blacklist hostkarma.junkemailfilter.com is rising in the charts. Here's >> a blacklist comparison chart. >> >> http://www.sdsc.edu/~jeff/spam/cbc.html >> > > Those results differ wildly with my stats ove

Re: I want MORE SPAM - MORE SPAM

2009-05-18 Thread Chris Owen
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On May 18, 2009, at 10:36 AM, DAve wrote: Those results differ wildly with my stats over the past year. Barracuda throws far too many FP for me to use on the MTA, I have to use it in SA and let the better tests pull the score up to tagging leve

Re: I want MORE SPAM - MORE SPAM

2009-05-18 Thread DAve
Marc Perkel wrote: Hi Everyone, My blacklist hostkarma.junkemailfilter.com is rising in the charts. Here's a blacklist comparison chart. http://www.sdsc.edu/~jeff/spam/cbc.html Those results differ wildly with my stats over the past year. Barracuda throws far too many FP for me to use on

Re: I want MORE SPAM - MORE SPAM

2009-05-18 Thread John Hardin
On Mon, 18 May 2009, Marc Perkel wrote: And to sweaten the deal, ...ew! -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 -

I want MORE SPAM - MORE SPAM

2009-05-18 Thread Marc Perkel
Hi Everyone, My blacklist hostkarma.junkemailfilter.com is rising in the charts. Here's a blacklist comparison chart. http://www.sdsc.edu/~jeff/spam/cbc.html So - I want to be #1. I want more spam. And you can lost some of your spam at the same time. All you have to do to help out is add a n

Re: EmailBl Stats

2009-05-18 Thread Art Greenberg
I installed the plugin last Tuesday. As of this morning (using the original domain list): Total Messages Processed: 2933 Number identified as spam: 2464 Total number tagged by EMAILBL: 7 Number of FNs tagged by EMAILBL: 2 The two FNs scored a 3. So if EMAILBL had enough weight, SA would have c

Re: EmailBl Stats

2009-05-18 Thread DAve
Henrik K wrote: On Sat, May 16, 2009 at 08:25:58AM -0500, Chris wrote: Started running the plug-in Thursday and though I don't get much spam a day I am getting hits: Ham: 232 Spam: 113 (thats a total count since 3 May) EmailBL.cf: Rule Name Score Ham Spam %of Ham %of

Re: Another yukky email

2009-05-18 Thread Matus UHLAR - fantomas
On 18.05.09 16:21, Matus UHLAR - fantomas wrote: > And someone apparently played with cores since: oh, disregard that one, I've mismatched the scores. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovan

Re: Another yukky email

2009-05-18 Thread Matus UHLAR - fantomas
> Jeremy Morton said: > > As you can see I've effectively disabled the BAYES_00 rule as it's giving > > false credit to a ton of backscatter crud messages, but is there really a > > way to block these kinds of backscatter? Is my Bayesian filtering screwed > > up? What score does your SA insta

Re: [spamassassin-users] shortcircuit

2009-05-18 Thread b-sub-sal
On Mon, 18 May 2009, John Hardin wrote: > On Mon, 18 May 2009, b-sub-...@rope.net wrote: > > > body SA1/dear friend/i > > describe SA1SA - dear friend > > score SA1 13 > > # Score of 12 is enough to classify as spam > > Poison Pill rules are generally a ba

Re: [spamassassin-users] shortcircuit

2009-05-18 Thread John Hardin
On Mon, 18 May 2009, b-sub-...@rope.net wrote: body SA1/dear friend/i describe SA1SA - dear friend score SA1 13 # Score of 12 is enough to classify as spam Poison Pill rules are generally a bad idea. If you _truly_ want to implement them, there are be

Re: Another yukky email

2009-05-18 Thread Mark Loeser
Jeremy Morton said: > As you can see I've effectively disabled the BAYES_00 rule as it's giving > false credit to a ton of backscatter crud messages, but is there really a > way to block these kinds of backscatter? Is my Bayesian filtering screwed > up? What score does your SA install give fo

Re: learning from IMAP spam collection

2009-05-18 Thread Martin Gregorie
On Sun, 2009-05-17 at 19:11 -0600, LuKreme wrote: > On 17-May-2009, at 01:42, Michael Monnerie wrote: > > fetchmail -asnp IMAP --folder autolearn --user $username -m "formail > > -s > > |spamassassin -d >>/tmp/x" $mailserver > Switch to using spamc/spamd and this way of using SA is OK. Start t

Re: Some strange results between spamd and spamc

2009-05-18 Thread Karsten Bräckelmann
On Sun, 2009-05-17 at 22:50 -0400, Matt Kettler wrote: > Pieter De Wit wrote: > > Here is the weird part - some mail comes up as spam when I hand it over to > > spamd, but if I take the archive file and strip the header (EHLO etc) out, > > save it it gets a MUCH lower score - I am talking 5.7/5.0

Re: whitelist spam scoring

2009-05-18 Thread Karsten Bräckelmann
On Mon, 2009-05-18 at 00:17 -0700, an anonymous Nabble user wrote: > Hello, > Although I have such a record > > whitelist_from *...@domain.com > > It's like someone sends a message with domain.com goes to address spam. > How to set a higher priority for the white list? The answer to that

whitelist spam scoring

2009-05-18 Thread vibi
Hello, Although I have such a record whitelist_from *...@domain.com It's like someone sends a message with domain.com goes to address spam. How to set a higher priority for the white list? -- View this message in context: http://www.nabble.com/whitelist-spam-scoring-tp23592265p235922