Re: Geniuses at expedia.com

> tests=[BAYES_00=0.1, DCC_CHECK=1.5, DCC_REPUT_60_69=0.1, > HTML_MESSAGE=0.001, INVALID_DATE=1.245, > MIME_HTML_ONLY=0.957, NO_REAL_NAME=1, > RELAY_COUNTRY_US=0.001, SARE_OEM_S_PRICE=1, > SPF_SOFTFAIL=1] autolearn=no received:from Why positive score for BAYES_00? It's supposed to mean that the ma

Re: Detecting email from my domain

On Wed, 5 Aug 2009 17:26:08 -0500, Luis Daniel Lucio Quiroz > Well, as far as i am receiving email from my domain to my domain. I dont > want to block it because there are about 10% of email that is okay. I'd like > to know if there is a plug or a rule for SA to give more grade if email comes >

Re: can Spamassassin count recipients?

On Wed, 2009-08-05 at 19:22 -0700, John Hardin wrote: > On Wed, 5 Aug 2009, Chris wrote: > > > On Wed, 2009-08-05 at 12:11 +0200, Tomasz Chmielewski wrote: > > > >> For example, when there are 5-10 recipients, assign 1 point; 11 > >> recipients and more - assign 2 points. > > > > Here's the rule(

Re: can Spamassassin count recipients?

On Wed, 5 Aug 2009, Chris wrote: On Wed, 2009-08-05 at 12:11 +0200, Tomasz Chmielewski wrote: For example, when there are 5-10 recipients, assign 1 point; 11 recipients and more - assign 2 points. Here's the rule(s) I use. They were posted here on the list quite awhile back: describe TO_T

Re: Making this FN correctly scored as spam

On Wed, 2009-08-05 at 19:12 -0500, Chris wrote: > This came to one of my address where what I usually get is 99% spam and > was scored as ham, no matter what I've done I can't get it to score the Without looking at the sample provided... > -0.1 RCVD_IN_JMF_W RBL: JunkEmailFilter: relay i

Re: can Spamassassin count recipients?

On Wed, 2009-08-05 at 12:11 +0200, Tomasz Chmielewski wrote: > Is it possible to count recipients with Spamassassin? > > Some of the spam I receive has multiple recipients in To: and/or CC: > headers, i.e.: > > To: 1...@example.com, 2...@example.com, 3...@example.com > CC: 1...@example.com, 2...

Making this FN correctly scored as spam

http://pastebin.com/m5e126ea This came to one of my address where what I usually get is 99% spam and was scored as ham, no matter what I've done I can't get it to score the minimum +5 points. After learning it as spam with sa-learn and using spamassassin -r to report to razor/pyzor/dcc and removin

Pet photo signatures

This just seems like another good way to sneak spam through: I love to share photos of my cat, but I don't want to choke up the email system with them, esp. if it enables spammers one more avenue to piggyback their crap on.

Re: Detecting email from my domain

On Wed, 5 Aug 2009, Luis Daniel Lucio Quiroz wrote: > Hi SAs, > > Well, as far as i am receiving email from my domain to my domain. I dont want > to block it because there are about 10% of email that is okay. I'd like to > know if there is a plug or a rule for SA to give more grade if email come

Re: Again AWL confusion

On Wed, 05 Aug 2009 10:15:00 +0200 a...@exys.org wrote: > 2 to 5 is the sweetspot. That message in question actually proved it > is working, since the URIBL hits came later. Then it scores >10 so > it gets rejected. I noticed earlier that you were greylisting for only 60s; that seems like a fa

Detecting email from my domain

Hi SAs, Well, as far as i am receiving email from my domain to my domain. I dont want to block it because there are about 10% of email that is okay. I'd like to know if there is a plug or a rule for SA to give more grade if email comes from other ip than MX. TIA LD

Re: Again AWL confusion

On Wed, 2009-08-05 at 22:21 +0200, Matus UHLAR - fantomas wrote: > turning off AWL and autolearn (optionally only when run at SMTP time) would > help you here. Although using such setup you loose much of advantages (like > AWL ;-) and especially personalising... > There are cases where AWL is a m

Re: Again AWL confusion

>> On 05.08.09 00:31, Martin Gregorie wrote: >>> If, for some (very) odd reason you run greylisting after SA then *of >>> course* your host has (a) seen the mail and (b) passed it through SA. >>> How else can the mail get to the greylister? >>> >>> Would you care to explain why you put a greylister

Geniuses at expedia.com

Yes, I now, if you enforce all the RFC's you will not get much spam, but you won't get much email either. Maybe its just me, but I am tired of explaining to clients that the people who write SMTP or WEB APP response type software don't seem to care if their email is formatted correctly or not.

Re: Backscatter.org used as RBL??

Marc Perkel wrote: Backscatter.org is the worst RBL on the planet. If you use it you will get a lot of false positives. Lets compare backscatterer's recommended usage of their list in your favourite MTA against your own recommendation for usage of your hostkarma RBL in your favourite MTA:

Re: Backscatter.org used as RBL??

d.h...@yournetplus.com wrote: Quoting LuKreme : On Aug 4, 2009, at 6:35, d.h...@yournetplus.com wrote: Quoting LuKreme : On 3-Aug-2009, at 18:36, Dennis G German wrote: Is Backscatter.org used by any rules? Pretty sure not. The way to use that

Re: Backscatter.org used as RBL??

If anyone has an example config for sendmail to use the backscatter rbl at smtp time please send it. I take a beating from backscatterers. I would think you could do this with a macro that checks "mail from" and triggers an rbl check on the ip. Sounds simple but my cf skills are barely above trial

Re: Backscatter.org used as RBL??

* Chris Owen : > We've had machines listed in that list that don't even accept email. Still, these can send out backscatter (send only boxes) -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-

Re: Backscatter.org used as RBL??

On Aug 5, 2009, at 11:53 AM, d.h...@yournetplus.com wrote: I wasn't referring to legitimate bounces. I was referring to legitimate messages (non bounce). If I started using the backscatterer.org RBL's at STMP time, guarantee I will get calls and several email messages asking why a message w

Re: Backscatter.org used as RBL??

Quoting LuKreme : On Aug 4, 2009, at 6:35, d.h...@yournetplus.com wrote: Quoting LuKreme : On 3-Aug-2009, at 18:36, Dennis G German wrote: Is Backscatter.org used by any rules? Pretty sure not. The way to use that RBL is as an RBL. Don't accept

Re: Backscatter.org used as RBL??

On Aug 4, 2009, at 6:35, d.h...@yournetplus.com wrote: Quoting LuKreme : On 3-Aug-2009, at 18:36, Dennis G German wrote: Is Backscatter.org used by any rules? Pretty sure not. The way to use that RBL is as an RBL. Don't accept the backscatter in

Re: can Spamassassin count recipients?

Tomasz Chmielewski wrote: > Is it possible to count recipients with Spamassassin? > > Some of the spam I receive has multiple recipients in To: and/or CC: > headers, i.e.: > > To: 1...@example.com, 2...@example.com, 3...@example.com > CC: 1...@example.com, 2...@example.com, 3...@example.com > >

Re: can Spamassassin count recipients?

> Is it possible to count recipients with Spamassassin? > > Some of the spam I receive has multiple recipients in To: > and/or CC: headers, i.e.: > > To: 1...@example.com, 2...@example.com, 3...@example.com > CC: 1...@example.com, 2...@example.com, 3...@example.com > > > I would like to count t

Re: Again AWL confusion

a...@exys.org wrote: > exactly. The point is that scores below 2 are never spam, so i avoid > greylisting. Thats my whitelist (you usually need for greylisting) at > the same time, since i whitelist some hosts in SA. Interesting set-up, although I don't think it would be suitable for a high-volum

can Spamassassin count recipients?

Is it possible to count recipients with Spamassassin? Some of the spam I receive has multiple recipients in To: and/or CC: headers, i.e.: To: 1...@example.com, 2...@example.com, 3...@example.com CC: 1...@example.com, 2...@example.com, 3...@example.com I would like to count the number of reci

Re: [NEW SPAM FLOOD] www.shopXX.net

Good morning *, Am 2009-08-04 13:51:24, schrieb Jason L Tibbitts III: > > "DS" == Dan Schaefer writes: > > DS> I'm glad to see this SPAM traffic has come to a halt. At least on my > DS> mail server... > > Yes, I haven't seen any of those spams since the morning of the 31st. > My servers wer

Re: [NEW SPAM FLOOD] www.shopXX.net

> "DS" == Dan Schaefer writes: DS> I'm glad to see this SPAM traffic has come to a halt. At least on my DS> mail server... Yes, I haven't seen any of those spams since the morning of the 31st. My servers were rejecting them like mad right up until that point in time (10:30CDT), and then noth

Re: Again AWL confusion

Matus UHLAR - fantomas wrote: On 05.08.09 00:31, Martin Gregorie wrote: If, for some (very) odd reason you run greylisting after SA then *of course* your host has (a) seen the mail and (b) passed it through SA. How else can the mail get to the greylister? Would you care to explain why you pu

Re: Network Tests / Rule Files Directories

On 04.08.09 16:39, Stefan Malte Schumacher wrote: > And it seems AWL really is the problem. Here are the relevant passages from > another Email, which only got enough points to be identified as Spam because > it was both in DCC and Razor. > > 5.0 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/

Re: Again AWL confusion

> On Wed, 2009-08-05 at 00:37 +0200, a...@exys.org wrote: > > Matus UHLAR - fantomas wrote: > > > On 04.08.09 20:09, a...@exys.org wrote: > > >> I have obviously never received any mail from that sender, so why does > > >> it hit? > > >> > > > in later mail you mention that you run SA before g