Re: Counting RAZOR2 hits

Hi, > You can also set your min_cf in your razor config files, which will > affect when the RAZOR2_CHECK rule fires. This does work in SpamAssassin, > as I have over-ridden the min_cf on my own system, and have done so for > years. Thanks to everyone for their great ideas thus far. I'm looking fo

HELO_DYNAMIC_IPADDR false positive

The following header line: Received: from static-96-254-126-11.tampfl.fios.verizon.net [96.254.126.11] by windows12.uvault.com with SMTP; Wed, 12 Aug 2009 08:26:40 -0400 Hits the HELO_DYNAMIC_IPADDR rule. I tested it this way: $ perl -le 'if ("static-96-254-126-11.tampfl.fios.veri

Re: Counting RAZOR2 hits

Karsten Bräckelmann wrote: > On Mon, 2009-08-17 at 09:52 +0200, Matus UHLAR wrote: > >> On 15.08.09 14:32, Matt Kettler wrote: >> >>> That means it was found and was above your min_cf. i.e.: Razor believes >>> it is spam. >>> >> There's no min_cf gor RAZOR and there's no public hitco

Re: [Solved] Bad performance of Bayes with MySQL cluster

On Tue, 18 Aug 2009, Jorn Argelo wrote: For the sake of the KISS concept I decided to scrap the multi-master replication and made it a master-slave setup only, where all 3 boxes point to one master. Then the slave is present as a backup server only. I was expecting to need 2 masters because of

Re: [Solved] Bad performance of Bayes with MySQL cluster

de 4, 2. sal 2300 København S Office: 7020 0979 Direct: 3336 9974 Mobile: 5120 1096 Fax:7020 0978 Web: www.techbiz.dk __ Information from ESET NOD32 Antivirus, version of virus signature database 4343 (20090817) __ The message was checked by ESET NOD32 Antivirus. ht

Re: received-header: unparseable:

LuKreme a écrit : > On 16-Aug-2009, at 18:03, Chris wrote: >> Received: from spam05.embarq.synacor.com (LHLO >> smtpout01.embarq.synacor.com) (10.50.1.5) by md29.embarq.synacor.com >> with LMTP; Sun, 16 Aug 2009 19:19:56 -0400 (EDT) > > > LMTP? Seriously? Does anyone use that? Well, yes, evidentl

Re: Weirdness: SA 3.2.5 catches far less spam than 3.1.9?

On Mon, Aug 17, 2009 at 5:17 AM, Matus UHLAR - fantomas wrote: > Did you properly configure trusted_networks and internal_networks? Yes, I double-checked that. I've read and re-read various docs on trusted_networks and internal_networks and I'm *pretty* sure I've got it right. :-) I also tried ma

RE: Barracuda RBL not in first place

On Mon, 2009-08-17 at 09:49 -0700, R-Elists wrote: > i want to publicly apologize to richard and the list. > > although i firmly stand behind what i posted, i should have done it off > list. > > i ask richard and the list to please forgive me > > thanks you > > - rh > Don't worry about it - I

RE: Barracuda RBL not in first place

On Mon, 2009-08-17 at 09:21 -0700, R-Elists wrote: > > Richard Wrote: > > No. Here is why. When someone posts a Barracuda send-up that > > is questionable, it will still end up in the archives. It is, > > therefore, relevant that any counter argument and supporting > > material be archived with

RE: Barracuda RBL not in first place

i want to publicly apologize to richard and the list. although i firmly stand behind what i posted, i should have done it off list. i ask richard and the list to please forgive me thanks you - rh

RE: Barracuda RBL not in first place

> Richard Wrote: > No. Here is why. When someone posts a Barracuda send-up that > is questionable, it will still end up in the archives. It is, > therefore, relevant that any counter argument and supporting > material be archived with it for balance. My follow ups have > been entirely within t

Re: [sa] Weirdness: SA 3.2.5 catches far less spam than 3.1.9?

On Sun, 16 Aug 2009, Kristina wrote: Hi, all. I've looked through the list and bugzilla, and maybe I've missed it, but I can't find anything about this problem. Basically, I upgraded from 3.1.9 to 3.2.5 on our mail servers. When you compare the hits on a message, is there any difference in BAYE

List Admin: bounce handling problem? RE: warning from users@spamassassin.apache.org

Is the 'bounce handler' for this list a little confused? I received this notice yesterday for a temporary mailbox overflow condition that occurred nearly two weeks ago (Aug 4). Now, according to the list processor, because I received this e-mail, all is well, but still, why would it be generati

RE: Barracuda RBL not in first place

On Mon, 2009-08-17 at 08:36 -0700, R-Elists wrote: > > > > But this is all *OT* and has no relevance to SA. Why this > > list was spammed with an unscientific spin of a claim in the > > first instance just shows the dark hand of Barracuda at work. > > > > > > > > Richard, > > i imagine you

RE: Barracuda RBL not in first place

> > But this is all *OT* and has no relevance to SA. Why this > list was spammed with an unscientific spin of a claim in the > first instance just shows the dark hand of Barracuda at work. > > > Richard, i imagine you are far more knowledgable than me (and others) in most respects re: spam

Re: Counting RAZOR2 hits

On Mon, 2009-08-17 at 09:52 +0200, Matus UHLAR wrote: > On 15.08.09 14:32, Matt Kettler wrote: > > That means it was found and was above your min_cf. i.e.: Razor believes > > it is spam. > > There's no min_cf gor RAZOR and there's no public hitcount. RAZOR2 has > internal trust system which counts

OT: dkim-milter forked to an OpenDKIM project

For those who missed it, the dkim-milter project forked. Its principal developer is now with the OpenDKIM project. The OpenDKIM v1.0.0 brings a couple of bug fixes over the dkim-milter, and uses a new build mechanism. Mark Here is the announcement posted on 2009-08-14: == The OpenDKIM proj

Re: Barracuda RBL in first place

Michael Hutchinson wrote: > So perhaps instead of adding another RBL, maybe some admins need to > consider adding in some HELO checking / rejection. Michael, Your suggestions are wonderful. These techniques will block more spam, with relatively few FPs, and their implementation doesn't require ad

Re: Barracuda RBL not in first place

On Mon, 2009-08-17 at 06:39 -0700, Marc Perkel wrote: > > > rich...@buzzhost.co.uk wrote: > > > > I have to agree with LuKreme, my overnight had 446 blocked prior to RBL, > > and only 387 by RBL. Again, noted that 'Barracuda' missed 43, 35 of > > these Spamhaus caught - so for me Spamhaus is st

Re: Barracuda RBL in first place

rich...@buzzhost.co.uk wrote: I have to agree with LuKreme, my overnight had 446 blocked prior to RBL, and only 387 by RBL. Again, noted that 'Barracuda' missed 43, 35 of these Spamhaus caught - so for me Spamhaus is still better than Barracuda. Also, I was sat in on a phone conference at

Re: Barracuda RBL in first place

On Mon, 17 Aug 2009 14:20:18 +0200, Matus UHLAR - fantomas wrote: >>reject_rbl_client zen.spamhaus.local=127.0.0.10, >>reject_rbl_client zen.spamhaus.local=127.0.0.11, >>reject_rbl_client zen.spamhaus.local, > [...] > isn't this a bit superflous? the last line should doo all the job p

Re: Barracuda RBL in first place

Quoting Matus UHLAR - fantomas : Quoting Matus UHLAR - fantomas : On 17.08.09 12:07, d.h...@yournetplus.com wrote: That all depends upon how you have Postfix configured. I have a gateway set up here and do the RBL lookups late in the smtpd_recipient_restrictions just before the greylist polic

Re: Barracuda RBL in first place

> Quoting Matus UHLAR - fantomas : > >> On 17.08.09 12:07, d.h...@yournetplus.com wrote: >>> That all depends upon how you have Postfix configured. I have a gateway >>> set up here and do the RBL lookups late in the >>> smtpd_recipient_restrictions just before the greylist policy. I.e.: >>> >>> smt

Re: Barracuda RBL in first place

Quoting Matus UHLAR - fantomas : On 17.08.09 12:07, d.h...@yournetplus.com wrote: That all depends upon how you have Postfix configured. I have a gateway set up here and do the RBL lookups late in the smtpd_recipient_restrictions just before the greylist policy. I.e.: smtpd_recipient_restricti

Re: Barracuda RBL in first place

On 17.08.09 12:07, d.h...@yournetplus.com wrote: > That all depends upon how you have Postfix configured. I have a gateway > set up here and do the RBL lookups late in the > smtpd_recipient_restrictions just before the greylist policy. I.e.: > > smtpd_recipient_restrictions = [...] >reject_r

Re: Subject keyword plugin?

On 17.08.09 04:03, Kenneth Porter wrote: > Is there a plugin that can read a text file of keywords, one per line, > and build the equivalent Perl regex rule for keywords in the Subject > line? I don't think so. You can use Mail::SpamAssassin::Plugin::WhiteListSubject plugin and set of whitelist_

Re: Weirdness: SA 3.2.5 catches far less spam than 3.1.9?

On 16.08.09 15:39, Kristina wrote: > Hi, all. I've looked through the list and bugzilla, and maybe I've > missed it, but I can't find anything about this problem. Basically, I > upgraded from 3.1.9 to 3.2.5 on our mail servers. This was an > out-of-the-box straight compile/install of the CPAN packa

Re: Barracuda RBL in first place

Quoting Ned Slider : LuKreme wrote: On 16-Aug-2009, at 16:55, MySQL Student wrote: So perhaps instead of adding another RBL, maybe some admins need to consider adding in some HELO checking / rejection. Can you explain a bit more here? What are you checking for, that the host is valid?

Re: DKIM-Reputation list

On Monday 17 August 2009 11:50:53 Florian Sager wrote: > Correct, there is only a dependency on the results of the DKIM.pm module. > There are DKIM verifiers that add a "Authentication-Results" header to > an email, these results would suffice to request data from > dkim-reputation.org as well; dup

Re: received-header: unparseable:

On Monday 17 August 2009 08:45:03 LuKreme wrote: > > Received: from spam05.embarq.synacor.com (LHLO > > smtpout01.embarq.synacor.com) (10.50.1.5) by md29.embarq.synacor.com > > with LMTP; Sun, 16 Aug 2009 19:19:56 -0400 (EDT) > > LMTP? Seriously? Does anyone use that? Well, yes, evidently. A sign

Weirdness: SA 3.2.5 catches far less spam than 3.1.9?

Hi, all. I've looked through the list and bugzilla, and maybe I've missed it, but I can't find anything about this problem. Basically, I upgraded from 3.1.9 to 3.2.5 on our mail servers. This was an out-of-the-box straight compile/install of the CPAN package. After doing so, complaints from users s

Subject keyword plugin?

Is there a plugin that can read a text file of keywords, one per line, and build the equivalent Perl regex rule for keywords in the Subject line?

Re: Barracuda RBL in first place

LuKreme wrote: On 16-Aug-2009, at 16:55, MySQL Student wrote: So perhaps instead of adding another RBL, maybe some admins need to consider adding in some HELO checking / rejection. Can you explain a bit more here? What are you checking for, that the host is valid?

Re: DKIM-Reputation list

Giampaolo Tomassoni schrieb: > AFAIK, Amavis is not involved: the Mail::SpamAssassin::Plugin::DKIMrep only > uses DKIM signatures "passed" by Mail::SpamAssassin::Plugin::DKIM, which in > turn uses Mail::DKIM to validate them. > > I believe Amavis do have independent DKIM code, which I would exclude

Re: Barracuda RBL in first place

On Mon, 2009-08-17 at 00:51 -0600, LuKreme wrote: > On 16-Aug-2009, at 16:55, MySQL Student wrote: > >> So perhaps instead of adding another RBL, maybe some admins need to > >> consider adding in some HELO checking / rejection. > > Can you explain a bit more here? What are you checking for, that th

RE: [Solved] Bad performance of Bayes with MySQL cluster

> > > In case anybody else comes across the same, I've kicked out the MySQL > cluster and now using MySQL with multi-master replication. There we can > use InnoDB and this definitely solved all of the problems I had with > bayes. Scantimes are now below 1 second. I don't have much load as of > yet,

Re: Subject starts Re: but no References/In-Reply-To

> At 02:56 AM 8/15/2009, you wrote: >> How would I create a rule to match when a subject line begins /^Re: /i >> but the message contains no References or In-Reply-To headers? On 15.08.09 07:12, Evan Platt wrote: > Just FYI, I'm on a number of lists where different people insist on > starting t

Re: Subject starts Re: but no References/In-Reply-To

On 15.08.09 10:56, Mike Cardwell wrote: > How would I create a rule to match when a subject line begins /^Re: /i > but the message contains no References or In-Reply-To headers? do you mean this one? % grep -e FAKE_REPLY_C -e __SUBJ_RE -e __MISSING_REF -e __NO_INR_YES_REF * 50_scores.cf:score

Re: Counting RAZOR2 hits

> MySQL Student wrote: > > I thought "grep -c RAZOR2_CHECK" through my mail logs would give me a > > good approximation of the number of times RAZOR2 was consulted, but > > that doesn't seem to be the case. There are some mails that don't have > > it listed in the "tests=" section. > > > > I've als