DOS_OE_TO_MX rule and trusted_networks

2011-10-10 Thread Tomas Macek
I'm using SpamAssassin 3.3.1 together with Amavis 2.6.4 on one server with Postfix. All our customers have public static IP addresses on their PC's 213.x.x.x/y. We use only one mailserver with one public IP address from the 213.x.x.x/y range mentioned earlier for both the incoming and outgoing

Blacklisting By Mail Server Rather Than By An Email Address

2011-10-10 Thread johnjinsf
I have recently changed the company that hosts my email and they use SpamAssassin. In the SpamAssassin Configuration I have entered several email addresses in the Blacklist which has worked fine. One thing I have noticed with one particular spammer is that they send out their emails using fake

Re: DOS_OE_TO_MX rule and trusted_networks

2011-10-10 Thread Benny Pedersen
On Mon, 10 Oct 2011 12:19:56 +0200 (CEST), Tomas Macek wrote: I suggest something like this: trusted_networks 213.x.x.x/y # all our public ip addresses range internal_networks 213.0.0.5 # let's say that's our mailserver's IP the above should only list all the mailserver(s) you have as isp,

Re: Blacklisting By Mail Server Rather Than By An Email Address

2011-10-10 Thread Benny Pedersen
On Mon, 10 Oct 2011 03:47:27 -0700 (PDT), johnjinsf wrote: Is there a way of blacklisting the mail server which would prevent any mail originating from that server being received? is sender domain(s) rfc-ignorant ?, sendmail -bv ab...@example.org sendmail -bv postmas...@example.org, what

Re: DOS_OE_TO_MX rule and trusted_networks

2011-10-10 Thread Tomas Macek
On Mon, 10 Oct 2011, Benny Pedersen wrote: On Mon, 10 Oct 2011 12:19:56 +0200 (CEST), Tomas Macek wrote: I suggest something like this: trusted_networks 213.x.x.x/y # all our public ip addresses range internal_networks 213.0.0.5 # let's say that's our mailserver's IP the above should only

Re: Blacklisting By Mail Server Rather Than By An Email Address

2011-10-10 Thread RW
On Mon, 10 Oct 2011 03:47:27 -0700 (PDT) johnjinsf wrote: Is there a way of blacklisting the mail server which would prevent any mail originating from that server being received? I don't think there is a way to blacklist a server unless the provider allows you to create SA rules. If it does

Re: Blacklisting By Mail Server Rather Than By An Email Address

2011-10-10 Thread RW
On Mon, 10 Oct 2011 13:47:28 +0100 RW wrote: On Mon, 10 Oct 2011 03:47:27 -0700 (PDT) johnjinsf wrote: Is there a way of blacklisting the mail server which would prevent any mail originating from that server being received? I don't think there is a way to blacklist a server unless

Re: DOS_OE_TO_MX rule and trusted_networks

2011-10-10 Thread Jernej Porenta
On Oct 10, 2011, at 1:14 PM, Tomas Macek wrote: hope that helps, if not post sample on pastebin, and just mangle sender donain with example.org But there is still the question what bad happened when DOS_OE_TO_MX matched the message? The client sent the mail from internal network

Re: New Bayes like paradigm

2011-10-10 Thread Marc Perkel
On 9/28/2011 8:02 AM, dar...@chaosreigns.com wrote: On 09/28, Marc Perkel wrote: You would only have to test the rule combinations that the message actually triggered. So if it hit 10 rules then it would be 1024 combinations. Seems not to be unreasonable to me. You definitely have a good

Re: Blacklisting based on SPF

2011-10-10 Thread Marc Perkel
On 10/7/2011 12:50 AM, Benny Pedersen wrote: On 7 Oct 2011 00:28:49 -, John Levine wrote: Nobody with any interest in delivering the mail that their users want. The error rate is much, much too high. how ? All forwarded email would fail SPF testing. You would be blocking all hosted

Re: Blacklisting based on SPF

2011-10-10 Thread Daniel McDonald
On 10/10/11 9:00 AM, Marc Perkel supp...@junkemailfilter.com wrote: On 10/7/2011 12:50 AM, Benny Pedersen wrote: On 7 Oct 2011 00:28:49 -, John Levine wrote: Nobody with any interest in delivering the mail that their users want. The error rate is much, much too high. how ? All

Re: DOS_OE_TO_MX rule and trusted_networks

2011-10-10 Thread Benny Pedersen
On Mon, 10 Oct 2011 13:14:21 +0200 (CEST), Tomas Macek wrote: On Mon, 10 Oct 2011, Benny Pedersen wrote: On Mon, 10 Oct 2011 12:19:56 +0200 (CEST), Tomas Macek wrote: I suggest something like this: trusted_networks 213.x.x.x/y # all our public ip addresses range internal_networks 213.0.0.5 #

Re: sa-learn --backup

2011-10-10 Thread Chris
On Mon, 2011-10-10 at 01:03 +0100, RW wrote: On Sun, 09 Oct 2011 08:31:16 -0500 Chris wrote: I've been running the above command as a cronjob nightly for years now suddenly in the past few days I've been getting this as the output of the cronjob: bayes: cannot open bayes databases

Re: Blacklisting based on SPF

2011-10-10 Thread David F. Skoll
On Mon, 10 Oct 2011 07:00:48 -0700 Marc Perkel supp...@junkemailfilter.com wrote: [Blocking SPF fail mail] All forwarded email would fail SPF testing. You would be blocking all hosted spam filtering services for example. Nonsense. If someone uses a hosted spam filtering servic for inbound

Re: sa-learn --backup

2011-10-10 Thread Bowie Bailey
On 10/9/2011 9:31 AM, Chris wrote: cd /home/chris/.spamassassin /usr/local/bin/sa-learn --backup /home/chris/SABackup/backup.txt Out of curiosity, is there a reason for the 'cd'? sa-learn gets the database path from the config (or defaults to ~/.spamassassin/bayes). The current directory is

How to create spam score list for sample email messages

2011-10-10 Thread Sharma, Ashish
Hi, I have a mail receiving setup where in Postfix (2.6.6) is the MTA and then I have amavisd-new (with spamassassin and CLamAV) as content filter. I have enabled spam report header in my amavisd-new conf file. I want to create a report of sample emails with the spam scores generated in

Re: New Bayes like paradigm

2011-10-10 Thread darxus
On 10/10, Marc Perkel wrote: On 9/28/2011 8:02 AM, dar...@chaosreigns.com wrote: On 09/28, Marc Perkel wrote: You would only have to test the rule combinations that the message actually triggered. So if it hit 10 rules then it would be 1024 combinations. Seems not to be unreasonable to me.

Re: How to create spam score list for sample email messages

2011-10-10 Thread Martin Gregorie
On Mon, 2011-10-10 at 15:36 +, Sharma, Ashish wrote: I want to create a report of sample emails with the spam scores generated in accordance with permissible limits after deploying the spamassassin updated rulesets. For that I am trying out on a shell script providing with my test email

Re: How to create spam score list for sample email messages

2011-10-10 Thread RW
On Mon, 10 Oct 2011 17:29:08 +0100 Martin Gregorie wrote: for f in testdata/*.txt do spamc testdata/$f | grep '^X-spam-status: ' result.txt For that to work you need the setting fold_headers 0

Re: Blacklisting By Mail Server Rather Than By An Email Address

2011-10-10 Thread johnjinsf
RW-15 wrote: I don't think there is a way to blacklist a server unless the provider allows you to create SA rules. Many thanks for your replies and suggestions. I haven't seen where my hoster allows for users to create rules, but I'll open a ticket with their help desk to ask if they

Re: How to create spam score list for sample email messages

2011-10-10 Thread Martin Gregorie
On Mon, 2011-10-10 at 20:08 +0100, RW wrote: On Mon, 10 Oct 2011 17:29:08 +0100 Martin Gregorie wrote: for f in testdata/*.txt do spamc testdata/$f | grep '^X-spam-status: ' result.txt For that to work you need the setting fold_headers 0 Fair comment: I use gawk rather than

Re: DOS_OE_TO_MX rule and trusted_networks

2011-10-10 Thread Tomas Macek
On Mon, 10 Oct 2011, Benny Pedersen wrote: On Mon, 10 Oct 2011 13:14:21 +0200 (CEST), Tomas Macek wrote: On Mon, 10 Oct 2011, Benny Pedersen wrote: On Mon, 10 Oct 2011 12:19:56 +0200 (CEST), Tomas Macek wrote: I suggest something like this: trusted_networks 213.x.x.x/y # all our public ip