Re: Spamassassin and SPF records with +all

2012-07-12 Thread Robert Schetterer
Am 11.07.2012 21:34, schrieb Josef Karliak: Good evening, within a few days we've spams from domains that has +all in the TXT spf record. I was thinking that I'll make a plugin that check this records and add some point to this email, but I do not know perl. Are there some other options ?

Re: Spamassassin and SPF records with +all

2012-07-12 Thread David F. Skoll
On Thu, 12 Jul 2012 08:50:59 +0200 Robert Schetterer rob...@schetterer.org wrote: spf does not solve spam problems in general, its may only one from many parameters for spam tagging check Indeed. I *never* subtract points for an SPF pass except for a very few select domains that I trust. I

Re: Spamassassin and SPF records with +all [learning per domain worth of SPF record]

2012-07-12 Thread Andrzej A. Filip
On 07/12/2012 09:01 AM, David F. Skoll wrote: On Thu, 12 Jul 2012 08:50:59 +0200 Robert Schetterer rob...@schetterer.org wrote: spf does not solve spam problems in general, its may only one from many parameters for spam tagging check Indeed. I *never* subtract points for an SPF pass except

Re: Spamassassin and SPF records with +all [learning per domain worth of SPF record]

2012-07-12 Thread David F. Skoll
On Thu, 12 Jul 2012 09:08:19 +0200 Andrzej A. Filip andrzej.fi...@gmail.com wrote: Would you suggest/recommend using spf-bayes? [auto-learning of worth of given domain SPF record] That is an interesting idea... store tokens like: example.com*spf-pass and compute probabilities. A while

Re: Spamassassin and SPF records with +all [learning per domain worth of SPF record]

2012-07-12 Thread Robert Schetterer
Am 12.07.2012 09:08, schrieb Andrzej A. Filip: On 07/12/2012 09:01 AM, David F. Skoll wrote: On Thu, 12 Jul 2012 08:50:59 +0200 Robert Schetterer rob...@schetterer.org wrote: spf does not solve spam problems in general, its may only one from many parameters for spam tagging check Indeed. I

Re: Spamassassin and SPF records with +all

2012-07-12 Thread Josef Karliak
Hi everybody, thanks for answers. Many of the spamming domains has a TXT record: v=spf1 +all. Or the name record types and at the end of the record they put +all anyway. So I can send spam by theirs domain, I'm authorized by this record. That is wrong. Ok, not everyone uses only

Re: Spamassassin and SPF records with +all [learning per domain worth of SPF record]

2012-07-12 Thread Martin Gregorie
On Thu, 2012-07-12 at 03:20 -0400, David F. Skoll wrote: On Thu, 12 Jul 2012 09:08:19 +0200 Andrzej A. Filip andrzej.fi...@gmail.com wrote: Would you suggest/recommend using spf-bayes? [auto-learning of worth of given domain SPF record] That is an interesting idea... store tokens like:

Re: Spamassassin and SPF records with +all

2012-07-12 Thread Benny Pedersen
Den 2012-07-12 09:33, Josef Karliak skrev: v=spf1 +all. if i find a domain with just that i perm reject this domain in mta without spf testing I tried META ... mentioned in some post, I'll see. maybe it helps spammers ? :=) if its your own domain as sender one could ask sender for

Re: Spamassassin and SPF records with +all

2012-07-12 Thread Benny Pedersen
Den 2012-07-12 08:50, Robert Schetterer skrev: i wouldnt invest time in it spf does not solve spam problems in general, its may only one from many parameters for spam tagging check currect any spammer can have valid spf records, also strict ones also any legal mail sender currect in

Re: Spamassassin and SPF records with +all [learning per domain worth of SPF record]

2012-07-12 Thread Benny Pedersen
Den 2012-07-12 09:20, David F. Skoll skrev: it's still the case because SPF is now more widely adopted than before. (Spammers tend to be early adopters of technology.) thay are properly implementing dmarc into spamassassin right now :)

Re: Spamassassin and SPF records with +all

2012-07-12 Thread RW
On Thu, 12 Jul 2012 08:50:59 +0200 Robert Schetterer wrote: Am 11.07.2012 21:34, schrieb Josef Karliak: Good evening, within a few days we've spams from domains that has +all in the TXT spf record. I was thinking that I'll make a plugin that check this records and add some point to

Re: Spamassassin and SPF records with +all

2012-07-12 Thread Martin Gregorie
On Thu, 2012-07-12 at 13:35 +0200, Benny Pedersen wrote: Den 2012-07-12 09:33, Josef Karliak skrev: v=spf1 +all. if i find a domain with just that i perm reject this domain in mta without spf testing That sounds like a good idea. Can the SPF plugin recognise overly permissive

Re: Spamassassin and SPF records with +all

2012-07-12 Thread John Hardin
On Thu, 12 Jul 2012, Martin Gregorie wrote: I'd suggest that any SPF record containing '+all' and possibly '?all' too, should trigger an SPF_PERMISSIVE rule rather than SPF_PASS so we can distinguish an authorised server in a tightly controlled domain from servers claiming to be part of a

Re: Spamassassin and SPF records with +all

2012-07-12 Thread Xtrade Assessory
Em Wed, 11 Jul 2012 18:22:49 -0400 dar...@chaosreigns.com escreveu: On 07/11, Josef Karliak wrote: within a few days we've spams from domains that has +all in the TXT spf record. I was thinking that I'll make a plugin that check this records and add some point to this email, but I do not

Re: Spamassassin and SPF records with +all

2012-07-12 Thread Martin Gregorie
On Thu, 2012-07-12 at 12:17 -0700, John Hardin wrote: On Thu, 12 Jul 2012, Martin Gregorie wrote: I'd suggest that any SPF record containing '+all' and possibly '?all' too, should trigger an SPF_PERMISSIVE rule rather than SPF_PASS so we can distinguish an authorised server in a tightly

SA timeout bug starting 2012/07/12

2012-07-12 Thread Dan Grossman
Hello, Starting this morning (USA time), around 20 spam messages have made it to my inbox due to errors in my spamassassin executions: -=-=- Timeout::_run: check: no loaded plugin implements 'check_main': cannot scan! Check the necessary '.pre' files are in the config directory. at