Re: SA Having Problems Scanning Email With Many RFC822 Attachments

2012-07-13 Thread Axb
On 07/13/2012 09:19 PM, MikeCCSoftware wrote: Environment: We're running MDaemon Email Server v12.5.6 that has SA v3.3.2 running on a Win2k8 R2 OS. Problem: We receive an email from one or our vendors with PO's attached. We have 58 stores we order for so there is 58 emails attached to one single

SA Having Problems Scanning Email With Many RFC822 Attachments

2012-07-13 Thread MikeCCSoftware
Environment: We're running MDaemon Email Server v12.5.6 that has SA v3.3.2 running on a Win2k8 R2 OS. Problem: We receive an email from one or our vendors with PO's attached. We have 58 stores we order for so there is 58 emails attached to one single email. Our SA is erroring out when trying to fi

R: RE: Spamassassin and SPF records with "+all"

2012-07-13 Thread Giampaolo Tomassoni
No, I'm not meaning that. I'm instead following the Hardin suggestion, which works better with mass-check. I'm suggesting to use CIDR::Lite to avoid being fooled by stuff like +128.0.0.0/1 +0.0.0.0/1... Giampaolo Benny Pedersen ha scritto: Den 2012-07-13 19:44, Giampaolo Tomassoni skrev: >

RE: Spamassassin and SPF records with "+all"

2012-07-13 Thread Benny Pedersen
Den 2012-07-13 19:44, Giampaolo Tomassoni skrev: Our hypothetic plugin could merge together CIDRs via Net::CIDR::Lite->add() and get the resultant merged, non-overlapping CIDRs via ->list(), then count the size of the allowed addresses (via something like 2^(32 - cidr_prefix)) and fire rules

RE: Spamassassin and SPF records with "+all"

2012-07-13 Thread Giampaolo Tomassoni
> From: John Hardin [mailto:jhar...@impsec.org] > > Agreed. I was speculating that multiple variants of SPF_PERMISSIVE > might be justified, e.g. SPF_PERMISSIVE_ALL, SPF_PERMISSIVE_1, > SPF_PERMISSIVE_8, etc. However, it is only speculation; I have no > data to support that level of complexity bei

Re: Spamassassin and SPF records with "+all"

2012-07-13 Thread John Hardin
On Fri, 13 Jul 2012, Martin Gregorie wrote: On Fri, 2012-07-13 at 07:33 -0700, John Hardin wrote: >snippage If checking for +all is justified then checking for */1 through */8 would probably also be justified, perhaps with firing different rule so that a different score could be applied

Re: Spamassassin and SPF records with "+all"

2012-07-13 Thread Martin Gregorie
On Fri, 2012-07-13 at 07:33 -0700, John Hardin wrote: > >snippage > If checking for +all is justified then checking for */1 through */8 would > probably also be justified, perhaps with firing different rule so that a > different score could be applied. > >more snippage > So does that m

Re: Spamassassin on Windows Plesk

2012-07-13 Thread Axb
On 07/13/2012 05:47 PM, Thomas Fox wrote: Hi, I'm wondering if there is a list specific to using Spamassasin on Windows, particularly with Plesk? I know I need to do some tuning, but Plesk is so odd in how it lays out the files I'm afraid of breaking something. As you haven't placed a specific

Re: Spamassassin and SPF records with "+all"

2012-07-13 Thread Benny Pedersen
Den 2012-07-13 17:02, David F. Skoll skrev: Absolutely. If you do not want to receive mail from a certain domain and it passes SPF, then there's pretty good evidence the mail really *is* from that domain and that you can apply your domain policy. bingo, if more recipients do this +all will cha

Spamassassin on Windows Plesk

2012-07-13 Thread Thomas Fox
Hi, I'm wondering if there is a list specific to using Spamassasin on Windows, particularly with Plesk? I know I need to do some tuning, but Plesk is so odd in how it lays out the files I'm afraid of breaking something.

Re: Spamassassin and SPF records with "+all"

2012-07-13 Thread Benny Pedersen
Den 2012-07-13 16:33, John Hardin skrev: So does that mean it may be legitimate to treat an SPF PASS as "something bad" if the SPF rule is defined in an "abusive" manner? meta __META_DNSWL_ANY (RCVD_IN_DNSWL_HI || RCVD_IN_DNSWL_MED || RCVD_IN_DNSWL_LOW) meta META_SPF_DNSWL (__META_DNSWL_ANY

Re: Spamassassin and SPF records with "+all"

2012-07-13 Thread David F. Skoll
On Fri, 13 Jul 2012 07:33:34 -0700 (PDT) John Hardin wrote: > So does that mean it may be legitimate to treat an SPF PASS as > "something bad" if the SPF rule is defined in an "abusive" manner? Absolutely. If you do not want to receive mail from a certain domain and it passes SPF, then there's

Re: Spamassassin and SPF records with "+all"

2012-07-13 Thread John Hardin
On Fri, 13 Jul 2012, David F. Skoll wrote: SPF has *never* been advocated as an anti-spam measure by the people who developed it. Agreed, but that does not mean under certain circumstances it cannot be useful as a spam indicator. And looking for +all or ?all is not enough; you can easily s

Re: Spamassassin and SPF records with "+all"

2012-07-13 Thread Bowie Bailey
On 7/13/2012 4:57 AM, David F. Skoll wrote: > On Thu, 12 Jul 2012 21:37:36 +0100 > Martin Gregorie wrote: > >> True enough. I just wanted to provide a concrete example of extra >> stuff the plug-in could do and why that could be useful. It hadn't >> occurred to me until just now that SPF_PASS can

Re: Spamassassin and SPF records with "+all"

2012-07-13 Thread David F. Skoll
On Thu, 12 Jul 2012 21:37:36 +0100 Martin Gregorie wrote: > True enough. I just wanted to provide a concrete example of extra > stuff the plug-in could do and why that could be useful. It hadn't > occurred to me until just now that SPF_PASS can be triggered by > slovenly and/or careless SPF confi