Re: A way to score Number of Recipients in the To: Line ?

2013-10-18 Thread Dave Warren
On 2013-10-18 23:21, haman...@t-online.de wrote: hile multiple recipients are common in ham, I would expect them only from known senders (and in fact senders known to use address lists on purpose) Or a customer who feels they are being ignored and takes the shotgun approach hoping that someone

Re: A way to score Number of Recipients in the To: Line ?

2013-10-18 Thread hamann . w
Kevin A McGrail wrote: >> On 10/18/2013 10:04 AM, Lutz Petersen wrote: >> > >> > I'm searching a way to give some extra Score depending on the Number >> > of Recipients in the To: Headerline. In the last days there are >> > massive Spamruns that are not marked as Spam - but all of them have >> > a

Testing the _REMOTEHOSTNAME_ in a rule

2013-10-18 Thread Philip Prindeville
I'm trying to write a rule that gives some spamminess score to messages received from any host that resolves to protection.outlook.com. I tried to use _REMOTEHOSTNAME_ to do this, but I think I got the header syntax wrong. Can someone set me straight? Thanks, -Philip

Re: A way to score Number of Recipients in the To: Line ?

2013-10-18 Thread John Hardin
On Fri, 18 Oct 2013, Kevin A. McGrail wrote: On 10/18/2013 10:04 AM, Lutz Petersen wrote: I'm searching a way to give some extra Score depending on the Number of Recipients in the To: Headerline. In the last days there are massive Spamruns that are not marked as Spam - but all of them have

Re: whitelist_from conditioned to hostname

2013-10-18 Thread Kris Deugau
nik600 wrote: > is possible to specify a whitelist_from in local.cf > limiting it for some hosts? > > Example: > > i want to whitelist my postmas...@foo.tld to avoid backscatter or > bouce_message classifications, but want to limit this whitelist only if > the sender is from my

Re: whitelist_from conditioned to hostname

2013-10-18 Thread Matus UHLAR - fantomas
On 18.10.13 17:24, nik600 wrote: is possible to specify a whitelist_from in local.cf limiting it for some hosts? yes, use whitelist_from_rcvd for that. Note that applies to external mail, e.g. mail received from hosts not in your internal_network. i want to whitelist my postmas...@foo.tld to

Re: whitelist_from conditioned to hostname

2013-10-18 Thread Benny Pedersen
nik600 skrev den 2013-10-18 17:24: Can i do that? sure: whitelist_auth postmas...@example.org whitelist_from allow forges, dont use it, its still candidate to be removed from spamassassin

whitelist_from conditioned to hostname

2013-10-18 Thread nik600
Dear sir is possible to specify a whitelist_from in local.cf limiting it for some hosts? Example: i want to whitelist my postmas...@foo.tld to avoid backscatter or bouce_message classifications, but want to limit this whitelist only if the sender is from my server, if the smtp client is somethin

Re: False positive in FB_CIALIS_LEO3 rule

2013-10-18 Thread Axb
On 10/18/2013 03:34 PM, Marcin Mirosław wrote: W dniu 18.10.2013 15:23, Axb pisze: On 10/18/2013 03:07 PM, Marcin Mirosław wrote: Hi! I'm not sure if false positives should be reported here or in bugzilla. If I choosen wrong place please let me know. Innocent phrase in Polish language "brakuje

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-18 Thread SM
At 02:56 15-10-2013, Stan Hoeppner wrote: In both cases the last two Received: headers in each message are forgeries as no SMTP transaction occurred. I'm sure this violates more than one SMTP RFC, but I doubt Gmane will change the way they do this any time soon. I don't think that there is any

Re: A way to score Number of Recipients in the To: Line ?

2013-10-18 Thread Kevin A. McGrail
On 10/18/2013 10:04 AM, Lutz Petersen wrote: I'm searching a way to give some extra Score depending on the Number of Recipients in the To: Headerline. In the last days there are massive Spamruns that are not marked as Spam - but all of them have a lot of Recipient Mail-Adresses in the To-Line (t

Re: A way to score Number of Recipients in the To: Line ?

2013-10-18 Thread Axb
On 10/18/2013 04:04 PM, Lutz Petersen wrote: I'm searching a way to give some extra Score depending on the Number of Recipients in the To: Headerline. In the last days there are massive Spamruns that are not marked as Spam - but all of them have a lot of Recipient Mail-Adresses in the To-Line (

A way to score Number of Recipients in the To: Line ?

2013-10-18 Thread Lutz Petersen
I'm searching a way to give some extra Score depending on the Number of Recipients in the To: Headerline. In the last days there are massive Spamruns that are not marked as Spam - but all of them have a lot of Recipient Mail-Adresses in the To-Line (the last one more than 50..). I didn't found an

Re: False positive in FB_CIALIS_LEO3 rule

2013-10-18 Thread Marcin Mirosław
W dniu 18.10.2013 15:23, Axb pisze: > On 10/18/2013 03:07 PM, Marcin Mirosław wrote: >> Hi! >> I'm not sure if false positives should be reported here or in bugzilla. >> If I choosen wrong place please let me know. >> Innocent phrase in Polish language "brakuje Ci aliasów"[1] triggers >> rules ment

Re: False positive in FB_CIALIS_LEO3 rule

2013-10-18 Thread Axb
On 10/18/2013 03:07 PM, Marcin Mirosław wrote: Hi! I'm not sure if false positives should be reported here or in bugzilla. If I choosen wrong place please let me know. Innocent phrase in Polish language "brakuje Ci aliasów"[1] triggers rules mentioned above. [1] - it means: "[...] you are missin

False positive in FB_CIALIS_LEO3 rule

2013-10-18 Thread Marcin Mirosław
Hi! I'm not sure if false positives should be reported here or in bugzilla. If I choosen wrong place please let me know. Innocent phrase in Polish language "brakuje Ci aliasów"[1] triggers rules mentioned above. [1] - it means: "[...] you are missing aliases [...]" Regards, Marcin