Re: More text/plain questions

2014-07-25 Thread Kevin A. McGrail
On 7/25/2014 6:19 PM, Amir Caspi wrote: On Jul 25, 2014, at 4:11 PM, Kevin A. McGrail wrote: You should look at the patch on bug 7068 (https://issues.apache.org/SpamAssassin/show_bug.cgi?id=7068) Yes, but this is within the code itself. I was referring to how to do this in a local.cf, for

Re: URIDNSBL check return code

2014-07-25 Thread Karsten Bräckelmann
On Sat, 2014-07-26 at 11:12 +1000, Noel Butler wrote: > On 26/07/2014 03:32, Axb wrote: > > what's the advantage of such a response method? > > > > The idea of separate return codes is to use different rules/scores and > > different rule descriptions which describe the type of listing > > As you

Re: URIDNSBL check return code

2014-07-25 Thread Noel Butler
On 26/07/2014 03:32, Axb wrote: > On 07/25/2014 07:26 PM, Kevin A. McGrail wrote: > On 7/24/2014 9:42 PM, Noel Butler wrote: Hi, Is there a way to get the return > code in the generated reports? eg: uridnssub ALT_URI bl.foo A > 127.0.0.2-127.0.0.11 body ALT_URI eval:check_uridnsbl('ALT_URI')

Re: Low Score for @localhost domain

2014-07-25 Thread RW
On Fri, 25 Jul 2014 13:39:46 -0300 Andre Luiz Paiz wrote: > > From: val...@iqm.unicamp.br >There is no whitelist setting for @localhost, unless this is a default >setting. But it's not from an address @localhost, it's from val...@iqm.unicamp.br

Re: URIDNSBL check return code

2014-07-25 Thread Noel Butler
Hi Kevin, Thanks, will try this out after lunch and get back to you. Cheers Noel On 26/07/2014 03:26, Kevin A. McGrail wrote: > On 7/24/2014 9:42 PM, Noel Butler wrote: > >> Hi, Is there a way to get the return code in the generated reports? eg: >> uridnssub ALT_URI bl.foo A 127.0.0.

Re: More text/plain questions

2014-07-25 Thread Amir Caspi
On Jul 25, 2014, at 4:11 PM, Kevin A. McGrail wrote: > You should look at the patch on bug 7068 > (https://issues.apache.org/SpamAssassin/show_bug.cgi?id=7068) Yes, but this is within the code itself. I was referring to how to do this in a local.cf, for example... Amir

Re: More text/plain questions

2014-07-25 Thread Kevin A. McGrail
On 7/25/2014 5:55 PM, Amir Caspi wrote: On Jul 24, 2014, at 4:08 PM, Philip Prindeville wrote: In text/plain with CTE of ‘7bit’ or ‘8bit’ it’s meaningless to use Unicode HTML entity encodings. It’s obviously not HTML. If you want Unicode in text/plain, it should be in base64 or quoted-prin

Re: More text/plain questions

2014-07-25 Thread Kevin A. McGrail
On 7/23/2014 2:27 PM, Paul Stead wrote: KAM's rules are also helping add a few extra points I try. https://issues.apache.org/SpamAssassin/show_bug.cgi?id=7068 and https://issues.apache.org/SpamAssassin/show_bug.cgi?id=7063 I've also implemented several rules to try and catch these types of

Re: More text/plain questions

2014-07-25 Thread Amir Caspi
On Jul 24, 2014, at 4:08 PM, Philip Prindeville wrote: > In text/plain with CTE of ‘7bit’ or ‘8bit’ it’s meaningless to use Unicode > HTML entity encodings. It’s obviously not HTML. > > If you want Unicode in text/plain, it should be in base64 or quoted-printable > CTE. Sure, but these spam

Re: Low Score for @localhost domain

2014-07-25 Thread Karsten Bräckelmann
On Fri, 2014-07-25 at 13:39 -0300, Andre Luiz Paiz wrote: > Quoting Adi : > > W dniu 2014-07-25 14:07, Andre Luiz Paiz pisze: > > > I received a SPAM that Spamassassing gave a high negative score > > > (-86.0) to a e-mail message. I believe that is because the spammer > > > > Maybe you get -100 f

Re: Low Score for @localhost domain

2014-07-25 Thread Matus UHLAR - fantomas
On 25.07.14 09:07, Andre Luiz Paiz wrote: I received a SPAM that Spamassassing gave a high negative score (-86.0) to a e-mail message. I believe that is because the spammer altered the "From:" header field to: querercrer@localhost why did you whitelist localhost? This is exactly what happens w

Re: Google, IPv6 and SPF (was Re: No SPF/DKIM/DMARC rule)

2014-07-25 Thread Robert Schetterer
Am 25.07.2014 um 19:40 schrieb David F. Skoll: > Google must be using some secret algorithm to decide whether or not to > be strict. its simply a bug, but they dont care, spam tagging was reported with all settings good ipv6 SPF/DKIM/DMARC/PTR however it might fixed recent or will fixed some day,

Re: Google, IPv6 and SPF (was Re: No SPF/DKIM/DMARC rule)

2014-07-25 Thread Kevin A. McGrail
On 7/25/2014 1:40 PM, David F. Skoll wrote: Google must be using some secret algorithm to decide whether or not to be strict. Agreed and/or they've modified things since but as you can imagine, an rptr/static IP has been best-practice for our firm for at least a decade, probably going back 16

Google, IPv6 and SPF (was Re: No SPF/DKIM/DMARC rule)

2014-07-25 Thread David F. Skoll
On Fri, 25 Jul 2014 13:30:43 -0400 "Kevin A. McGrail" wrote: > Even with ptr records and static IPs, etc. we had to add an SPF > record to at least 2 domains in April to get Google to accept the > email over IPv6. Using IPv4, they did not reject. Not sure what > triggers, etc. but that's the re

Re: URIDNSBL check return code

2014-07-25 Thread Axb
On 07/25/2014 07:26 PM, Kevin A. McGrail wrote: On 7/24/2014 9:42 PM, Noel Butler wrote: Hi, Is there a way to get the return code in the generated reports? eg: uridnssub ALT_URI bl.foo A 127.0.0.2-127.0.0.11 body ALT_URI eval:check_uridnsbl('ALT_URI') describe ALT_URI URL's domain A re

Re: No SPF/DKIM/DMARC rule

2014-07-25 Thread Kevin A. McGrail
On 7/25/2014 1:21 PM, Joe Quinn wrote: On 7/25/2014 1:18 PM, David F. Skoll wrote: On Fri, 25 Jul 2014 13:07:34 -0400 Joe Quinn wrote: Something we have noticed is that Google blocks email from servers that use IPv6 but do not have an SPF record. Really? We have not noticed that. We have a

Re: URIDNSBL check return code

2014-07-25 Thread Kevin A. McGrail
On 7/24/2014 9:42 PM, Noel Butler wrote: Hi, Is there a way to get the return code in the generated reports? eg: uridnssub ALT_URI bl.foo A 127.0.0.2-127.0.0.11 body ALT_URI eval:check_uridnsbl('ALT_URI') describe ALT_URI URL's domain A record listed in bl.foo ($RETRUN_CODE) score AL

Re: No SPF/DKIM/DMARC rule

2014-07-25 Thread Robert Schetterer
Am 25.07.2014 um 19:18 schrieb David F. Skoll: > On Fri, 25 Jul 2014 13:07:34 -0400 > Joe Quinn wrote: > >> Something we have noticed is that Google blocks email from servers >> that use IPv6 but do not have an SPF record. True, Goggle tags mails comming in via ipv6 ,sometimes, use ipv4 transpor

Re: No SPF/DKIM/DMARC rule

2014-07-25 Thread Joe Quinn
On 7/25/2014 1:18 PM, David F. Skoll wrote: On Fri, 25 Jul 2014 13:07:34 -0400 Joe Quinn wrote: Something we have noticed is that Google blocks email from servers that use IPv6 but do not have an SPF record. Really? We have not noticed that. We have a number of customers using us for outbou

Re: No SPF/DKIM/DMARC rule

2014-07-25 Thread David F. Skoll
On Fri, 25 Jul 2014 13:07:34 -0400 Joe Quinn wrote: > Something we have noticed is that Google blocks email from servers > that use IPv6 but do not have an SPF record. Really? We have not noticed that. We have a number of customers using us for outbound relaying and our logs show Google accept

No SPF/DKIM/DMARC rule

2014-07-25 Thread Joe Quinn
Something we have noticed is that Google blocks email from servers that use IPv6 but do not have an SPF record. Is there any value to implementing a similar rule for SA with a relatively small score? If your domain does not use SPF, DKIM, or DMARC, you're not even trying to prevent forgeries.

Re: Individual pre learning - Bayes in SQL

2014-07-25 Thread Adi
Hello > OTOH if someone gets so little spam that they struggle to reach 200, > does it matter? I'm just in the course of transferring the mail accounts from the server where was global bayes (with a lot ham/spam tokens) for an individual userpref/bayes. Before bayes reach 200 spam threshold it

Re: Low Score for @localhost domain

2014-07-25 Thread Andre Luiz Paiz
Quoting "Kevin A. McGrail" : On 7/25/2014 8:07 AM, Andre Luiz Paiz wrote: I tried to use the following rule (from Spamassassing guide), but it did not worked: header LOCAL_HEADER from =~ /@localhost/ [if-unset: @localhost] score LOCAL_HEADER -3.0 - Sample of the email on pastebin.com - Wha

Re: Low Score for @localhost domain

2014-07-25 Thread Andre Luiz Paiz
Quoting Adi : W dniu 2014-07-25 14:07, Andre Luiz Paiz pisze: Hi everybody, I received a SPAM that Spamassassing gave a high negative score (-86.0) to a e-mail message. I believe that is because the spammer Maybe you get -100 for whitelist ? Please check (or pastebin) mail headers (X-Spam*

Re: Low Score for @localhost domain

2014-07-25 Thread Adi
W dniu 2014-07-25 14:07, Andre Luiz Paiz pisze: > Hi everybody, > > I received a SPAM that Spamassassing gave a high negative score > (-86.0) to a e-mail message. I believe that is because the spammer Maybe you get -100 for whitelist ? Please check (or pastebin) mail headers (X-Spam*) or look in

Re: Alternate method to check for rule updates?

2014-07-25 Thread RW
On Thu, 24 Jul 2014 18:56:10 -0700 jdebert wrote: > > > > > I cannot trust that the response received by sa-update is valid. > > > Is there another method to check for updates? > > > > If you really cannot trust *.updates.spamassassin.org DNS responses, > > you cannot trust *any* DNS response.

Re: Individual pre learning - Bayes in SQL

2014-07-25 Thread RW
On Fri, 25 Jul 2014 12:21:42 +0200 Adi wrote: > I can change To/CC in loop for trained addresses in "mega spam mails". > Or change To/CC to exam...@example.com before make sa-learn. Just delete those headers. > I want pre learning because in the beginning people would be hard to > get 200 SPAM

Re: Low Score for @localhost domain

2014-07-25 Thread Kevin A. McGrail
On 7/25/2014 8:07 AM, Andre Luiz Paiz wrote: I tried to use the following rule (from Spamassassing guide), but it did not worked: header LOCAL_HEADER from =~ /@localhost/ [if-unset: @localhost] score LOCAL_HEADER -3.0 - Sample of the email on pastebin.com - What rules hit already? Seriously,

Re:

2014-07-25 Thread cigan_ng
Hi! http://fumarcachimba.com/_redirect?ewuremj134895

Low Score for @localhost domain

2014-07-25 Thread Andre Luiz Paiz
Hi everybody, I received a SPAM that Spamassassing gave a high negative score (-86.0) to a e-mail message. I believe that is because the spammer altered the "From:" header field to: querercrer@localhost. The source domain is: web3.host-services.com and the message is a SPAM. Even messages sent fr

Re: Individual pre learning - Bayes in SQL

2014-07-25 Thread Adi
Hello > A token is a word or some piece of derived data. I just means > that email contained 360 of them. Thanks for clarify >> Mail addressed to another person will not be a problem in learning >> process? > > Probably not. It wont make any difference in most cases, but if > one of those addr