Re: DKIM domainkeys=fail (1024-bit key) reason="fail (message has been altered)"

2016-08-26 Thread Dave Warren
On Fri, Aug 26, 2016, at 08:39, Bowie Bailey wrote: > On 8/26/2016 11:34 AM, widowsoft wrote: > > I am sure this has been done to death but I would like to ban emails that > > show > > "domainkeys=fail (1024-bit key) reason="fail (message has been altered)"" > > > > any ideas please I have tried re

Re: Possible ignore CRLF?

2016-08-26 Thread RW
On Fri, 26 Aug 2016 12:07:48 -0700 (PDT) John Hardin wrote: > On Fri, 26 Aug 2016, Robert Boyl wrote: > > > Rule > > > > describe BRF_TEST123test > > body BRF_TEST123 \bSe você não deseja mais receber nossos > > e-mails, cancele\b/i > > That's missing a leading slash. Is that a copy+pa

Re: Possible ignore CRLF?

2016-08-26 Thread John Hardin
On Fri, 26 Aug 2016, John Hardin wrote: body __ALL_BODY /./ Oops. body __ALL_BODY /.+/ {blush} -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C

Re: Possible ignore CRLF?

2016-08-26 Thread John Hardin
On Fri, 26 Aug 2016, Robert Boyl wrote: Rule describe BRF_TEST123test body BRF_TEST123 \bSe você não deseja mais receber nossos e-mails, cancele\b/i That's missing a leading slash. Is that a copy+paste error? Do you run lint checks before restarting SA? That shouldn't have passed li

Re: Possible ignore CRLF?

2016-08-26 Thread Axb
Please keep list mail on the list. On 08/26/2016 08:41 PM, Robert Boyl wrote: Hi, Thanks for reply. Hehe, sorry :)) Rule describe BRF_TEST123test body BRF_TEST123 \bSe você não deseja mais receber nossos e-mails, cancele\b/i scoreBRF_TEST123 0.1 See here the message that qmail c

Re: Possible ignore CRLF?

2016-08-26 Thread Robert Boyl
Hi, Thanks for reply. Hehe, sorry :)) Rule describe BRF_TEST123test body BRF_TEST123 \bSe você não deseja mais receber nossos e-mails, cancele\b/i scoreBRF_TEST123 0.1 See here the message that qmail cant catch due to a CRLF in middle of text (right after word "se") but icewarp can

Re: DKIM domainkeys=fail (1024-bit key) reason="fail (message has been altered)"

2016-08-26 Thread Bowie Bailey
On 8/26/2016 11:34 AM, widowsoft wrote: I am sure this has been done to death but I would like to ban emails that show "domainkeys=fail (1024-bit key) reason="fail (message has been altered)"" any ideas please I have tried regex but i admit i am a novice i added header DKIM_FAIL ALL =~ /domaink

DKIM domainkeys=fail (1024-bit key) reason="fail (message has been altered)"

2016-08-26 Thread widowsoft
I am sure this has been done to death but I would like to ban emails that show "domainkeys=fail (1024-bit key) reason="fail (message has been altered)" " any ideas please I have tried regex but i admit i am a novice i added header DKIM_FAIL ALL =~ /domainkeys=fail (1024-bit key)/i score DKIM_FA

Re: Possible ignore CRLF?

2016-08-26 Thread Axb
On 08/26/2016 03:46 PM, Robert Boyl wrote: Hi, everyone! Just curious if anyone has had this issue before. We have a customer SA rule that catches certain text "se voce nao deseja mais receber..." We have an icewarp mail server where our rule hits just fine, DESPITE a CRLF after word "SE". Se

Possible ignore CRLF?

2016-08-26 Thread Robert Boyl
Hi, everyone! Just curious if anyone has had this issue before. We have a customer SA rule that catches certain text "se voce nao deseja mais receber..." We have an icewarp mail server where our rule hits just fine, DESPITE a CRLF after word "SE". See imagem showing that CRLF http://screenpress

Re: Financial domain list

2016-08-26 Thread Axb
On 08/26/2016 02:23 PM, Benny Pedersen wrote: On 2016-08-26 13:23, Axb wrote: I've commited 10_uridnsbl_skip_financial.cf to trunk. coopbank.dk jyskebank.dk sydbank.dk nordfynsbank.dk i know there is more, just cant remember them here now In the future, Please do not post domain lists to SA

Re: Financial domain list

2016-08-26 Thread Benny Pedersen
On 2016-08-26 13:23, Axb wrote: I've commited 10_uridnsbl_skip_financial.cf to trunk. coopbank.dk jyskebank.dk sydbank.dk nordfynsbank.dk i know there is more, just cant remember them here now

Re: Financial domain list

2016-08-26 Thread Axb
I've commited 10_uridnsbl_skip_financial.cf to trunk. Not yet sure if this should be included in default SA's ruleset. If interested, you can checkout from SVN or DL directly from: http://svn.apache.org/repos/asf/spamassassin/trunk/rulesrc/sandbox/axb/10_uridnsbl_skip_financial.cf This is work