Re: Assistance needed

2016-10-18 Thread Axb
On 10/18/2016 09:08 AM, Sue Mey wrote: Here is a Printscreen of the Spam score: printscreen? what happened to good old copy/paste? Your report doesn't show which rule hit, which is pretty lame nor any debug data to prove it's an uptodate rule which is hitting. As their paying user, sugg

Re: Assistance needed

2016-10-18 Thread Axb
Also: They score URIBL Grey 1.10 but SA's score is score URIBL_GREY 0 1.084 0 0.424 "whtelisted domain" with that score isn't something SA default SA would do. If thy can't affford to support the report they show you, why should volunteers do it? for free? On 10/18/2016 09:17 AM, Axb wrote:

RE: Assistance needed

2016-10-18 Thread Sue Mey
Spam score details (in lieu of printscreen). I tried GetResonse help first but they seem stumped as to the reason for this. In the meantime I am just stuck. Spam Assassin results description points Contains an URL listed in the URIBL greylist 1.10 Sender domain is commonly abused freem

Re: Assistance needed

2016-10-18 Thread Axb
On 10/18/2016 09:28 AM, Sue Mey wrote: Spam score details (in lieu of printscreen). I tried GetResonse help first but they seem stumped as to the reason for this. In the meantime I am just stuck. ... so take your business somewhere else... with staff which isn't stumped by the tools they use.

Re: The real spoofing issue (was Re: How to get spam assassin to detect spoofed mails as SPF is clearly useless)

2016-10-18 Thread Dianne Skoll
On October 18, 2016 2:27:09 AM EDT, Ruga wrote: >Yes, you can prefix a quoted string to the actual address. No, the >quoted string is not part of the address. Indeed. >There are two approaches here: one is to defend the spammer's abuse of >the standard (intended to trick the average Joe into b

Re: The real spoofing issue (was Re: How to get spam assassin to detect spoofed mails as SPF is clearly useless)

2016-10-18 Thread Dianne Skoll
On October 18, 2016 2:09:37 AM EDT, Ruga wrote: >RFC 2822 and 5322 are in the "Standards Track". >RFC 822 is still the standard. Interesting, but the example is still RFC-compliant, even with 822. Regards, Dianne.

RE: Assistance needed

2016-10-18 Thread Sue Mey
Wow. So sorry I bothered you guys. -Original Message- From: Axb [mailto:axb.li...@gmail.com] Sent: 18 October 2016 09:35 AM To: users@spamassassin.apache.org Subject: Re: Assistance needed On 10/18/2016 09:28 AM, Sue Mey wrote: > Spam score details (in lieu of printscreen). I tried GetR

Re: Assistance needed

2016-10-18 Thread Axb
On 10/18/2016 10:46 AM, Sue Mey wrote: Wow. why wow? So sorry I bothered you guys. You didn't bother anyone, otherwise you would have been ignored. 100% -Original Message- From: Axb [mailto:axb.li...@gmail.com] Sent: 18 October 2016 09:35 AM To: users@spamassassin.apache.org Subj

Re: The real spoofing issue

2016-10-18 Thread Ralph Seichter
On 18.10.16 00:52, Ruga wrote: > https://tools.ietf.org/html/rfc5322#section-3.6.2 The header line From: "John Doe " does not violate the RFC section you linked. It may be unusual, and you are of course free to personally (!) use it as a spam indicator, but it is definitely RFC-compliant, so

Re: Assistance needed

2016-10-18 Thread RW
On Tue, 18 Oct 2016 09:17:31 +0200 Axb wrote: > Your report doesn't show which rule hit, The rule description is for FB_CIALIS_LEO3. It's not in the current rules set.

Re: Assistance needed

2016-10-18 Thread Axb
On 10/18/2016 01:22 PM, RW wrote: On Tue, 18 Oct 2016 09:17:31 +0200 Axb wrote: Your report doesn't show which rule hit, The rule description is for FB_CIALIS_LEO3. It's not in the current rules set. Thanks! Speaks for Getresponse's "Spam Assassin" thingie .-)

Re: The real spoofing issue (was Re: How to get spam assassin to detect spoofed mails as SPF is clearly useless)

2016-10-18 Thread Dianne Skoll
On Tue, 18 Oct 2016 02:06:38 -0400 Ruga wrote: > < does not belong to the author(s) of the message.>> A Quoted-String phrase is NOT a mailbox. It's just a quoted string that is not subject to any further interpretation. Regards, Dianne.

Re: The real spoofing issue (was Re: How to get spam assassin to detect spoofed mails as SPF is clearly useless)

2016-10-18 Thread Joseph Brennan
--On October 18, 2016 at 02:06:38 -0400 Ruga wrote: > > > ... unless you're applying DMARC, which says the "From:" should instead "align" with something other than the author of the message in some cases. --Joseph Brennan

Re: Assistance needed

2016-10-18 Thread Kris Deugau
Sue Mey wrote: > Here is a Printscreen of the Spam score: Screenshots are generally frowned on since anyone who might do some quick inspection and testing can't then copy-paste any relevant fragments for local testing. Also, attached images bulk up a message quite a lot. > Below is the body of m

RE: Assistance needed

2016-10-18 Thread John Hardin
On Tue, 18 Oct 2016, Sue Mey wrote: Spam score details (in lieu of printscreen). I tried GetResonse help first but they seem stumped as to the reason for this. In the meantime I am just stuck. Spam Assassin results description points BODY: Uses a mis-spelled version of cialis. 3.10 Absent

Re: Assistance needed

2016-10-18 Thread shanew
On Tue, 18 Oct 2016, Kris Deugau wrote: I saved the message and dug up a copy of the FB_CIALIS_LEO3 rule RW mentioned; I note that as he said it's not part of the current live rules, and in fact checking further it looks like it's been commented out entirely in the rules development sandbox, so

Re: Assistance needed

2016-10-18 Thread John Hardin
On Tue, 18 Oct 2016, Kris Deugau wrote: Sue Mey wrote: dbg: rules: ran body rule FB_CIALIS_LEO3 ==> got hit: "Calm All is" (from "NW1826 All is Calm All is Bright") Try: "NW1826 All is Calm, All is Bright" The comma will bypass that rule until GetResponse fixes their systems. -- Joh

RE: Assistance needed

2016-10-18 Thread Sue Mey
Thank you! Best Regards Sue Mey -Original Message- From: John Hardin [mailto:jhar...@impsec.org] Sent: 18 October 2016 06:36 PM To: spamassassin-users Subject: Re: Assistance needed On Tue, 18 Oct 2016, Kris Deugau wrote: > Sue Mey wrote: > > dbg: rules: ran body rule FB_CIALIS_LEO3

How to create a URIBL

2016-10-18 Thread Alex
Hi, I've collected a bunch of URIs that I'd like to incorporate into my rulebase. I know how to create a DNSBL, but I don't specifically know how to create a URIBL. Can I use rbldnsd for this? Or would I have to extract the IP or hostname from the URL, then also use a bunch of uri rules? If so, is

Re: How to create a URIBL

2016-10-18 Thread Joe Quinn
On 10/18/2016 6:21 PM, Alex wrote: Hi, I've collected a bunch of URIs that I'd like to incorporate into my rulebase. I know how to create a DNSBL, but I don't specifically know how to create a URIBL. Can I use rbldnsd for this? Or would I have to extract the IP or hostname from the URL, then als

Re: How to create a URIBL

2016-10-18 Thread Rob McEwen
Alex, here are some suggestions: In your rbldnsd-formatted file, put a dot at the beginning, which serves as a wildcard. So your three examples: 109 .73 .134 .241 51steel1 .org amessofblues1 .com (I added spaces here to evade spam filtering, but those spaces shouldn't actually be there)

Re: How to create a URIBL

2016-10-18 Thread Alex
Hi, > (2) the fact that the IP is in reverse order. How do you then enter ranges? For example, one of the rbldnsd zone examples I've seen have entries such as: 1.168.160.0-255 That does not look to be in reverse order, as the host octet is still last. > foo.example.com:127.0.0.2:Blocked System

PYZOR_CHECK always have zero score, why?

2016-10-18 Thread Pedro David Marco
Hi! It seems PYZOR_CHECK rule is not being used in my SA Just installed SA and Pyzor in a Debian and executed  "pyzor discover."In Debian pyzor is enabled by default so nothing to add in local.cf. Command "pyzor check < emailfile.eml" works ok. .. now i try to test SA in debug mode like thi

Re: PYZOR_CHECK always have zero score, why?

2016-10-18 Thread Bill Cole
On 18 Oct 2016, at 23:22, Pedro David Marco wrote: So Pyzor seems to be OK!... the problem is somehow related to PYZOR_CHECK rule but why???  Some config file is being loaded that sets the score of PYZOR_CHECK to 0. It is NOT 0 in the current default ruleset: 50_scores.cf:score PYZOR_CHECK

Re: PYZOR_CHECK always have zero score, why?

2016-10-18 Thread Pedro David Marco
Thanks Bill.. i already did but still no clues... Files in my Debian SA package (3.4.1) containing the string PYZOR_CHECK: # for i in `dpkg -L spamassassin`; do grep -l PYZOR_CHECK $i 2>/dev/null ; done/usr/share/spamassassin/30_text_fr.cf/usr/share/spamassassin/30_text_pl.cf/usr/share/spamassassi

Re: PYZOR_CHECK always have zero score, why?

2016-10-18 Thread John Hardin
On Wed, 19 Oct 2016, Pedro David Marco wrote: Files in my Debian SA package (3.4.1) containing the string PYZOR_CHECK: Run debug mode and look for the list of config files it's actually reading. What comes after the default 50_scores.cf? i have even looked for the string PYZOR_CHECK through

Re: PYZOR_CHECK always have zero score, why?

2016-10-18 Thread Pedro David Marco
Thanks John... this is the list: Oct 19 06:58:33.422 [28083] dbg: config: using "/var/lib/spamassassin/3.004001/updates_spamassassin_org/50_scores.cf" for included fileOct 19 06:58:33.437 [28083] dbg: config: using "/var/lib/spamassassin/3.004001/updates_spamassassin_org/60_adsp_override_dkim.cf