Re: FORGED_HOTMAIL_RCVD2 false positive

On 01/29/18 06:00, Alex wrote: > Hi, > >> FORGED_HOTMAIL_RCVD2 (hotmail.com 'From' address, but no 'Received:') >> triggers for valid hotmail messages... (SA 3.4.1) >> >> This small change solves the problem but i do not know whether it is the >> correct way...maybe "hotmail" string should be

Re: FORGED_HOTMAIL_RCVD2 false positive

Hi, > FORGED_HOTMAIL_RCVD2 (hotmail.com 'From' address, but no 'Received:') > triggers for valid hotmail messages... (SA 3.4.1) > > This small change solves the problem but i do not know whether it is the > correct way...maybe "hotmail" string should be changed widelly to > "outlook|hotmail".

Re: Shortcircuit reports only 1 test

Now I see that whitelist_from_rcvd is probably the best all around. As explained here: *whitelist_from_rcvd a...@lists.sourceforge.net  sourceforge.net* Works similarly to whitelist_from, except that in addition to matching a sender address, a relay's r

Shortcircuit reports only 1 test

I will try my best to explain a subset of this project in greater detail without going into too much detail as you never know who is on this list. Assume all of the following: An smtp server that always accepts email but never sends email. Mailboxes with unique user names such that it would be hi

Re: Shortcircuit reports only 1 test

On 01/28/2018 02:25 PM, Benny Pedersen wrote: Chip skrev den 2018-01-28 21:01: I see that makes sense.  Thanks for the clarity. However how do you get to 150? good DKIM = 100 good SPF = 100 That totals 200 one more reason not to use it use domain based whitelist_auth not just global all th

Re: Shortcircuit reports only 1 test

Chip skrev den 2018-01-28 21:01: I see that makes sense.  Thanks for the clarity. However how do you get to 150? good DKIM = 100 good SPF = 100 That totals 200 one more reason not to use it use domain based whitelist_auth not just global all that is dkim pass or spf pass if you want spam

Re: Shortcircuit reports only 1 test

Ah, yes, it's coming together now.  Thanks for the tutorial.  I'm assuming when you say "less than" and you are working with negative numbers, that the less than moves the score towards, for example, -200 from a for example, -150. On 01/28/2018 03:12 PM, David Jones wrote: > On 01/28/2018 02:09 PM

Re: Shortcircuit reports only 1 test

On 01/28/2018 02:09 PM, David Jones wrote: On 01/28/2018 02:01 PM, Chip wrote: I see that makes sense.  Thanks for the clarity. However how do you get to 150? good DKIM = 100 good SPF = 100 That totals 200 Think about it for a minute.  We are talking about negative numbers. There could be

Re: Shortcircuit reports only 1 test

On 01/28/2018 02:01 PM, Chip wrote: I see that makes sense.  Thanks for the clarity. However how do you get to 150? good DKIM = 100 good SPF = 100 That totals 200 Think about it for a minute. We are talking about negative numbers. There could be some spam hits that add a few points to a n

Re: Shortcircuit reports only 1 test

I see that makes sense.  Thanks for the clarity. However how do you get to 150? good DKIM = 100 good SPF = 100 That totals 200 On 01/28/2018 02:53 PM, David Jones wrote: > On 01/28/2018 12:36 PM, Chip wrote: >> I have the following in local.cf >> >> shortcircuit DKIM_VALID_AU on >> shortcircui

Re: Shortcircuit reports only 1 test

On 01/28/2018 12:36 PM, Chip wrote: I have the following in local.cf shortcircuit DKIM_VALID_AU on shortcircuit SPF_PASS on score DKIM_VALID_AU -100 score SPF_PASS -100 Just to be clear about these settings above for new SA users, this is not recommended. This is a very special need that he

Re: Shortcircuit reports only 1 test

Chip skrev den 2018-01-28 19:36: I have the following in local.cf shortcircuit DKIM_VALID_AU on shortcircuit SPF_PASS on score DKIM_VALID_AU -100 score SPF_PASS -100 The question is are all triggers reported in headers (DKIM and SPF), or just some? if you want to have both use: meta DMARC_SC

Shortcircuit reports only 1 test

I have the following in local.cf shortcircuit DKIM_VALID_AU on shortcircuit SPF_PASS on score DKIM_VALID_AU -100 score SPF_PASS -100 The question is are all triggers reported in headers (DKIM and SPF), or just some? A look at the logs and SA headers shows: Logs: 2018-01-28 13:24:05 1efrcb-0001

Re: Scoring Issues

On 27/01/2018 19:29, Ralph Seichter wrote: I trust you are aware that you actually penalise senders which pass the SPF check if you use a greater-than-zero score? Minus signs matter. ;-) Sure it's a "penalization", but of an order of magnitude so little that a minus, albeit more logically cor