Re: Fake EHLO triggering ALL_TRUSTED

2019-07-04 Thread David Jones
On 7/4/19 6:35 PM, Bill Cole wrote: > On 4 Jul 2019, at 16:59, David Jones wrote: > >> It seems like authenticated mail submission should only apply to >> internal_networks and not extend out to the trusted_networks. > > No. See https://wiki.apache.org/spamassassin/DynablockIssues. > > In short:

Re: Fake EHLO triggering ALL_TRUSTED

2019-07-04 Thread Bill Cole
On 4 Jul 2019, at 16:59, David Jones wrote: It seems like authenticated mail submission should only apply to internal_networks and not extend out to the trusted_networks. No. See https://wiki.apache.org/spamassassin/DynablockIssues. In short: if you don't trust the authentication of your

Re: Spamhaus Technology contributions to SpamAssassin

2019-07-04 Thread Bill Cole
On 3 Jul 2019, at 14:04, micah anderson wrote: Giovanni Bechis writes: [...] This has been superseded by https://svn.apache.org/repos/asf/spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/OLEMacro.pm the plugin is for trunk but it works out of the box in 3.4.3rc3 as well (some work is needed

Re: Fake EHLO triggering ALL_TRUSTED

2019-07-04 Thread David Jones
On 7/4/19 2:28 PM, RW wrote: > On Thu, 4 Jul 2019 19:11:43 + > David Jones wrote: > >> Just had a compromised account on one of my customer's mail servers >> (96.4.156.21) try to blast out phishing email. This 96.4 IP is our >> customer space so it's in my trusted_networks since it will not

Re: Fake EHLO triggering ALL_TRUSTED

2019-07-04 Thread RW
On Thu, 4 Jul 2019 19:11:43 + David Jones wrote: > Just had a compromised account on one of my customer's mail servers > (96.4.156.21) try to blast out phishing email. This 96.4 IP is our > customer space so it's in my trusted_networks since it will not forge > the Received header. This

Fake EHLO triggering ALL_TRUSTED

2019-07-04 Thread David Jones
Just had a compromised account on one of my customer's mail servers (96.4.156.21) try to blast out phishing email. This 96.4 IP is our customer space so it's in my trusted_networks since it will not forge the Received header. The 88.233 IP is from Turkey (88.233.47.16.dynamic.ttnet.com.tr)

Re: Spamhaus Technology contributions to SpamAssassin

2019-07-04 Thread Riccardo Alfieri
On 04/07/19 09:16, @lbutlr wrote: On 3 Jul 2019, at 05:08, Stephan Seitz wrote: By the way is this plugin necessary if you are using postfix/postscreen with your DQS key? That was my question as well. If you use Spamassassin I am surely suggesting to use it, even if you use ZEN to do

Re: Spamhaus Technology contributions to SpamAssassin

2019-07-04 Thread @lbutlr
On 3 Jul 2019, at 05:08, Stephan Seitz wrote: > By the way is this plugin necessary if you are using postfix/postscreen with > your DQS key? That was my question as well.