Re: Fw: spam from gmail.com

2021-11-11 Thread Arne Jensen
Den 12-11-2021 kl. 00:43 skrev Loren Wilton: I have to admit I'd never paid much attention to the RCVD_IN_DNSWL_* scores on spam before. [...] Looking at spam for last month, [...] But I do have 12 pretty blatent spams that hit RCVD_IN_DNSWL_HI. It makes me wonder just how useful a rule it i

Re: Fw: spam from gmail.com

2021-11-11 Thread Arne Jensen
Den 11-11-2021 kl. 20:21 skrev Greg Troxel: It's a really interesting question what DNSWL_MED ought to be for score. Given what MED is supposed to be: Medium Rare spam occurrences, corrected promptly. -2.3 points seems entirely reasonable. But I don't see how gmail makes sense being

Re: Fw: spam from gmail.com

2021-11-11 Thread Benny Pedersen
On 2021-11-12 00:43, Loren Wilton wrote: [172.105.221. 77] li1875-77.members.linode.com [178. 79.178. 52] li347-52.members.linode.com imho its safe to reject *.members.linode.com with is default for all linode vps that only need a homepage :=)

Re: Fw: spam from gmail.com

2021-11-11 Thread Benny Pedersen
On 2021-11-11 21:15, Matija Nalis wrote: I guess you could disable default DNSWL_MED score with: score DNSWL_MED 0 and then create your own score: metaMY_DNSWL_MEDDNSWL_MED && !FREEMAIL_FROM score MY_DNSWL_MED-2.5 good rule if score DNSWL_MED is not zerro keep score DNSWL_ME

Re: Fw: spam from gmail.com

2021-11-11 Thread Loren Wilton
I have to admit I'd never paid much attention to the RCVD_IN_DNSWL_* scores on spam before. Looking at spam for last month, I don't have a single RCVD_IN_DNSWL_MED. But I do have 12 pretty blatent spams that hit RCVD_IN_DNSWL_HI. It makes me wonder just how useful a rule it is. Especially when

Re: Fw: spam from gmail.com

2021-11-11 Thread Matija Nalis
On Thu, Nov 11, 2021 at 02:21:06PM -0500, Greg Troxel wrote: > yes, what I really want is something like > > exclude_from_dnswlgmail I guess you could disable default DNSWL_MED score with: score DNSWL_MED 0 and then create your own score: metaMY_DNSWL_MEDDNSWL_MED && !FREEMAIL_FROM

Re: Fw: spam from gmail.com

2021-11-11 Thread Greg Troxel
Philipp Ewald writes: > You can report it. Gmail is on DNSWL > > @gmail.com> > RCVD_IN_DNSWL_MED=-2.3 > > https://www.dnswl.org/?page_id=17 I tried to find gmail being on DNSWL_MED and I haven't been able to. There are google.com servers on DNSWL_NONE. Can someone explain what addresses are

Re: spam from gmail.com

2021-11-11 Thread Greg Troxel
Bill Cole writes: >> I've ended up giving a point each to FREEMAIL_FROM and TO_GMAIL, which >> sort of nulls that out. > > Also: the DNSWL rules in the default ruleset are mis-scored, based > apparently on a Perceptron run early in the history of SA and DNSWL. I > don't know exactly how to fix t

Re: Fw: spam from gmail.com

2021-11-11 Thread Greg Troxel
Matus UHLAR - fantomas writes: >>>It would be really nice if there were an easy way to exclude a domain >>>from whitelist checks. > > On 11.11.21 17:24, Benny Pedersen wrote: >>add >> >>freemail_whitelist gmail.com >> >>to local.cf >> >> its not a whitelist, more a skip gmail.com as a freemail i

Re: Fw: spam from gmail.com

2021-11-11 Thread Matus UHLAR - fantomas
On 2021-11-11 13:56, Greg Troxel wrote: Philipp Ewald writes: You can report it. Gmail is on DNSWL @gmail.com> RCVD_IN_DNSWL_MED=-2.3 https://www.dnswl.org/?page_id=17 As far as i know DNSWL is used by default I've ended up giving a point each to FREEMAIL_FROM and TO_GMAIL, which sort of

Re: Fw: spam from gmail.com

2021-11-11 Thread Matija Nalis
I use DNSWLh spamassassin plugin from http://www.chaosreigns.com/dnswl/sa_plugin/ which allows that "spamassassin --report" also reports to DNSWL, thus improving DNSWL database for everybody. Also, I reduce effect of RCVD_IN_DNSWL_MED to -0.5 as default seems somewhat unreasonable. On Thu, 11

Re: Fw: spam from gmail.com

2021-11-11 Thread Benny Pedersen
On 2021-11-11 13:56, Greg Troxel wrote: Philipp Ewald writes: You can report it. Gmail is on DNSWL @gmail.com> RCVD_IN_DNSWL_MED=-2.3 https://www.dnswl.org/?page_id=17 As far as i know DNSWL is used by default I've ended up giving a point each to FREEMAIL_FROM and TO_GMAIL, which sort of

Re: spam from gmail.com

2021-11-11 Thread Bill Cole
On 2021-11-11 at 07:56:59 UTC-0500 (Thu, 11 Nov 2021 07:56:59 -0500) Greg Troxel is rumored to have said: > Philipp Ewald writes: > >> You can report it. Gmail is on DNSWL >> >> @gmail.com> >> RCVD_IN_DNSWL_MED=-2.3 >> >> https://www.dnswl.org/?page_id=17 >> >> As far as i know DNSWL is used by

Re: Fw: spam from gmail.com

2021-11-11 Thread Greg Troxel
Philipp Ewald writes: > You can report it. Gmail is on DNSWL > > @gmail.com> > RCVD_IN_DNSWL_MED=-2.3 > > https://www.dnswl.org/?page_id=17 > > As far as i know DNSWL is used by default I've ended up giving a point each to FREEMAIL_FROM and TO_GMAIL, which sort of nulls that out. It would be r

Re: Fw: spam from gmail.com

2021-11-11 Thread Noel Butler
This is _exactly_ why I zero out whitelists. A decent portion of spam being rejected here is from gmail, far more than from outlook and co. Trust can only be earned, not bought and not assumed, whitelists should have no place in SA, and why always use clear_uridnsbl_skip_domain On 11/11/202

Re: Fw: spam from gmail.com

2021-11-11 Thread Philipp Ewald
You can report it. Gmail is on DNSWL @gmail.com> RCVD_IN_DNSWL_MED=-2.3 https://www.dnswl.org/?page_id=17 As far as i know DNSWL is used by default On 11/8/21 7:27 PM, Rupert Gallagher wrote: Spammers are using gmail.com. Congratulations to Google for their fine work... Original Mes