Re: Did the whitelist_from_rcvd semantics change?

2023-04-28 Thread Philip Prindeville
> On Apr 28, 2023, at 10:24 AM, Reindl Harald wrote: > > > > Am 28.04.23 um 18:11 schrieb Philip Prindeville: >>> On Apr 25, 2023, at 6:28 AM, Bill Cole >>> wrote: >>> >>> On 2023-04-24 at 16:32:55 UTC-0400 (Mon, 24 Apr 2023 14:32:55 -0600) >>> Philip Prindeville >>> is rumored to have

Re: Assistance with rule

2023-04-28 Thread Matus UHLAR - fantomas
On 28.04.23 12:11, Joey J wrote: I haven't written many of these with Meta, but wanted to make sure how this works. If the meta FROM_TEST from FROM_TEST_EMAIL && FROM_TEST_IP is false, does that mean the next line score will not be added/executed? In my mind, I feel like (top down logic ) the

Re: Did the whitelist_from_rcvd semantics change?

2023-04-28 Thread Bill Cole
On 2023-04-28 at 12:11:02 UTC-0400 (Fri, 28 Apr 2023 10:11:02 -0600) Philip Prindeville is rumored to have said: On Apr 25, 2023, at 6:28 AM, Bill Cole wrote: On 2023-04-24 at 16:32:55 UTC-0400 (Mon, 24 Apr 2023 14:32:55 -0600) Philip Prindeville is rumored to have said: I thought the

Re: Assistance with rule

2023-04-28 Thread Joey J
I haven't written many of these with Meta, but wanted to make sure how this works. If the meta FROM_TEST from FROM_TEST_EMAIL && FROM_TEST_IP is false, does that mean the next line score will not be added/executed? In my mind, I feel like (top down logic ) the score will happen all the time.

Re: Did the whitelist_from_rcvd semantics change?

2023-04-28 Thread Philip Prindeville
> On Apr 25, 2023, at 6:28 AM, Bill Cole > wrote: > > On 2023-04-24 at 16:32:55 UTC-0400 (Mon, 24 Apr 2023 14:32:55 -0600) > Philip Prindeville > is rumored to have said: > >> I thought the matching included subdomains, and seem to remember that >> working. > > It never has. At least not

Re: FROM_RETURNPATH_MISMATCH

2023-04-28 Thread Joey J
Thank you all. Someone internally must have seen that rule and added it, I think I'm going to pull it out as it has way too many false positives. I took the assumption (we know) that it was one of the base rules. On Fri, Apr 28, 2023 at 11:43 AM Matus UHLAR - fantomas wrote: > On 28.04.23

Re: Assistance with rule

2023-04-28 Thread Matus UHLAR - fantomas
On 28.04.23 11:04, Joey J wrote: I have this rule which I thought looked good, but doesn't seem to ever kick in. header FROM_TEST_IP_AND_EMAIL From =~ /sender@sender\.com/i && Received =~ /from 138\.193\.30\.7/ I was hoping to find the senders email address, then if it's found, see the

Re: FROM_RETURNPATH_MISMATCH

2023-04-28 Thread Bill Cole
On 2023-04-28 at 10:58:52 UTC-0400 (Fri, 28 Apr 2023 10:58:52 -0400) Joey J is rumored to have said: Hello All, I'm trying to understand why SA keeps scoring this rule, when the sender only has their from address, no reply to etc, nothing helping me to understand why. I'm guessing here,

Re: FROM_RETURNPATH_MISMATCH

2023-04-28 Thread Matus UHLAR - fantomas
On 28.04.23 10:58, Joey J wrote: I'm trying to understand why SA keeps scoring this rule, when the sender only has their from address, no reply to etc, nothing helping me to understand why. I'm guessing here, but this would be where the reply to differs from the from? Any assistance

Assistance with rule

2023-04-28 Thread Joey J
Hello all, I have this rule which I thought looked good, but doesn't seem to ever kick in. header FROM_TEST_IP_AND_EMAIL From =~ /sender@sender\.com/i && Received =~ /from 138\.193\.30\.7/ score FROM_TEST_IP_AND_EMAIL -8.0 I was hoping to find the senders email address, then if it's found, see

FROM_RETURNPATH_MISMATCH

2023-04-28 Thread Joey J
Hello All, I'm trying to understand why SA keeps scoring this rule, when the sender only has their from address, no reply to etc, nothing helping me to understand why. I'm guessing here, but this would be where the reply to differs from the from? Any assistance appreciated. -- Thanks! Joey