Re: TxRep does not evaluate EMAIL_IP reputation

2024-06-03 Thread giovanni
On 6/3/24 1:10 AM, Tomohiro Hosaka wrote: Slight correction. 2024-06-03 07:55 に Tomohiro Hosaka さんは書きました: Here $rc is dualvar. https://metacpan.org/pod/DBI#execute This is not dualvar, exactly. However, the patch is unchanged. Evaluated as a bool, it is "0E0" true; evaluated as a number, it

Re: Lots of FN because of VALIDITY* rules

2024-06-03 Thread Matus UHLAR - fantomas
On 03.06.24 07:26, postgarage Graz IT wrote: A few days ago a lot of false negatives landed in our inboxes. As it turned out the reason was that the for nearly all mails the RCVD_IN_VALIDITY_CERTIFIED and RCVD_IN_VALIDITY_SAFE rules matched. I now know that validity introduced a query limit wh

Re: Lots of FN because of VALIDITY* rules

2024-06-03 Thread Matus UHLAR - fantomas
On 03.06.24 12:02, Matus UHLAR - fantomas wrote: On 03.06.24 07:26, postgarage Graz IT wrote: A few days ago a lot of false negatives landed in our inboxes. As it turned out the reason was that the for nearly all mails the RCVD_IN_VALIDITY_CERTIFIED and RCVD_IN_VALIDITY_SAFE rules matched. I

DKIM length 'l=' tag

2024-06-03 Thread Andrew C Aitchison
The DKIM RFC https://datatracker.ietf.org/doc/html/rfc6376#section-8.2 tells us that it is not safe to rely on the DKIM length (l=) tag and https://www.zone.eu/blog/2024/05/17/bimi-and-dmarc-cant-save-you/ shows how it can be used to subvert BIMI*. I am looking at extending Mail::SpamAssa

RE: DKIM length 'l=' tag

2024-06-03 Thread Marc
> > > The DKIM RFC > https://datatracker.ietf.org/doc/html/rfc6376#section-8.2 > tells us that it is not safe to rely on the DKIM length (l=) tag > and > https://www.zone.eu/blog/2024/05/17/bimi-and-dmarc-cant-save-you/ > shows how it can be used to subvert BIMI*. > > I am looking at ex

Re: Lots of FN because of VALIDITY* rules

2024-06-03 Thread postgarage Graz IT
On 6/3/24 12:02, Matus UHLAR - fantomas wrote: > On 03.06.24 07:26, postgarage Graz IT wrote: >> A few days ago a lot of false negatives landed in our inboxes. As it >> turned out the reason was that the for nearly all mails the >> RCVD_IN_VALIDITY_CERTIFIED and RCVD_IN_VALIDITY_SAFE rules matc

Re: Lots of FN because of VALIDITY* rules

2024-06-03 Thread Bill Cole
On 2024-06-03 at 01:26:31 UTC-0400 (Mon, 3 Jun 2024 07:26:31 +0200) postgarage Graz IT is rumored to have said: Now for my questions: *) as is stated in active.list it should not be edited. What's the correct place to add the new rules to activate them? local.cf? Yes. In your local version o

Re: Lots of FN because of VALIDITY* rules

2024-06-03 Thread Bill Cole
On 2024-06-03 at 08:35:32 UTC-0400 (Mon, 3 Jun 2024 14:35:32 +0200) postgarage Graz IT is rumored to have said: I think that the active.list file should be updated, when there are new rules, shouldn't it? It is updated where it is actually used, on the ASF rule maintenance system. It is irre

Re: DKIM length 'l=' tag

2024-06-03 Thread Bill Cole
On 2024-06-03 at 07:05:29 UTC-0400 (Mon, 3 Jun 2024 12:05:29 +0100 (BST)) Andrew C Aitchison is rumored to have said: The DKIM RFC https://datatracker.ietf.org/doc/html/rfc6376#section-8.2 tells us that it is not safe to rely on the DKIM length (l=) tag Never has been safe. Terrible idea

Re: DKIM length 'l=' tag

2024-06-03 Thread John Levine
It appears that Bill Cole said: >Never has been safe. Terrible idea from the start. Never should have >been included in the specification. Agreed. >I was thinking of the same thing in a half-assed way, just catching >anything using the length tag. I'd bet that correlates to spam but we'd >nee