Re: Filtering at border routers: Is it possible?

2019-03-22 Thread Anthony Hoppe
Not knowing the details of your environment... Instead of taking on the job of filtering email for all of your clients (this, to me, will open up a can of worms), why not set a policy that port 25 is blocked by default and customers must request for it to be unblocked? You can then build a li

Re: Negative rule score not working as expected

2017-05-11 Thread Anthony Hoppe
- On May 11, 2017, at 8:04 AM, Anthony Hoppe aho...@sjcourts.org wrote: > - On May 11, 2017, at 6:02 AM, RW rwmailli...@googlemail.com wrote: > >> On Thu, 11 May 2017 12:19:37 + >> David Jones wrote: >> >>> From: Anthony Hoppe >>>   >

Re: Negative rule score not working as expected

2017-05-11 Thread Anthony Hoppe
- On May 11, 2017, at 6:02 AM, RW rwmailli...@googlemail.com wrote: > On Thu, 11 May 2017 12:19:37 + > David Jones wrote: > >> From: Anthony Hoppe >>   >> >Can I whitelist based on a combination of the Received header and >> >domain in the Ret

Re: Negative rule score not working as expected

2017-05-11 Thread Anthony Hoppe
- On May 11, 2017, at 5:14 AM, RW rwmailli...@googlemail.com wrote: > On Wed, 10 May 2017 21:09:17 -0700 (PDT) > Anthony Hoppe wrote: > > >> Here are headers from one of the messages: >> https://pastebin.com/ijy9Z51y > > > X-Spam-Status:

Re: Negative rule score not working as expected

2017-05-10 Thread Anthony Hoppe
ssage - From: "Alex" To: "Anthony Hoppe" , "SpamAssassin" Sent: Wednesday, May 10, 2017 5:41:37 PM Subject: Re: Negative rule score not working as expected Hi, > headerAH_KNOWBE4 Received=~ /phishtest\.knowbe4\.com/ > score AH_KNOWBE4 score -10.0

Re: Negative rule score not working as expected

2017-05-10 Thread Anthony Hoppe
, 2017 5:02:11 PM Subject: Re: Negative rule score not working as expected On Thu, 11 May 2017, Benny Pedersen wrote: > Anthony Hoppe skrev den 2017-05-11 00:55: >> I'm trying to implement a very simple rule that looks at the >> "Received" header(s) and if a string is

Re: Negative rule score not working as expected

2017-05-10 Thread Anthony Hoppe
...and now it works as expected. Thank you all for listening. :-D - Original Message - From: "Anthony Hoppe" To: "SpamAssassin" Sent: Wednesday, May 10, 2017 3:58:57 PM Subject: Re: Negative rule score not working as expected Oh my chuck, I am such an idiot. My

Re: Negative rule score not working as expected

2017-05-10 Thread Anthony Hoppe
Oh my chuck, I am such an idiot. My score line is wrong. This would be more appropriate: score AH_KNOWBE4 -10.0 I guess it just took me posting here to notice. Whoops! - Original Message - From: "Anthony Hoppe" To: "SpamAssassin" Sent: Wednesday, May 10, 201

Negative rule score not working as expected

2017-05-10 Thread Anthony Hoppe
I'm trying to implement a very simple rule that looks at the "Received" header(s) and if a string is found apply a negative score. The rule is as follows: headerAH_KNOWBE4 Received=~ /phishtest\.knowbe4\.com/ score AH_KNOWBE4 score -10.0 describe AH_KNOWBE4 Prevents KnowBe4 campaign

Re: SoughtRules

2016-08-30 Thread Anthony Hoppe
gt; >> Am 30.08.2016 um 02:45 schrieb John Hardin: >>> On Mon, 29 Aug 2016, Anthony Hoppe wrote: >>> >>>> I just learned about the sought ruleset via >>>> https://wiki.apache.org/spamassassin/ImproveAccuracy. Is this ruleset >>>> still activ

Re: SoughtRules

2016-08-30 Thread Anthony Hoppe
ot;SpamAssassin" Sent: Monday, August 29, 2016 5:51:29 PM Subject: Re: SoughtRules Am 30.08.2016 um 02:45 schrieb John Hardin: > On Mon, 29 Aug 2016, Anthony Hoppe wrote: > >> I just learned about the sought ruleset via >> https://wiki.apache.org/spamassassin/ImproveAccuracy

SoughtRules

2016-08-29 Thread Anthony Hoppe
I just learned about the sought ruleset via https://wiki.apache.org/spamassassin/ImproveAccuracy. Is this ruleset still actively maintained? I'm considering implementing it in my environment, but want to make sure just in case. Thanks!

Re: Spoofed Domain

2016-08-09 Thread Anthony Hoppe
Our mail setup (Zimbra) uses postfix. - Original Message - From: "John Hardin" To: "SpamAssassin" Sent: Tuesday, August 9, 2016 4:20:22 PM Subject: Re: Spoofed Domain On Tue, 9 Aug 2016, Anthony Hoppe wrote: > Though I think I'd rather just reject...t

Re: Spoofed Domain

2016-08-09 Thread Anthony Hoppe
ges should always be coming from itself (single mail server setup here). I see how SPF may not be so reliable. From: "Vincent Fox" To: "Anthony Hoppe" Cc: "SpamAssassin" Sent: Tuesday, August 9, 2016 3:51:32 PM Subject: Re: Spoofed Domain You co

Re: Spoofed Domain

2016-08-09 Thread Anthony Hoppe
When you say SPF is not a good tool for filtering, do you mean that it shouldn't be used at all? Or if SPF_FAIL is triggered that an email should be rejected altogether? From: "Vincent Fox" To: "Anthony Hoppe" , "SpamAssassin" Sent: Tuesday, Aug

Re: Spoofed Domain

2016-08-09 Thread Anthony Hoppe
Hmm, that's not a bad idea for this particular instance. I may do that. From: "Rob McEwen" To: "SpamAssassin" Sent: Tuesday, August 9, 2016 3:01:57 PM Subject: Re: Spoofed Domain On 8/9/2016 5:56 PM, Anthony Hoppe wrote: > Here are the headers as an exa

Spoofed Domain

2016-08-09 Thread Anthony Hoppe
Hello All, Although I've been a member of this list for a while, I'm still very much a n00b when it comes to SpamAssassin. So please keep that in mind when you read my message (don't hurt me!)... :-) Someone out there has decided to spoof our domain and send us spam. My first thought was tha

Accidental Spam Forward

2016-05-31 Thread Anthony Hoppe
All, I accidentally forwarded some spam to this list. Autocomplete got the best of me and I chose "spamassassin" instead of "spamcop" in the "TO" field of the message. I haven't received the message myself (not sure if I will), but wanted to apologize in case any of you got it. Happy, uh, Tu

Re: Repository of rules

2015-09-08 Thread Anthony Hoppe
Awesome. Thank you! From: "Joe Quinn" To: "SpamAssassin" Sent: Tuesday, September 8, 2015 8:26:55 AM Subject: Re: Repository of rules On 9/8/2015 11:13 AM, Anthony Hoppe wrote: Hey All, This is likely a n00b question, so I apologize. I've been a member

Repository of rules

2015-09-08 Thread Anthony Hoppe
Hey All, This is likely a n00b question, so I apologize. I've been a member of this list for a while. Periodically, I see rules develop based on submissions of samples from other members. Is there, by chance, a repository of rules like that somewhere I can reference? I'm not often able to ke

Re: Civility [WAS: Re: Can not disable checks against dnsbl.ahbl.org]

2015-01-09 Thread Anthony Hoppe
Amir, I couldn't have said it better myself. I agree 100%. Not only is this type of communication disrespectful to the OP, it is just as disrespectful to the other members of this list as it is clogging their inboxes with garbage. It does not contribute to the usefulness or helpfulness of thi

Re: Rule to check To and/or CC headers

2013-03-04 Thread Anthony Hoppe
not sure how check_mailfrom_matches_rcvd() functions and what it returns if true/false. Thanks! Anthony Hoppe IS Support Technician II Menlo Park City School District (650) 321-7140 ext. 5272 aho...@mpcsd.org - Original Message - From: "Mark Martinec" To: users@spamassassin.apache.

Re: Rule to check To and/or CC headers

2013-03-01 Thread Anthony Hoppe
ame pattern, u...@domain.com exists both in the Return Path AND the From field. Anthony Hoppe IS Support Technician II Menlo Park City School District (650) 321-7140 ext. 5272 aho...@mpcsd.org - Original Message - From: "Dave Warren" To: users@spamassassin.apache.org Se

Rule to check To and/or CC headers

2013-03-01 Thread Anthony Hoppe
think being able to use this to add just a teeny bit to the spam score will help complement some of our current rules. Thanks! ~ Anthony Anthony Hoppe IS Support Technician II Menlo Park City School District (650) 321-7140 ext. 5272 aho...@mpcsd.org

Re: Yahoo single link spam

2013-03-01 Thread Anthony Hoppe
We don't see them as much as we used to, but they still make an appearance every once and a while. ~ Anthony - Original Message - From: "David F. Skoll" To: users@spamassassin.apache.org Sent: Friday, March 1, 2013 9:33:55 AM Subject: Re: Yahoo single link spam Somewhat OT... are peop