Re: Spam bounceback attack

2007-04-09 Thread Jamie L. Penman-Smithson
On 9 Apr 2007, at 15:18, J. wrote: --- ram [EMAIL PROTECTED] wrote: snip 1) Verify recipient addresses 2) Add SPF records for your domain. And blacklist those servers who accept forged mails from your domain and bounce them 3) If you are suddenly facing a flush of Mailer-Demons give a

Re: Problem with false-positives for SASL users

2006-06-30 Thread Jamie L. Penman-Smithson
On 30 Jun 2006, at 23:25, Daryl C. W. O'Shea wrote: martin f krafft wrote: snip Sure you do... at least auth headers that you know you added. Your problem is that Postfix doesn't include RFC 3848 style (or any) auth tokens. This TLS line is only added when someone authenticates

Re: Problem with false-positives for SASL users

2006-06-30 Thread Jamie L. Penman-Smithson
On 1 Jul 2006, at 00:32, Daryl C. W. O'Shea wrote: Jamie L. Penman-Smithson wrote: It's better to look at the 'Authenticated sender': Received: from bar.example.org (bar.example.org [127.0.0.1]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present

Re: SPF Verifying email

2006-06-22 Thread Jamie L. Penman-Smithson
Hi there, On 22 Jun 2006, at 15:47, Tracey Gates wrote: I've been reading up on SPF and understand that it checks the validity of the return address of an email and if that return address is valid, it doesn't change the scoring of the email to identify it as spam...a wash so to speak. If

Re: Adding Phishing Link rule

2006-06-19 Thread Jamie L. Penman-Smithson
On 19 Jun 2006, at 17:26, Chris Santerre wrote: Still I don't know how to create a rule like this. But as someone else in the bug tracker already mentioned a year ago, what SpamAssassin misses to do things like that is a 'rawbody' match that uses the entire message, not only single

Re: New spam type - sender domain quickly deleted

2006-06-12 Thread Jamie L. Penman-Smithson
On 12 Jun 2006, at 07:53, Michael Monnerie wrote: yesterday I've got some new kind of spam: X-Envelope-From: [EMAIL PROTECTED] Received: from abruxateatro.com (unknown [210.245.161.31]) by power2u.goelsen.net (Postfix) with SMTP id for _; Sun, 11 Jun

Re: Gmail spam

2006-06-09 Thread Jamie L. Penman-Smithson
On 9 Jun 2006, at 13:56, Jason Staudenmayer wrote: Is anyone else getting spam from gmail? The ones I'm getting are very lengthy but doesn't look like bayes poison. It's _not from_ GMail. snip Received: from unknown (HELO 192.168.0.4) (66.148.73.132) by mail2.adventureaquarium.com with

Re: Hiring for Spam Assassin Troubleshooting

2006-06-04 Thread Jamie L. Penman-Smithson
On 4 Jun 2006, at 18:35, WFGB Team wrote: Yes, we have someone looking into that this Wednesday to give us a quote on that. However the original issue was SPAM assassin detecting our own emails as SPAM. That issue has been resolved and therefore closing out the thread. All uppercase

Re: Lots of this kind of spam getting through

2006-05-27 Thread Jamie L. Penman-Smithson
On 27 May 2006, at 19:09, Philip Mak wrote: I'm getting about 50+ per day of these spams not being caught by SpamAssassin (SpamAssassin version 3.1.1 running on Perl version 5.8.4). There's two types: snip These spams all have different URLs, but if you visit them they're exactly the same

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-25 Thread Jamie L. Penman-Smithson
On 25 May 2006, at 16:31, Kai Schaetzl wrote: Mike Jackson wrote on Wed, 24 May 2006 08:44:17 -0700: Personally, I have those two rules zero-scored in my local.cf. Even though I like RFCI, and use their bogusmx and dsn lists at the MTA level, these two create too many false positives.

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-25 Thread Jamie L. Penman-Smithson
On 25 May 2006, at 20:31, Kai Schaetzl wrote: Jamie L. Penman-Smithson wrote on Thu, 25 May 2006 17:12:07 +0100: .de does not have a working WHOIS server, that's fundamentally broken: No, *your* whois client is outdated and broken. Agreed, it works in a later version. snip

Re: false scoring for DNS_FROM_RFC_ABUSE

2006-05-25 Thread Jamie L. Penman-Smithson
On 25 May 2006, at 21:54, Magnus Holmgren wrote: On Thursday 25 May 2006 21:31, Kai Schaetzl took the opportunity to write: Jamie L. Penman-Smithson wrote on Thu, 25 May 2006 17:12:07 +0100: .de does not have a working WHOIS server, that's fundamentally broken: No, *your* whois client