Re: "more_spam_from" like "more_spam_to"

2014-09-19 Thread Matus UHLAR - fantomas
om mailing lists is not filtered by SA... I do this too, for some lists (although not all). Some lists can even unsubscribe user after receiving bounces ... -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varo

Re: "more_spam_from" like "more_spam_to"

2014-09-18 Thread Matus UHLAR - fantomas
. Also, it has much different meaning than not scanning mail from those hosts. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. The 3 bi

Re: small bug in logging

2014-09-11 Thread Matus UHLAR - fantomas
-milt:189. Sep 11 16:54:46 localhost spamd[8205]: spamd: result: Y 7 - BAYES_99,BAYES_999,DKIM_SIGNED -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akuk

Re: RCVD_IN_MSPIKE_* strange scoring

2014-09-10 Thread Matus UHLAR - fantomas
RCVD_IN_MSPIKE_H2 0.001 -1.772 0.001 -1.772 score RCVD_IN_MSPIKE_H3 0.001 -0.010 0.001 -0.010 score RCVD_IN_MSPIKE_H4 0.001 -0.010 0.001 -0.010 score RCVD_IN_MSPIKE_H5 0.001 -1.000 0.001 -1.000 -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-ma

Re: Large commented out body HTML causing SA to timeout/give up/allow spam

2014-09-06 Thread Matus UHLAR - fantomas
atistics (would be interesting) ? : 1. For messages bigger than 250 KB . SPAM / HAM % no... 2. Compare how many SPAM was catched (in %) is < 250 KB and > 250 KB 12 of 40 this year, ~100 out of ~7000 since I save them... (I don't count those rejected with score >10) -- Matus UHLAR - fa

Re: Large commented out body HTML causing SA to timeout/give up/allow spam

2014-09-05 Thread Matus UHLAR - fantomas
th SA and it did catch much of spam. unfortunately there IS spam >256K... yes, it _needs_ much memory and CPU power... -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NE

Re: RP_MATCHES_RCVD

2014-09-05 Thread Matus UHLAR - fantomas
Am 05.09.2014 um 09:04 schrieb Matus UHLAR - fantomas: and I see more things that are way too much 5.0 BAYES_95 tag-level=4.5 On 05.09.14 09:13, Reindl Harald wrote: # adjust IADB scoring (way too high defaults) score RCVD_IN_IADB_VOUCHED -0.5 score RCVD_IN_IADB_DOPTIN -0.8 score

Re: RP_MATCHES_RCVD

2014-09-05 Thread Matus UHLAR - fantomas
BAYES_95 BODY: Bayes spam probability is 95 to 99% * -1.7 RP_MATCHES_RCVD Envelope sender domain matches, handover relay domain and I see more things that are way too much 5.0 BAYES_95 tag-level=4.5 ... -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to

Re: correct AWL on training

2014-09-04 Thread Matus UHLAR - fantomas
Likewise, FN should adjust AWL upwards on manual training, no? I am not sure how should the manual training be done when talking about AWL. The only way I think is to remove the address from AWL. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receiv

Re: Spam messages bypassing SA

2014-09-04 Thread Matus UHLAR - fantomas
flag, you should check for failures and exit with tempfail.. at fourth, can't you plug SA directly in your MTA? -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akuko

Re: random low contrast text with bayes

2014-09-03 Thread Matus UHLAR - fantomas
od training, and using hapaxes (enabled by default) it can even help detecting the spam. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. 42.7 perc

Re: bayes scroing too low

2014-09-03 Thread Matus UHLAR - fantomas
ly never had a need for pastebin working 11 years yes, because you post attachments to the list, which is not very polite... looks like in case of the SA-list i start to use it in the future good... -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NO

Re: sa-learn and find

2014-09-03 Thread Matus UHLAR - fantomas
file status can break this feature, e.g. a backup system that reads files and resets atime back will cause resetting the ctime. Setting it _not_ to reset atime (nobody uses atime nowadays) should fix the problem. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish

Re: Outlook, we do love to hate you....

2014-08-28 Thread Matus UHLAR - fantomas
black list due to this 'out of office'|'vacation' messages. I am aware of the RFC3834 but not sure if our Exchange server is following it. Of course is does not. Microsoft does not follow standards. It does violate them, break them, misinterpret them... -- Matus UHLAR - fant

Re: formatting of report headers

2014-08-28 Thread Matus UHLAR - fantomas
score: 0.5000] it's apparently your MUA that re-formats thhose headers. fix the MUA, complain to authors or get other one. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem

Re: Spam info headers

2014-08-27 Thread Matus UHLAR - fantomas
around this by configuring add_header all Report _REPORT_ so the X-Spam-Report is added to every message, not just spam... not sure if this works with amavis, It seems that amavis only adds x-spam-report only when mail is spam, configurable with "tag2 level". -- M

Re: sanitizing/normalizing messages for feeding sa-learn

2014-08-27 Thread Matus UHLAR - fantomas
properly. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Your mouse has moved. Windows NT will now restart for changes to take to take effect. [OK]

Re: drop of score after update tonight

2014-08-25 Thread Matus UHLAR - fantomas
the fact SA is not as effective -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. WinError #9: Out of error messages.

Re: drop of score after update tonight

2014-08-25 Thread Matus UHLAR - fantomas
n Debian definition. (you need own server if you process ofer 100k messages daily, and license if you have internal checksum database) you can get the source, build and run in most of cases freely. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive

Re: drop of score after update tonight

2014-08-25 Thread Matus UHLAR - fantomas
you are complaining about low scores... silly. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Silvester Stallone: Father of the RISC concept.

Re: Help determining what is causing mails being marked as Spam

2014-08-21 Thread Matus UHLAR - fantomas
-02-07) on vps81276.ovh.net X-Spam-Level: X-Spam-Status: No, score=0.5 required=3.0 tests=ALL_TRUSTED,MISSING_DATE, MISSING_MID,T_DKIM_INVALID autolearn=no autolearn_force=no version=3.4.0 this does not say it's spam. it says it is NOT spam. -- Matus UHLAR - fantomas, uh...@fan

Re: FW: Tons of spam getting through

2014-08-20 Thread Matus UHLAR - fantomas
=-0.001] autolearn=no autolearn_force=no This one is actually amavisd header, which means that the MTA uses spamassassin indirectly. Just FYI. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address

Re: Second step with SA

2014-08-15 Thread Matus UHLAR - fantomas
rking this as ham (and running "sa-learn --ham") but this has surprisingly little effect. are you training as the correct user? -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tut

Re: Opinions needed on what to consider spam

2014-08-14 Thread Matus UHLAR - fantomas
On 2014-08-13 07:14, Matus UHLAR - fantomas wrote: call an unsubscribe-hook _and_ train as spam. Should be viable for both solicided an unsolicited mail. Or, does anyone think that unsubscribing spam is counter-productive still? On 13.08.14 11:06, Dave Warren wrote: In short, yes, it is

Re: Opinions needed on what to consider spam

2014-08-13 Thread Matus UHLAR - fantomas
On Wednesday 13 August 2014 at 16:14:06 (EU time), Matus UHLAR - fantomas wrote: call an unsubscribe-hook _and_ train as spam. Should be viable for both solicided an unsolicited mail. Or, does anyone think that unsubscribing spam is counter-productive still? On 13.08.14 16:43, Antony Stone

Re: Opinions needed on what to consider spam

2014-08-13 Thread Matus UHLAR - fantomas
nd_ train as spam. Should be viable for both solicided an unsolicited mail. Or, does anyone think that unsubscribing spam is counter-productive still? -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovan

Re: Spam score in headers does not match the Content analysis report

2014-08-12 Thread Matus UHLAR - fantomas
SA marked it as spam actually, not SA, but amavis. Yes, amavis uses SA engine but it's not SA. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu

Re: Running SA without the bayesian classifier

2014-08-12 Thread Matus UHLAR - fantomas
using a 5.0 threshold but given your example I guess I should push it up to 8.0. if you use quarantine and watch the statistics, you can catch spam outbreaks without unnecessary delaying mail. Note that your users might see manual review as breaking their privacy... -- Matus UHLAR - fantomas, uh

Re: Running SA without the bayesian classifier

2014-08-11 Thread Matus UHLAR - fantomas
ted servers for hitting 7.0... You can still use RBL checks like RCVD_IN_SORBS_*, RCVD_IN_XBL, URI BL's, and razor/pyzor/dcc However, I would try using BAYES, at least when you get some outbreaks. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish N

Re: Missing rules

2014-08-08 Thread Matus UHLAR - fantomas
out of sync, some define score for RCVD_IN_MSPIKE_H4 but do not define the rules... -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Nothing

Re: New at SpamAssassin - how to not get headers

2014-08-05 Thread Matus UHLAR - fantomas
er to change user you train on, than change user under which SA/whatever daemon/service runs as. You can cause permission issues etc. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu

Re: Yahoo no longer accepting spam reports -- time to block.

2014-08-03 Thread Matus UHLAR - fantomas
klist effective immediately. I got the same answer. I am considering the same. On 02.08.14 18:54, The Doctor wrote: I blog spam from Yahoo, Google and Hotmail. Feel free to use my blog http://www.nk.ca/blog/ as proof. serendipity error: unable to connect to database - exiting. -- Matus UHLAR

Re: Bypass URIBL_BLACK check for 1 domain

2014-07-29 Thread Matus UHLAR - fantomas
y got the answer (and it's in the manual) -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. "They say when you play that M$ CD backwa

Re: Ready to throw in the towel on email providing...

2014-07-29 Thread Matus UHLAR - fantomas
, more filters, more overhead, more wasted CPU time and bandwidth. You Might Be An Anti-Spam Kook If... The FUSSP involves replacing SMTP. http://www.rhyolite.com/anti-spam/you-might-be.html#programmer-11 -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish N

Re: Low Score for @localhost domain

2014-07-26 Thread Matus UHLAR - fantomas
aid it was localhost address. Do you have *@iqm.unicamp.br in whitelist_from? -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. 2B|!2B, that's a question!

Re: Low Score for @localhost domain

2014-07-25 Thread Matus UHLAR - fantomas
at happens when you whitelist something you should not whitelist. Do not whitelist your domain, localhost, localdomain etc. The spammer did exactly what spammers do to usestupid whitelists: set From: to something you have whitelisted. Without your whitelist, the score would be 14. -- Matus UHLAR

Re: Adding header depending on _SCORE_ and settings UserPref

2014-07-24 Thread Matus UHLAR - fantomas
ts, e.g. when final score is over 10 (or whatever you configure) -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. "The box said 'R

Re: tips and tricks?

2014-07-20 Thread Matus UHLAR - fantomas
I'd only use Sought rules, not SMF_BRACKETS_TO -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. There's a long-standing bug relat

Re: Adding header depending on _SCORE_ and settings UserPref

2014-07-20 Thread Matus UHLAR - fantomas
o two checks, one at SMTP time (with sane defaults), and second (user-personalized) at delivery time. single recipient e-mails can be scanned with user preferences at SMTP time and you can skip the latter step for them. Of course, spam rejected at SMTP time won't be scanned with per-user se

Re: Adding header depending on _SCORE_ and settings UserPref

2014-07-19 Thread Matus UHLAR - fantomas
trowing it away (imho, if you accept the mail, you should keep track, just for sure, so it doesn't get lost in /dev/null). the "spam" directory is a good idea, e.g. with courier's imap and its emptytrash feature (set to 91 at my former employer) -- Matus UHLAR - fant

Re: Adding header depending on _SCORE_ and settings UserPref

2014-07-19 Thread Matus UHLAR - fantomas
ists and move mail to /dev/null. you should reject the mail instead. see the programs above. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklam

Re: SA and Ubuntu 14.04 LTS

2014-07-17 Thread Matus UHLAR - fantomas
On 16.07.14 19:36, Chris wrote: >installed via CPAN as I always have On Thu, 2014-07-17 at 09:13 +0200, Matus UHLAR - fantomas wrote: yes, that's why we have package distributions, to install packages in a semi-manual way. first check if you have installed spamassassin as ubuntu pack

Re: SA and Ubuntu 14.04 LTS

2014-07-17 Thread Matus UHLAR - fantomas
distributions, to install packages in a semi-manual way. first check if you have installed spamassassin as ubuntu package, and if so, remove one of them... -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varova

Re: Smtp auth and trusted_networks

2014-07-13 Thread Matus UHLAR - fantomas
Matus UHLAR - fantomas skrev den 2014-07-13 17:14: What do I (or the others) miss here? On 13.07.14 18:27, Benny Pedersen wrote: i yet to see that pbl ips with smtp auth here any dynamic - dialup, DSL, cable ... ? they are supposed to use authentication and should not get

Re: Smtp auth and trusted_networks

2014-07-13 Thread Matus UHLAR - fantomas
Matus UHLAR - fantomas skrev den 2014-07-13 12:30: isn't the whole point of authentication to avoid scanning the authenticated IP in blacklists? On 13.07.14 15:04, Benny Pedersen wrote: that would be a fault, since when its sent via smtps or submission it would be in trusted_net

Re: Why isn't BAYES_99 + BAYES_999 trusted?

2014-07-13 Thread Matus UHLAR - fantomas
rent 0.2) -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Remember half the people you know are below average.

Re: Smtp auth and trusted_networks

2014-07-13 Thread Matus UHLAR - fantomas
till don't understad the point: isn't the whole point of authentication to avoid scanning the authenticated IP in blacklists? -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adr

Re: Smtp auth and trusted_networks

2014-07-11 Thread Matus UHLAR - fantomas
trusted hosts ? isn't the whole point of authenticaTION to avoid scanning the authenticated IP in blacklists? -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOS

Re: Pyzor with aliases.

2014-07-04 Thread Matus UHLAR - fantomas
On 07/04/2014 07:02 AM, Matus UHLAR - fantomas wrote: I have read the man page multiple times. spamass-milter passes the local part of mail recipient to spamd, which is not necessarily a username. spamass-milter even can call "sendmail -bv" to get the user, but it still may not be

Re: Pyzor with aliases.

2014-07-04 Thread Matus UHLAR - fantomas
On 07/04/2014 05:27 AM, Matus UHLAR - fantomas wrote: I repeat: spamass-milter does not (and can not) know about local users. On 04.07.14 06:30, Steve Bergman wrote: SPAMASS_MILTER(8) I have read the man page multiple times. spamass-milter passes the local part of mail recipient to spamd

Re: Pyzor with aliases.

2014-07-04 Thread Matus UHLAR - fantomas
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6995 On 07/03/2014 09:38 AM, Matus UHLAR - fantomas wrote: I see you are next person (after me) who encountered this issue. Maybe you could comment (or at least +1) the bug. On 03.07.14 09:57, Steve Bergman wrote: What do you think

Re: Pyzor with aliases.

2014-07-03 Thread Matus UHLAR - fantomas
On 03.07.14 09:28, Steve Bergman wrote: https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6995 On 07/03/2014 09:17 AM, Matus UHLAR - fantomas wrote: I have explained my position in the bug, link to which you removed. Yes. I saw that you did. then you should understand why I do not

Re: Pyzor with aliases.

2014-07-03 Thread Matus UHLAR - fantomas
On 07/03/2014 07:53 AM, Matus UHLAR - fantomas wrote: Aha, this seems to be spamd fallback to 'nobody' user, usually with homedir /nonexistent. spamc and spamass-milter have nothing to do with it. I have modified my spamd to use different user as fallback. On 03.07.14 08:43, Ste

Re: Pyzor with aliases.

2014-07-03 Thread Matus UHLAR - fantomas
On 07/03/2014 02:31 AM, Matus UHLAR - fantomas wrote: pardon me, but spamass-milter uses spamc, so pyzor is called from spamd. That means, the above should apply for spamd, not spamass-milter. On 03.07.14 07:26, Steve Bergman wrote: The issue seems to be spamc (and thus pyzor) running as the

Re: Pyzor with aliases.

2014-07-03 Thread Matus UHLAR - fantomas
lter uses spamc, so pyzor is called from spamd. That means, the above should apply for spamd, not spamass-milter. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT aku

Re: getting tons of SPAM

2014-07-02 Thread Matus UHLAR - fantomas
? paste full headers on pastebin. OR, did you already? -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Windows found: (R)emove, (E)rase

Re: getting tons of SPAM

2014-07-01 Thread Matus UHLAR - fantomas
On 27.06.14 07:50, motty cruz wrote: X-Quarantine-ID: <4QFxoaNchYOk> X-Virus-Scanned: amavisd-new at fqdn.com X-Amavis-Alert: BAD HEADER SECTION, MIME error: error: unexpected end of header On Fri, Jun 27, 2014 at 8:16 AM, Matus UHLAR - fantomas wrote: This might explain much.

Re: pyzor: check failed: internal error, python traceback seen in response

2014-07-01 Thread Matus UHLAR - fantomas
-0ubuntu2 ancient, buggy, EOL version for both issues, you should ask help on ubuntu. I have no idea whether 10.04 is supported still (is that LTS version?) but ubuntu should take care about such issues if it's supported (well, that's what "support" means) -- Matus UH

Re: SA rule to detect prior SA pass?

2014-06-29 Thread Matus UHLAR - fantomas
dkim signed mails if this headers is dkim signed, its this really why T_DKIM_INVALID exists ? only if admins would as X-Spam headers before DKIM-signing the mail. yes i know its not sa fault some admins just sign all headers :( I think that would be an extremely bad idea. -- Matus UHLAR

Re: getting tons of SPAM

2014-06-27 Thread Matus UHLAR - fantomas
x27;t have a lot of time? Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="b89161365ddc621bf5b4340f2659783e69.692014062755451" -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail a

Re: getting tons of SPAM

2014-06-27 Thread Matus UHLAR - fantomas
NCEMENT2 1.513 score DRUGS_ERECTILE 3.513 score DRUG_ED_SILD 2.013 score HELO_DYNAMIC_DHCP 2.513 score HS_INDEX_PARAM 1.513 score ONLINE_PHARMACY 3.013 score RDNS_DYNAMIC 1.013 score RDNS_NONE 2.013 score STOX_REPLY_TYPE 2.013 score SUBJ_BUY 2.013 score TVD_VISIT_PHARMA 2.913 score TVD_SPACE_RATIO 1.

Re: Bayer Filter Not Working

2014-06-25 Thread Matus UHLAR - fantomas
data: last expire reduction c Jun 25 07:53:29.670 [13397] dbg: bayes: tie-ing to DB file R/W /var/lib/amavis/.spamassassin/bayes_toks Jun 25 07:53:29.672 [13397] dbg: bayes: tie-ing to DB file R/W /var/lib/amavis/.spamassassin/bayes_seen -- Matus UHLAR - fantomas, uh...@fantomas.sk ;

Re: Soft whitelist a specific mx server

2014-06-23 Thread Matus UHLAR - fantomas
, def_whitelist_* by -15. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. I don't have lysdexia. The Dog wouldn't allow that.

Re: Soft whitelist a specific mx server

2014-06-23 Thread Matus UHLAR - fantomas
is not what I want. I just want to downscore mails from this server because I don't trust them. downscore? because you don't trust them? I'm kinda lost now... -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising

Re: SA without procmail?

2014-06-18 Thread Matus UHLAR - fantomas
t. they can only tag or reject mail detected as spam. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. "Two words: Windows survives." -

Re: Why do I get both URIBL_DBL_SPAM and URIBL_BLOCKED?

2014-06-11 Thread Matus UHLAR - fantomas
> On Fri, 6 Jun 2014 16:42:50 +0200 Matus UHLAR - fantomas wrote: >> I would not be surprised... I have already met people having >> problem because of djbdns (and that's why I don't recommend using >> it) RW wrote: > What problem did they have specificall

Re: Spam score range and distribution statistics?

2014-06-09 Thread Matus UHLAR - fantomas
On 09.06.14 09:47, Ben Stover wrote: As far as I found out SpamAssassin calculates the spam score and puts the value into the email header. What is the maximum range of the score? -10,,+10 I don't think it has limits. Maybe just limist for integer. -- Matus UHLAR - fantoma

Re: add_header all Date of Scan _DATE_

2014-06-09 Thread Matus UHLAR - fantomas
changes for tomorrow. --- lib/Mail/SpamAssassin/Util.pm (revision 1601300) +++ lib/Mail/SpamAssassin/Util.pm (working copy) @@ -582,6 +582,7 @@ } sub time_to_rfc822_date { + my $pms = shift; my($time) = @_; my @days = qw/Sun Mon Tue Wed Thu Fri Sat/; -- Matus UHLAR - fantom

Re: Viagra spam not caught

2014-06-07 Thread Matus UHLAR - fantomas
On 06/05/2014 09:25 AM, Matus UHLAR - fantomas wrote: Seems the only problems Daniele could solve are obsolete rules and mistrained BAYES database. On 06.06.14 18:06, Daniele Paoni wrote: I deleted the bayes database and trained it using real spam&ham I would not clear the BAYES DB so

Re: Why do I get both URIBL_DBL_SPAM and URIBL_BLOCKED?

2014-06-06 Thread Matus UHLAR - fantomas
. I have already met people having problem because of djbdns (and that's why I don't recommend using it) I still find having supported and recent version of DNS server better -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail

Re: Why do I get both URIBL_DBL_SPAM and URIBL_BLOCKED?

2014-06-06 Thread Matus UHLAR - fantomas
Matus UHLAR - fantomas wrote djbdns? I really wonder, when more alternatives were advised to you, why did you choose the oldest, worst, most buggy and years unsupported alternative? On 06.06.14 02:11, zespri wrote: Well, on the page that the original link led to this page was linked: http

Re: I'm getting T_DKIM_INVALID from gmail

2014-06-06 Thread Matus UHLAR - fantomas
ing supported. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. "One World. One Web. One Program." - Microsoft promotional adve

Re: Why do I get both URIBL_DBL_SPAM and URIBL_BLOCKED?

2014-06-06 Thread Matus UHLAR - fantomas
On 06.06.14 00:28, zespri wrote: Thank you all. I've installed djbdns and now the URIBL_BLOCKED is gone! Yay! djbdns? I really wonder, when more alternatives were advised to you, why did you choose the oldest, worst, most buggy and years unsupported alternative? -- Matus UHLAR - fantoma

Re: Don't modify body - just add headers?

2014-06-05 Thread Matus UHLAR - fantomas
mass-milter is not enough for you. Original Message ---- From: Matus UHLAR - fantomas Sent: June 3, 2014 2:26:39 AM CDT To: users@spamassassin.apache.org Subject: Re: Don't modify body - just add headers? On 02.06.14 18:45, Patrick Thomas wrote: Call Method: Mail => Po

Re: Viagra spam not caught

2014-06-05 Thread Matus UHLAR - fantomas
is rule in 3.3.2 (I use Debian's spamassassin so I have 3.3.2 for now). Seems the only problems Daniele could solve are obsolete rules and mistrained BAYES database. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising

Re: Don't modify body - just add headers?

2014-06-03 Thread Matus UHLAR - fantomas
ing spamc instead of spamassassin (shortens startup time). - even better, run spam filter as postfix filter, using spamass-milter or other pre-queue filter. You could reject spam already at SMTP level -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to recei

Re: I am getting lots of SPAM

2014-05-30 Thread Matus UHLAR - fantomas
MIME_HTML_ONLY=0.723, RDNS_NONE=2.013, T_REMOTE_IMAGE=0.01, URIBL_BLACK=1.7, USER_IN_WHITELIST_TO=-6] autolearn=no Why is this user whitelisted if you consider it to be spam? it's the recipient that is whitelisted. In such case it is really silly to blame SA for not marking

Re: SPAM from a registrar

2014-05-20 Thread Matus UHLAR - fantomas
forwarders? If so, removing the forwarder configuration should help. because forwarding defeats the main reason we recommended you having own nameserver for doing lookups from your own IP that won't get blacklisted (with forwarding, the lookups come from your forwarders that may be b

Re: whitelist_from_spf dbg

2014-05-19 Thread Matus UHLAR - fantomas
On 19.05.14 11:06, Jeff Mincy wrote: Date: Mon, 19 May 2014 11:06:24 -0400 From: Jeff Mincy To: Matus UHLAR - fantomas please, avoid personal replies. I am not subscribed to mailing list to get personal mail from people there. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http

Re: whitelist_from_spf dbg

2014-05-19 Thread Matus UHLAR - fantomas
s ^.*\@.*buy\.com$ entry >May 8 18:21:27.859 [22058] dbg: spf: whitelist_from_spf: amandarodriq...@odysseyshop.ribsbuy.com is in user's WHITELIST_FROM_SPF and passed SPF check From: Matus UHLAR - fantomas Date: Sun, 18 May 2014 18:22:49 +0200 According to the documentation, they are

Re: whitelist_from_spf dbg

2014-05-18 Thread Matus UHLAR - fantomas
}) { if ($scanner->{sender} =~ qr/$regexp/i) { ##New dbg output here: dbg("spf: $param: $scanner->{sender} matches $regexp entry"); return 1; I assume the contents of *_networks is modified before RE matching, so you'd wonder what is the content...

Re: Spamassassin Rule Scores

2014-04-28 Thread Matus UHLAR - fantomas
>On 4/24/2014 6:12 AM, emailitis.com wrote: >>Also, in the maillog, I would like to see spamd show not just the >>tests, but the scores of each. On Sunday 27 April 2014 at 19:03, Matus UHLAR - fantomas wrote: add_header all Report _REPORT_ On 27.04.14 19:10, Antony Stone

Re: Spamassassin Rule Scores

2014-04-27 Thread Matus UHLAR - fantomas
the option, etc. though. Always love people submitting patches! I believe that add_header all Report _REPORT_ in your user_prefs does what you want (the scores are rounded to 1 decimal plave but is should be OK for most cases) -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.

Re: RP_MATCHES_RCVD

2014-04-17 Thread Matus UHLAR - fantomas
does not mean it's not spam, only because millions of @gmail.com ham comming from gmail.com are ham... this logic is braindead to me -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na t

Re: RP_MATCHES_RCVD

2014-04-15 Thread Matus UHLAR - fantomas
, so even if that rule seems incorrect hitting then it corrected by other rules it's not corrected, that's the point... -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adr

Re: Which IP is tested by the RBLs?

2014-03-28 Thread Matus UHLAR - fantomas
will still be checked for blacklist that contain hacked, zombie and other abusing IPs. ...of course, all with properly set up SA or similar spam filter. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varo

Re: DATE_IN_FUTURE_96_Q only hits with ssl-received mail

2014-03-06 Thread Matus UHLAR - fantomas
On Thu, 2014-03-06 at 11:49 +0100, Matus UHLAR - fantomas wrote: and now I must tell that the workaround does not work. Unfortunately I still get DATE_IN_* issues for mail received via SMTP/SSL On 06.03.14 11:15, Martin Gregorie wrote: Is there any chance that this is due to a man-in-the

Re: DATE_IN_FUTURE_96_Q only hits with ssl-received mail

2014-03-06 Thread Matus UHLAR - fantomas
On 19.02.14 17:32, Matus UHLAR - fantomas wrote: some time ago I was wondering if sendmail changes the Date: header. The reason was that I've been receiving mail that fired DATE_IN_FUTURE_96_Q when being received at SMTP level, but not later. Now I found out that when the same mail is rec

Re: spamd weird logging to /var/log/messages

2014-02-24 Thread Matus UHLAR - fantomas
ause it's the lowest level possible. Facility "*" has logic, but level "*" has the same meaning as "debug". -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto

Re: DATE_IN_FUTURE_96_Q only hits with ssl-received mail

2014-02-21 Thread Matus UHLAR - fantomas
On 19.02.14 17:32, Matus UHLAR - fantomas wrote: some time ago I was wondering if sendmail changes the Date: header. The reason was that I've been receiving mail that fired DATE_IN_FUTURE_96_Q when being received at SMTP level, but not later. Now I found out that when the same mail is rec

DATE_IN_FUTURE_96_Q only hits with ssl-received mail

2014-02-19 Thread Matus UHLAR - fantomas
body parts X-Spam-Level: *** X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on fantomas.fantomas.sk -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek

Re: BAYES_999 of score 1.0 (default)

2014-02-17 Thread Matus UHLAR - fantomas
On 02/17/2014 02:43 PM, Matus UHLAR - fantomas wrote: seems after last rule update we've got new rule BAYES_99 in 72_scores.cf but without score (and thus default 1.0) in 50_scores.cf. ... a mistake happened apparently? On 17.02.14 15:07, Axb wrote: BAYES_999 is *not* BAYES_99 sorry

BAYES_999 of score 1.0 (default)

2014-02-17 Thread Matus UHLAR - fantomas
Hello, seems after last rule update we've got new rule BAYES_99 in 72_scores.cf but without score (and thus default 1.0) in 50_scores.cf. ... a mistake happened apparently? -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advert

Re: not learned Ham with BAYES_99

2014-02-13 Thread Matus UHLAR - fantomas
On Mon, 20 Jan 2014 11:37:48 +0100 Matus UHLAR - fantomas wrote: I heave received a ham message, that hit BAYES_50 at the time I received it. After feeding to "spamassassin -k" and rechecking it gives BAYES_99: On 20.01.14 12:10, RW wrote: This is the odd bit. So, after SpamAssa

Re: regexp for SMTP AUTH

2014-02-07 Thread Matus UHLAR - fantomas
l later. So, spamd apparently sees something different than you do. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. "Two words: W

Re: regexp for SMTP AUTH

2014-02-07 Thread Matus UHLAR - fantomas
\n \s etc. On Thu, 6 Feb 2014, Matus UHLAR - fantomas wrote: isn't this the first Received: header? spamd may not receive it when MTA first transfers message to SA and THEN adds the Received: header... e.g. milter behaves like this On 06.02.14 13:52, David B Funk wrote: Any worthwhile mil

Re: regexp for SMTP AUTH

2014-02-06 Thread Matus UHLAR - fantomas
\n \s etc. isn't this the first Received: header? spamd may not receive it when MTA first transfers message to SA and THEN adds the Received: header... e.g. milter behaves like this -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail adve

Re: not learned Ham with BAYES_99

2014-02-02 Thread Matus UHLAR - fantomas
On Fri, 31 Jan 2014 21:32:33 +0100 Matus UHLAR - fantomas wrote: After repeated learning as ham I get BAYES_50 at least for the latter message, but I still wonder, how exactly does spamassassin identify messages that do not contain Message-Id? On 02.02.14 13:12, RW wrote: It never uses

Re: not learned Ham with BAYES_99

2014-01-31 Thread Matus UHLAR - fantomas
On Mon, 20 Jan 2014 11:37:48 +0100 Matus UHLAR - fantomas wrote: I heave received a ham message, that hit BAYES_50 at the time I received it. After feeding to "spamassassin -k" and rechecking it gives BAYES_99: On 20.01.14 12:10, RW wrote: This is the odd bit. I think I have foun

Re: Trouble with DATE_IN_FUTURE_96_XX

2014-01-31 Thread Matus UHLAR - fantomas
times are within a couple of seconds - so my question is: why SA adds DATE_IN_FUTURE_96_Q? Am 31.01.2014 um 15:44 schrieb Matus UHLAR - fantomas : I have seen that often too. I have feeling that sendmail changes Date: to current if it's in the future. On 31.01.14 16:09, Rainer Sokoll

<    7   8   9   10   11   12   13   14   15   16   >