FOUND_YOU rule

What exactly is the "FOUND_YOU" rule? The wiki entry on it is empty and I can't find anything about it on the internet.

RE: Regex in case of spaces

Hi dude, Try the following - need to buy (a\s)?products?([\s?]{0,})? added a conditional a with a space "(a\s)?" added a conditional s after product s? added a conditional combination of space and question marks ([\s?]{0,})? Hope it helps Rgds Tony > Subject: Re: Regex in c

false positive: KHOP_BIG_TO_CC

instaed of Bcc or a list scoreKHOP_BIG_TO_CC 3.199 3.399 3.199 3.399 Tony. -- f.anthony.n.finch d...@dotat.at http://dotat.at/ Forties, Cromarty: East, veering southeast, 4 or 5, occasionally 6 at first. Rough, becoming slight or moderate. Showers, rain at first. Moderate or good

Re: failed to compile Mail::SpamAssassin::Plugin::Check::_body_tests

sa-compile.txt http://spamassassin.1065346.n5.nabble.com/file/n105697/sa-compile.txt I've uploaded sa-compile.txt which is the output I got when I ran: /usr/bin/sa-compile --siteconfigpath=/etc/mail/spamassassin --updatedir=/etc/mail/spamassassin -- View this message in context:

Re: failed to compile Mail::SpamAssassin::Plugin::Check::_body_tests

ok I've re-done the sa-compile and uploaded a new text file. The command I used was: /usr/bin/sa-compile --siteconfigpath=/etc/mail/spamassassin --updatedir=/var/lib/spamassassin/3.003001/updates_spamassassin_org sa-compile.txt http://spamassassin.1065346.n5.nabble.com/file/n105699/sa-compile.txt

SOLVED: failed to compile Mail::SpamAssassin::Plugin::Check::_body_tests

thankyou kevin you found the problem. I did have errors in local.cf and when I cleared these up I did '#su defang' again on a test spam and this time there were no errors and no warnings. -- View this message in context:

Re: failed to compile Mail::SpamAssassin::Plugin::Check::_body_tests

I ran the command *#/usr/bin/sa-compile* on it's own and since cleaning up local.cf (posted earlier) it all seems ok now, no more errors. The latest sa-compile output is attached. sa-compile.txt http://spamassassin.1065346.n5.nabble.com/file/n105722/sa-compile.txt -- View this message in

Re: SOLVED: failed to compile Mail::SpamAssassin::Plugin::Check::_body_tests

@benny *su defang -s /bin/bash -c 'spamassassin -x -p /etc/mail/sa-mimedefang.cf -D testmessage.txt'* is a command I run on test spam mail (testmessage.txt) to see that spamassassin is processing it correctly and not throwing up errors. I run spamd on centos 5.9 and run it alongside of

Re: failed to compile Mail::SpamAssassin::Plugin::Check::_body_tests

thanks for your response. I went into v320.pre and *loadplugin Mail::SpamAssassin::Plugin::Rule2XSBody* is already commented ie: it has a '#' at the beginning on the line. Did you mean uncomment? -- View this message in context:

failed to compile Mail::SpamAssassin::Plugin::Check::_body_tests

I'm running a centos 5.9 server with spamassassin-3.3.1-2.el5, when I do an '#su defang' check on a test spam I'm getting: *warn: rules: failed to compile Mail::SpamAssassin::Plugin::Check::_body_tests_0_3, skipping:* I did a search on google but found nothing for this particular error. How do I

increase in spams getting though

I've been running spamassassin for about 4 years on a centos 5 server, currently running spamassassin-3.3.1-2.el5. I've always been impressed and very pleased with the way SA works and I regularly run sa-update and I update the bayes databases. I use plugins too - raor, pyzor, dkim etc but over

Re: increase in spams getting though

now I've given it some more thought it's a certain type of spam that gets through. I never get scams or marital aid spam, never. The spam mails that get through are consistently to do with hospitality, increased sales and business courses. Are there rules I should be using to combat this type of

RE: PreRBL with spamassasdon

Recently there was a good thread about postscreen and rbl. I just updated my config and have seen a decent improvement. Here is the starter message: http://archives.neohapsis.com/archives/postfix/2013-04/0468.html Hope this helps, Tony From: Raymond Dijkxhoorn [mailto:raym

sudden increase in spam

centos 5.8 server running spamassassin-3.3.1-2.el5 I've been using spamassassin for three years and during that period it's been doing a great job of keeping spam down to almost zero but in the last couple of weeks I've seen and increase in junk mail slipping through - about 3 to 4 a day which is

sa-update 3.3 daily changes

sa-update for version 3.3 is usually very quiet - last update 4 July; previous one 12 June. We have been getting daily updates since Saturday morning. Is this expected? Tony. -- f.anthony.n.finch d...@dotat.at http://dotat.at/ HUMBER THAMES DOVER WIGHT PORTLAND: NORTH BACKING WEST OR NORTHWEST

Re: sa-update 3.3 daily changes

On Wed, 8 Sep 2010, John Hardin wrote: It's expected and very welcome. It means the age-limited nightly masscheck corpora have once again gotten large enough that the score generator can safely publish updated rules and scores on a regular basis. Ah, good news :-) Tony. -- f.anthony.n.finch

Re: Extending XBL to all untrusted

positives from senders that are using remote message submission, and from some webmail users if their server puts the webmail client IP address in the message headers. Tony. -- f.anthony.n.finch d...@dotat.at http://dotat.at/ GERMAN BIGHT HUMBER: SOUTHWEST 5 TO 7. MODERATE OR ROUGH. SQUALLY

Any amavisd-milter help out there?

but don't see anything that should place a file in /etc/sysconfig. Can anyone familiar with amavisd-milter know whether such a file should be created and installed in a default unpackaging of amavisd-milter? TIA, Tony

Newbie Help! Scalix11 OpenSuSE SA

scanning? 2. Does anyone have a reference to a similar procedure to what I described? Perhaps a different reference describing the same procedure might be either more accurate or more explanatory/complete. TIA. Tony

RE: Low Score?

meta rules to filter out some specific stuff that was sneaking by. It appears that I should get Razor going and at least take a look at the KHOP_* rules and JunkEmailFilter BL. Thanks everyone for taking the time to check the messages through your filters. -Tony B -Original Message

Low Score?

I am starting to see more messages than usual get through our spam filters. Anyone have any tips on what would make these score higher? http://pastebin.com/m41d3437a http://pastebin.com/d626a4352 http://pastebin.com/m14c73cab Thanks in advance, Tony

False Negatives

/m16055c85 http://pastebin.com/m52635526 http://pastebin.com/m491c4882 http://pastebin.com/m7c1240f2 Anyone have any suggestions? Thanks in advance! --- Tony Bunce: [EMAIL PROTECTED] Sr. Programming Systems

[OT] Yahoo Deferred

are getting more frequent every day. Tony Bunce: [EMAIL PROTECTED]mailto:[EMAIL PROTECTED] Sr. Programming Systems Administrator - GO Concepts Inc.http://www.go-concepts.com/ Phone: (513) 934-8234

RE: [OT] Yahoo Deferred

it in (postal mail). Even then the feedback loop is DomainKeys based instead of IP based, so for ISPs you don't know if your customers are sending spam to yahoo. At least I know that I'm not alone now, thanks for the input. I'll let everyone know if I make any headway. -Tony -Original Message

RE: [OT] Yahoo Deferred

I have heard using Domainkeys or DKIM helps greatly? Is that true? So far DomainKeys has not helped from what I can tell. Yahoo is deferring the message as soon as my server connects, so it never even gets a chance to see the DomainKeys header. -Tony B

Mail marked as spam on outgoing mail

internally been marked as SPAM? If I can supply more info that would assist in getting an answer please let me know Tony

Re: Mail marked as spam on outgoing mail

On 9 Nov 2007, at 12:39, wolfgang wrote: In an older episode (Friday, 9. November 2007), Tony Baker wrote: X-Spam-Status: Yes, score=5.373 tagged_above=-999 required=2.7 tests=[ALL_TRUSTED=-1.8, AWL=9.772, BAYES_00=-2.599] AWL=9.772: This seems to indicate that a recent mail with your

Re: running sa-update gives error

On 2 Nov 2007, at 09:20, Daryl C. W. O'Shea wrote: Tony Baker wrote: server:~ root# sa-update Can't locate LWP/UserAgent.pm in @INC (@INC contains: /Library/ Perl/5.8.6/darwin-thread-multi-2level /Library/Perl/5.8.6 /System/ Library/Perl/5.8.6/darwin-thread-multi-2level /System/Library/Perl

Re: running sa-update gives error

place, hopefully inside one of your @INClude directory. Installed LWP::UserAgent through cpan now when running sa-update I get the folowing: server: admin# /usr/bin/sa-update error: gpg required but not found! Tony

running sa-update gives error

/Perl /System/Library/Perl/ Extras/5.8.6/darwin-thread-multi-2level /System/Library/Perl/Extras/ 5.8.6 /Library/Perl/5.8.1) at /usr/bin/sa-update line 79. BEGIN failed--compilation aborted at /usr/bin/sa-update line 79. What have I broken, and how can I fix it Tony

Support - spamassassin

I have attached an example of our email that is now being considered spam. Thank-you for any possible guidance and resolution. Best Regards, Tony Le Piane Logistics Software Corp. (905) 881-0320 www.logisticssoftware.com BLOCKED::http://www.logisticssoftware.com

Invalid Date header - Date not RFC 2822

I have attached an example of our email that is now being considered spam. Thank-you for any possible guidance and resolution. Best Regards, Tony Le Piane Logistics Software Corp. (905) 881-0320 www.logisticssoftware.com BLOCKED::http://www.logisticssoftware.com

RE: Support - spamassassin

get it. Really appreciate your reply. Best Regards, Tony -Original Message- From: Duane Hill [mailto:[EMAIL PROTECTED] Sent: August 31, 2007 11:07 AM To: users@spamassassin.apache.org Subject: Re: Support - spamassassin On Fri, 31 Aug 2007 at 10:38 -0400, [EMAIL PROTECTED] confabulated

white_list is not working.....HELP!

is it not whitelisting!!! thanks for your help!!! *** Tony Guadagno Guadagno Consulting [EMAIL PROTECTED] 585.703.6700 *** BEGIN:VCARD VERSION:2.1 X-GWTYPE:USER FN:Tony Guadagno EMAIL;WORK;PREF;NGW:[EMAIL

RE: white_list is not working.....HELP!

: AcfpzX9sYZtuwDNJRcim8H0+6Lyt/wADEuq5 References: [EMAIL PROTECTED][EMAIL PROTECTED][EMAIL PROTECTED][EMAIL PROTECTED][EMAIL PROTECTED][EMAIL PROTECTED][EMAIL PROTECTED][EMAIL PROTECTED][EMAIL PROTECTED][EMAIL PROTECTED] [EMAIL PROTECTED] From: Tony Guadagno [EMAIL PROTECTED] To: [EMAIL PROTECTED

RE: white_list is not working.....HELP!

PROTECTED] whitelist_from [EMAIL PROTECTED] whitelist_from [EMAIL PROTECTED] whitelist_from [EMAIL PROTECTED] *** Tony Guadagno Guadagno Consulting [EMAIL PROTECTED] 585.703.6700 *** Bowie Bailey [EMAIL

RE: white_list is not working.....HELP!

YEP! that did it i will have to work around that. thanks VERY MUCH!! *** Tony Guadagno Guadagno Consulting [EMAIL PROTECTED] 585.703.6700 *** Bowie Bailey [EMAIL PROTECTED] 8/29/2007 12:11 PM

Re: Posioned MX is a bad idea [Was: Email forwarding and RBL trouble]

that a dictionary attack will fail - relying on obscurity or 100% blacklist coverage isn't enough. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ IRISH SEA: SOUTHERLY, BACKING NORTHEASTERLY FOR A TIME, 3 OR 4. SLIGHT OR MODERATE. SHOWERS. MODERATE OR GOOD, OCCASIONALLY POOR.

Re: Posioned MX is a bad idea [Was: Email forwarding and RBL trouble]

On Sat, 25 Aug 2007, Dave Pooser wrote: So do you run your servers with VRFY enabled? Yes. If you are verifying addresses at RCPT time, which you must to avoid spam blowback, then there's no point disabling VRFY. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ IRISH SEA: SOUTHERLY

pdfinfo - how to prove it is working

::SpamAssassin::Plugin::PDFInfo: Can't locate object method new via package Mail::SpamAssassin::Plugin::PDFInfo at (eval 32) line 1. Where line 131 reads use Mail::SpamAssassin::Logger; Can someone give me some pointers as to what may be wrong Regards Tony

Re: DNS timeout problem

In [EMAIL PROTECTED], Bob Proulx wrote: For your Debian machine it is very easy with the following commands. $ sudo apt-get update $ sudo apt-get install bind9 The default package configuration is a caching nameserver and the above commands should be all that is needed to set up and

Re: DNS timeout problem

In [EMAIL PROTECTED], Gary V wrote: As mentioned twice, use a local caching DNS server (like bind for example). Even if configured to forward requests to your ISP's DNS server it may make a big difference. What OS are you running? Linux. -- TH * http://www.realh.co.uk

Re: DNS timeout problem

In [EMAIL PROTECTED], SM wrote: At 06:10 07-07-2007, Tony Houghton wrote: SA used to kill a different router I used to have, but I don't think that's the problem here. I temporarily pointed /etc/resolv.conf to my ISP's servers and restarted spamd, which you'd expect to make at least some

Re: DNS timeout problem

In [EMAIL PROTECTED], Gary V wrote: Gary V wrote: As mentioned twice, use a local caching DNS server (like bind for example). Even if configured to forward requests to your ISP's DNS server it may make a big difference. What OS are you running? Linux. Exactly which distrubution

Re: DNS timeout problem

In [EMAIL PROTECTED], SM wrote: Hi Tony, At 15:01 06-07-2007, Tony Houghton wrote: I just use the one built in to my ADSL router; I don't know whether it caches. The one it forwards to at my ISP is probably bind. The DNS server on your ADSL router is built for residential usage. If you

Re: DNS timeout problem

In [EMAIL PROTECTED], Bob Proulx wrote: Tony Houghton wrote: SA used to kill a different router I used to have, but I don't think that's the problem here. I don't see how even a low end router would have a problem with the amount of data from DNS lookups that could be generated. It must

DNS timeout problem

: util: PATH included '/usr/bin/X11', keeping [14452] dbg: util: PATH included '/usr/games', keeping [14452] dbg: util: PATH included '/home/tony/bin', keeping [14452] dbg: util: PATH included '/sbin', keeping [14452] dbg: util: PATH included '/usr/sbin', keeping [14452] dbg: util: PATH included '/usr

Re: DNS timeout problem

In [EMAIL PROTECTED], James D. Rallo wrote: Are you running a local dns caching server? I just use the one built in to my ADSL router; I don't know whether it caches. The one it forwards to at my ISP is probably bind. Do manual queries to rbls take a long time? (Hint: Don't run the query

Re: Add DNS checks at MTA

On Thu, 12 Apr 2007, Suhas Ingale wrote: Following is my ACL list from exim conf. I want to add DNS checks for hosts so that connections from blacklisted IP addresses are blocked at MTA level. http://www.exim.org/exim-html-4.66/doc/html/spec_html/ch40.html#SECTmorednslists Tony

RE: Add DNS checks at MTA

.html#id2579986 Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ BAILEY: SOUTH OR SOUTHWEST 6 TO GALE 8, OCCASIONALLY SEVERE GALE 9 AT FIRST. ROUGH OR VERY ROUGH, OCCASIONALLY HIGH AT FIRST. OCCASIONAL RAIN. MODERATE OR GOOD, OCCASIONALLY POOR.

Re: per user scanning

around to implement it. Unfortunately there's no easy solution, even for common policies. Tony. -- [EMAIL PROTECTED] [EMAIL PROTECTED] http://dotat.at/ ${sg{\N${sg{\ N\}{([^N]*)(.)(.)(.*)}{\$1\$3\$2\$1\$3\n\$2\$3\$4\$3\n\$3\$2\$4}}\ \N}{([^N]*)(.)(.)(.*)}{\$1\$3\$2\$1\$3\n\$2\$3\$4\$3\n\$3\$2

Re: per user scanning

variable, $acl_m* (the * part is chosen by you), which you set in the RCPT ACL depending on the recipient. You can add some logic to detect if the variable is already set (i.e. a message with multiple recipients) and adjust it accordingly - e.g. choose a default user. Tony. -- f.a.n.finch [EMAIL

Re: Techworld says spam shows sudden slide'?

half of November and levels have been fairly constant (but with a level slightky lower than the peak) since then. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ BAILEY: WEST 7 OR GALE 8, BECOMING CYCLONIC SEVERE GALE 9 OR STORM 10. VERY HIGH. RAIN OR SHOWERS. MODERATE OR GOOD.

RE: Help! rewrite_header subject not working for me

I see, yes, I am calling SA directly, no Amavis etc involved.. *** Tony Guadagno Guadagno Consulting [EMAIL PROTECTED] 585.703.6700 *** Bowie Bailey [EMAIL PROTECTED] 12/21/2006 9:37 am Tony Guadagno wrote

RE: Help! rewrite_header subject not working for me

I guess i don't understand, you say that Rewriting the subject is ultimately the responsibility of the MTA., but SA has this option, so that means that it is SA's responsibility...right? *** Tony Guadagno Guadagno Consulting [EMAIL PROTECTED

Help! rewrite_header subject not working for me

;NGW:[EMAIL PROTECTED] N:Guadagno;Tony END:VCARD

Yet another question about rewrite_header subject not working for me

;NGW:[EMAIL PROTECTED] N:Guadagno;Tony END:VCARD

Yet another question about rewrite_header subject not working for me

;NGW:[EMAIL PROTECTED] N:Guadagno;Tony END:VCARD

Re: Them spammers are getting smarter..

On Tue, 21 Nov 2006, Evan Platt wrote: So used to be mail from Richard Smith, subject Me again Richard. Now they're using the last name, ie Me again Smith Their fake Received: line is still the same. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ BAILEY: CYCLONIC BECOMING

Re: A false positive...

: header above is malformed, so SpamAssassin can't extract the timezone offset. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ BAILEY: CYCLONIC BECOMING NORTHWESTERLY SEVERE GALE 9 TO VIOLENT STORM 11, OCCASIONALLY HURRICANE FORCE 12 IN SOUTH, DECREASING 7 TO SEVERE GALE 9 LATER. HIGH

current stock scams are easy to spot

-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670 Thread-Index: Aca6QB0)-/ZA;3SO+O/M?G3G3C(7,== Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ FORTIES CROMARTY: SOUTHERLY VEERING

Re: Well, that didn't take very bloody long

://article.gmane.org/gmane.mail.spam.spamassassin.general/90322 Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ VIKING: SOUTHERLY VEERING WESTERLY 6 TO GALE 8, OCCASIONALLY SEVERE GALE 9. HIGH. RAIN THEN SHOWERS. MODERATE OR GOOD.

RE: Amazon / RFCI false positives

who's trying to help. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ THAMES: WEST OR NORTHWEST 4 OR 5. SLIGHT TO MODERATE. FAIR. GOOD.

Amazon / RFCI false positives

Amazon.co.uk was listed by RFC-Ignorant at the start of this week, and it is now scoring more than 5: DNS_FROM_RFC_DSN 2.87, DNS_FROM_RFC_POST 1.44, FROM_EXCESS_BASE64 1.05. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ IRISH SEA: VARIABLE 3 OR LESS, BECOMING WESTERLY 4 OR 5 LATER

Re: Amazon / RFCI false positives

On Fri, 3 Nov 2006, Ralf Hildebrandt wrote: * Tony Finch [EMAIL PROTECTED]: Amazon.co.uk was listed by RFC-Ignorant at the start of this week, and it is now scoring more than 5: DNS_FROM_RFC_DSN 2.87, DNS_FROM_RFC_POST 1.44, FROM_EXCESS_BASE64 1.05. Amazon.co.uk is not listed: http

RE: Amazon / RFCI false positives

On Fri, 3 Nov 2006, Michael Scheidell wrote: Not a false positive if their servers are broken. True from the RFCI point of view, but NOT true from the SpamAssassin point of view. These messages are wanted by their recipients so should not be scored as spam by SpamAssassin. Tony

Re: forged headers

, because it shows up in my virus infection audit reports. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ FORTIES CROMARTY FORTH: SOUTHERLY 6 TO GALE 8, DECREASING 5 OR 6 LATER. RAIN OR SHOWERS. MODERATE OR GOOD.

Re: DNSing MX to 127.0.0.1: Ruleset (or something) for this?

to augment this list with bogon or hijacked address space, but then it would be more work to keep up-to-date. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ FISHER: WEST OR NORTHWEST 4 OR 5 BECOMING VARIABLE 3 OR 4. FAIR. MODERATE OR GOOD.

Re: 0451.com

syntax described in RFC 1035 is informative, not normative. RFC 1912 is also informative, and it obviously misinterprets RFC 1123 which clearly allows all-numeric labels. All RFCs are not created equal and the earlier ones especially must be interpreted intelligently. Tony. -- f.a.n.finch [EMAIL

RE: 0451.com

alphabetic domains. For example, 263.com is China's second-largest ISP. You can't just assume that an all-numeric domain is necessarily abusive, any more so than Yahoo or Fastmail. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ FISHER: WEST OR NORTHWEST 4 OR 5 BECOMING VARIABLE 3 OR 4

Re: 0451.com

liberal syntax. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ FISHER: WEST OR NORTHWEST 4 OR 5 BECOMING VARIABLE 3 OR 4. FAIR. MODERATE OR GOOD.

Re: Allowing IMAP/POP to Send Email

for domains that they pretend to be. It would not. They could still talk SMTP or steal users' login credentials. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ FISHER: WEST OR NORTHWEST 4 OR 5 BECOMING VARIABLE 3 OR 4. FAIR. MODERATE OR GOOD.

Re: SPF is now a standard: RFC4408

an extremely scathing IESG note which basically says you should expect interoperability problems if you use any MARID technique, including SPF. It's not a standard until it's STD-4408, IIRC. STD numbers are not allocated like that. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at

false positive on FORGED_MUA_OUTLOOK (v.3.1)

/200509.mbox/[EMAIL PROTECTED] and about halfway down http://list-archive.xemacs.org/xemacs-design/xemacs-design.200603 (search for SlipStream) Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ HEBRIDES BAILEY: WEST 5 TO 7, OCCASIONALLY GALE 8 IN BAILEY AND PERHAPS LATER IN HEBRIDES

Re: Exiscan + subject rewrite not working

of SpamAssassin, and instead relies on Exim's own facilities for this.. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ BISCAY: WEST 5 OR 6 BECOMING VARIABLE 3 OR 4. SHOWERS AT FIRST. MODERATE OR GOOD.

spamcopuri and SA 3.1.0

? Tony

Re: sender-valid SMTP callbacks (Re: Does tuxorama.com sound fa miliar to anyone?)

query to the Exchange server, but unless you can help me figure out how to do it, then I guess I'll just remain a f*cking idiot admin. It's fairly straightforward with Exim. http://www.exim.org/eximwiki/MsExchangeAddressVerification Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at

Re: I'm afraid I might have to report this list as a spam source

On Wed, 21 Dec 2005, [EMAIL PROTECTED] wrote: You see, it does not allow me to unsubscribe. It's ezmlm, so you can just reject all messages from the list and it will unsubscribe you :-) Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ BISCAY: WEST 5 OR 6 BECOMING VARIABLE 3 OR 4

Questions

be useful. I have tried adding -D to the spamd commandline in init.d and /etc/sysconfig/spamassassin (using fedora Core 4) but it seems to ignore it. Regards, Tony

Score Info (was RE: error in counting score?)

, Tony Melia -Original Message- From: Michael Monnerie [mailto:[EMAIL PROTECTED] Sent: Wednesday, 16 November 2005 6:58 PM To: users@spamassassin.apache.org Subject: error in counting score? X-Virus-Scanned: amavisd-new at my host X-Spam-Status: Yes, hits=5.55 tagged_above=-999

Picture based spam

. Obviously SA can't read the message since it is an image, but is there a way to make a rule that blocks a mail where there is an image only, no text? Regards, Tony

Spamassassin Distro

to! Regards,Tony

SA Gateway - MS Exchange -- what if MSE down?

is a filter not an MTA and that Postfix is a check/forwarding agent (not store forward). Would I be correct in assuming, in the event that if MS Exchange was down, in order to store mail -- I would need to have a backup MTA with all the users mailboxes replicated? Thanks, Tony

Re: Exim with Spamassassin and mimedefang

HOWTOs using sendmail but I want to switch to Exim or am I just making things hard? Recent versions of Exim come with support for SpamAssassin and anti-virus software built in. See the section in the documentation about Content Scanning. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at

Re: Observation on secondary MX

On Mon, 2 May 2005, Justin Mason wrote: It might be worthwhile maintaining some kind of spammer tactics knowledge base, on the wiki maybe? There's http://www.jgc.org/tsc/ but it's more focussed on textual obfuscation than low-level tactics. Tony. -- f.a.n.finch [EMAIL PROTECTED] http

Re: Webmail and IP rules

/viewcvs.cgi/spamassassin/trunk/lib/Mail/SpamAssassin/Message/Metadata/Received.pm?rev=112024r1=57557r2=112024 Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ NORTH UTSIRE SOUTH UTSIRE: VARIABLE 3 OR 4 BECOMING SOUTHWEST 5 TO 7, PERHAPS GALE 8 LATER. FAIR THEN RAIN. MODERATE OR GOOD.

Re: HELO_DYNAMIC_IPADDR matches wrongly on hotmail

On Mon, 31 Jan 2005, Ole Nomann Thomsen wrote: So I don't feel able to bugzilla this one - any takers? It isn't a bug in SpamAssassin. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ FAEROES: NORTHWEST 5 TO 7, OCCASIONALLY VARIABLE 3 OR 4 FOR A TIME. RAIN AT TIMES. MODERATE OR GOOD.

Re: HELO_DYNAMIC_IPADDR matches wrongly on hotmail

-literal. You're only allowed one of them after the from keyword; any other information must appear in () afterwards. What's more, they must be separated by spaces, not juxtaposed. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ NORTH FITZROY SOLE: NORTHEAST 4 OR 5, BUT 3 IN WEST SOLE

Re: HELO_DYNAMIC_IPADDR matches wrongly on hotmail

6.41.149 Release) with SMTP; Wed, 19 Jan 2005 19:41:14 - F-Secure Anti-Virus for Internet Mail is producing incorrectly-formatted Received: lines. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ FORTIES CROMARTY FORTH TYNE DOGGER: NORTH BACKING NORTHWEST 5 OR 6, DECREASING 4 FOR A TIME

Re: HELO_DYNAMIC_IPADDR matches wrongly on hotmail

would be something like Received: from hotmail.com (bay22-dav1.bay22.hotmail.com [64.4.16.181]:30781) by mailgateway.sitc.dk ([195.231.241.98]:25) (F-Secure Anti-Virus for Internet Mail 6.41.149 Release) with SMTP; Wed, 19 Jan 2005 19:41:14 - Tony. -- f.a.n.finch [EMAIL

logs and probably-spam almost-certainly-spam directories

and I need to know where they are going so that we can verify that we aren't getting false positives. In summary I'd like to know where to dig and would appreciate any advice on a basic setup for a few users. If anybody has time to assist I can divulge more details as needed. Regards, -Tony

Re: FORGED_MUA_OUTLOOK false positives

On Wed, 12 Jan 2005, Menno van Bennekom wrote: I noticed that FORGED_MUA_OUTLOOK falsely triggers with this hotmail-email that is sent from Outlook-Express via the http-hotmailserver. http://bugzilla.spamassassin.org/show_bug.cgi?id=4065 Tony. -- f.a.n.finch [EMAIL PROTECTED] http

Re: FORGED_MUA_OUTLOOK false positives

On Wed, 12 Jan 2005, Martin Hepworth wrote: you guys running that rule live at cam.ac.uk? I haven't actually finished testing it properly yet, because it has got muddled up in the upgrade to SA 3.0.2 which I keep forgetting to finish :-) Tony. -- f.a.n.finch [EMAIL PROTECTED] http

Re: consensus on SPF

. In Exim: daemon_smtp_ports = 25 : 465 : 587 tls_on_connect_ports= 465 Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ COLWYN BAY TO THE MULL OF GALLOWAY INCLUDING THE ISLE OF MAN: SOUTHWEST VEERING WEST 7 OR GALE 8, OCCASIONALLY SEVERE GALE FORCE 9 FOR A TIME. RAIN OR SHOWERS

Re: consensus on SPF

On Tue, 14 Dec 2004, Clarke Brunt wrote: it seems to me that a 'fail' result is a perfectly good reason to reject a message outright, which is what I do (without it even being passed to SpamAssassin). How many users do you have? Do none of them have vanity addresses? Tony. -- f.a.n.finch

HELO check suggestion

think it's usable as a sole reason for rejection. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ MALIN HEBRIDES: NORTHEAST 4 OR 5 INCREASING 6. RAIN LATER. GOOD BECOMING MODERATE.

Re: Preferred DNSBL

implemented a workaround in the meantime. You should read http://www.cymru.com/Bogons/ and subscribe to the bogons-announce list. Tony. -- f.a.n.finch [EMAIL PROTECTED] http://dotat.at/ THE MULL OF GALLOWAY TO MULL OF KINTYRE INCLUDING THE FIRTH OF CLYDE AND THE NORTH CHANNEL: WEST OR SOUTHWEST 3