RE: Detecting very recently registered domain names

2014-01-09 Thread hospice admin
From: hospice...@outlook.com To: users@spamassassin.apache.org Subject: RE: Detecting very recently registered domain names Date: Mon, 6 Jan 2014 13:45:07 + Date: Mon, 6 Jan 2014 12:26:08 + From

Re: Detecting very recently registered domain names

2014-01-09 Thread Neil Schwartzman
On Jan 6, 2014, at 8:45 AM, hospice admin hospice...@outlook.com wrote: ... its not like NOMINET give a darn about spam, is it?? Nominet are arguably one of the few registrars that very much do care about spam, AFAIK. I know several staffers and former staffers who job it was to deal with

Re: Detecting very recently registered domain names

2014-01-06 Thread Andrew Hearn
On Thu, 19 Dec 2013 10:02:39 -0500 Joe Quinn jqu...@pccc.com wrote: We are noticing a lot of spam coming from domains that are less than two months old. Is there a good way to detect this automatically? We've thought about whois, but do not want to get blocked for looking like we are

RE: Detecting very recently registered domain names

2014-01-06 Thread hospice admin
Date: Mon, 6 Jan 2014 12:26:08 + From: andrew.he...@aaisp.net.uk To: users@spamassassin.apache.org Subject: Re: Detecting very recently registered domain names On Thu, 19 Dec 2013 10:02:39 -0500 Joe Quinn jqu...@pccc.com wrote: We are noticing

RE: Detecting very recently registered domain names

2014-01-06 Thread si
Date: Mon, 6 Jan 2014 12:26:08 + From: andrew.he...@aaisp.net.uk To: users@spamassassin.apache.org Subject: Re: Detecting very recently registered domain names On Thu, 19 Dec 2013 10:02:39 -0500 Joe Quinn jqu...@pccc.com wrote: We are noticing

Re: Detecting very recently registered domain names

2014-01-06 Thread Neil Schwartzman
On Jan 6, 2014, at 8:45 AM, hospice admin hospice...@outlook.com wrote: ... its not like NOMINET give a darn about spam, is it?? Nominet are arguably one of the few registrars that very much do care about spam, AFAIK. I know several staffers and former staffers who job it was to deal with

Re: Detecting very recently registered domain names

2014-01-06 Thread Matthias Leisi
Going back to the OP of this thread after some thinking: On Thu, Dec 19, 2013 at 4:02 PM, Joe Quinn jqu...@pccc.com wrote: We are noticing a lot of spam coming from domains that are less than two months old. Is there a good way to detect this automatically? We've thought about whois, but do

Detecting very recently registered domain names

2013-12-19 Thread Joe Quinn
We are noticing a lot of spam coming from domains that are less than two months old. Is there a good way to detect this automatically? We've thought about whois, but do not want to get blocked for looking like we are harvesting information. Regards, JMQ

Re: Detecting very recently registered domain names

2013-12-19 Thread Alex
Hi, On Thu, Dec 19, 2013 at 10:02 AM, Joe Quinn jqu...@pccc.com wrote: Isn't that where Kevin works too? Couldn't you just walk down the hall and ask him? lol We are noticing a lot of spam coming from domains that are less than two months old. Is there a good way to detect this automatically?

Re: Detecting very recently registered domain names

2013-12-19 Thread Joe Quinn
According to this thread of five years ago, that RBL is not very well maintained. I wonder if that's still the case? (http://spamassassin.1065346.n5.nabble.com/New-Day-old-Bread-list-trick-td52989.html) There also don't appear to be any alternative RBLs that provide a similar list. I might

Re: Detecting very recently registered domain names

2013-12-19 Thread Steve Freegard
On 19/12/13 15:50, Joe Quinn wrote: According to this thread of five years ago, that RBL is not very well maintained. I wonder if that's still the case? (http://spamassassin.1065346.n5.nabble.com/New-Day-old-Bread-list-trick-td52989.html) There also don't appear to be any alternative RBLs that

Re: Detecting very recently registered domain names

2013-12-19 Thread Marcin Mirosław
W dniu 19.12.2013 16:13, Alex pisze: Hi, Hi, On Thu, Dec 19, 2013 at 10:02 AM, Joe Quinn jqu...@pccc.com wrote: Isn't that where Kevin works too? Couldn't you just walk down the hall and ask him? lol We are noticing a lot of spam coming from domains that are less than two months old.

Re: Detecting very recently registered domain names

2013-12-19 Thread Benny Pedersen
Joe Quinn skrev den 2013-12-19 16:02: We are noticing a lot of spam coming from domains that are less than two months old. Is there a good way to detect this automatically? We've thought about whois, but do not want to get blocked for looking like we are harvesting information. maybe make a

Re: Detecting very recently registered domain names

2013-12-19 Thread Benny Pedersen
Marcin Mirosław skrev den 2013-12-19 17:47: I've noticed false positives in last days in this rule. 1.5 URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread) [URIs: imageshack.us] add this domain to uribl_skip_domains dont be fool :)

Re: Detecting very recently registered domain names

2013-12-19 Thread John Hardin
On Thu, 19 Dec 2013, Benny Pedersen wrote: Marcin Mirosław skrev den 2013-12-19 17:47: I've noticed false positives in last days in this rule. 1.5 URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread) [URIs: imageshack.us] add this domain

Re: Detecting very recently registered domain names

2013-12-19 Thread Benny Pedersen
John Hardin skrev den 2013-12-19 18:31: You shouldn't have to do that. one should not complain either :) hard to be right :(

Re: Detecting very recently registered domain names

2013-12-19 Thread Kevin A. McGrail
On 12/19/2013 10:13 AM, Alex wrote: Isn't that where Kevin works too? Couldn't you just walk down the hall and ask him? lol :-) I'm trying to get more people involved in the project. Speaking of which, I published the crash course on email / spam at

Re: Detecting very recently registered domain names

2013-12-19 Thread Robert Schetterer
Am 19.12.2013 18:48, schrieb Kevin A. McGrail: On 12/19/2013 10:13 AM, Alex wrote: Isn't that where Kevin works too? Couldn't you just walk down the hall and ask him? lol :-) I'm trying to get more people involved in the project. Speaking of which, I published the crash course on email /

Re: Detecting very recently registered domain names

2013-12-19 Thread Kevin A. McGrail
On 12/19/2013 1:17 PM, Robert Schetterer wrote: couldnt read that all ,but looks nice Thanks. spf. dkim, dmarc are not antispam mechs, however they may help sometimes in some spam cases, so do not mix it up with antispam and confuse users Good point. I'll add a caveat because mail

Re: Detecting very recently registered domain names

2013-12-19 Thread Robert Schetterer
Am 19.12.2013 19:21, schrieb Kevin A. McGrail: On 12/19/2013 1:17 PM, Robert Schetterer wrote: couldnt read that all ,but looks nice Thanks. spf. dkim, dmarc are not antispam mechs, however they may help sometimes in some spam cases, so do not mix it up with antispam and confuse users Good

Re: Detecting very recently registered domain names

2013-12-19 Thread Benny Pedersen
Kevin A. McGrail skrev den 2013-12-19 19:21: On 12/19/2013 1:17 PM, Robert Schetterer wrote: couldnt read that all ,but looks nice Thanks. spf. dkim, dmarc are not antispam mechs, however they may help sometimes in some spam cases, so do not mix it up with antispam and confuse users Good

Re: Detecting very recently registered domain names

2013-12-19 Thread Kevin A. McGrail
Sender Policy Framework (SPF) - SPF is an anti-spam approach in which the Internet domain ... Will clarify but I wouldn't be shocked if that was the description on wikipedia from a year or so ago. This compendium has been written over many years.

Re: Detecting very recently registered domain names

2013-12-19 Thread Robert Schetterer
Am 19.12.2013 19:28, schrieb Kevin A. McGrail: Sender Policy Framework (SPF) - SPF is an anti-spam approach in which the Internet domain ... Will clarify but I wouldn't be shocked if that was the description on wikipedia from a year or so ago. This compendium has been written over many

Re: Detecting very recently registered domain names

2013-12-19 Thread Benny Pedersen
Robert Schetterer skrev den 2013-12-19 19:39: not a big problem at all ,in your case, but some marketing people promote spf/dkim/dmarc as some jedi wonder tool against spam, which simply isnt true so what is true ? i really hate ignorants

Re: Detecting very recently registered domain names

2013-12-19 Thread Matus UHLAR - fantomas
On 12/19/2013 1:17 PM, Robert Schetterer wrote: couldnt read that all ,but looks nice spf. dkim, dmarc are not antispam mechs, however they may help sometimes in some spam cases, so do not mix it up with antispam and confuse users Am 19.12.2013 19:21, schrieb Kevin A. McGrail: Good point.

Re: Detecting very recently registered domain names

2013-12-19 Thread Matus UHLAR - fantomas
Sender Policy Framework (SPF) - SPF is an anti-spam approach in which the Internet domain ... Am 19.12.2013 19:28, schrieb Kevin A. McGrail: Will clarify but I wouldn't be shocked if that was the description on wikipedia from a year or so ago. This compendium has been written over many

Re: Detecting very recently registered domain names

2013-12-19 Thread Kevin A. McGrail
On 12/19/2013 1:47 PM, Matus UHLAR - fantomas wrote: ok, so this is again one site that should be corrected... spf is NOT an anti-spam tool - it is anti-forgery tool. Yes, much of spam is forged but the info above is still wrong... Kevin, please fix that info... Definitely will mark it as

Re: Detecting very recently registered domain names

2013-12-19 Thread Benny Pedersen
Kevin A. McGrail skrev den 2013-12-19 20:14: On 12/19/2013 1:47 PM, Matus UHLAR - fantomas wrote: ok, so this is again one site that should be corrected... spf is NOT an anti-spam tool - it is anti-forgery tool. Yes, much of spam is forged but the info above is still wrong... Kevin, please

Re: Detecting very recently registered domain names

2013-12-19 Thread Robert Schetterer
Am 19.12.2013 19:49, schrieb Matus UHLAR - fantomas: Sender Policy Framework (SPF) - SPF is an anti-spam approach in which the Internet domain ... Am 19.12.2013 19:28, schrieb Kevin A. McGrail: Will clarify but I wouldn't be shocked if that was the description on wikipedia from a year or so