Re: Loads of FPs caused by FORGED_RELAY_MUA_TO_MX

2019-06-08 Thread Niamh Holding
Hello Bill, Friday, June 7, 2019, 8:17:56 PM, you wrote: BC> You are free to change this locally. See the documentation of BC> originating_ip_headers (perldoc Mail::SpamAssassin::Conf) I've added- originating_ip_headers X-Yahoo-Post-IP X-Apparently-From X-SenderIP to local.cf However I still

Re: Loads of FPs caused by FORGED_RELAY_MUA_TO_MX

2019-06-07 Thread Niamh Holding
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello John, Friday, June 7, 2019, 7:48:57 PM, you wrote: JH> X-Spam-Relays-External, not Untrusted. Yes and it will always be the first external Received IP address, X-Originating-IP: should net be in the chain of external IP addresses. - -- Best

Re: Loads of FPs caused by FORGED_RELAY_MUA_TO_MX

2019-06-07 Thread RW
On Fri, 07 Jun 2019 15:17:56 -0400 Bill Cole wrote: > On 7 Jun 2019, at 12:52, Niamh Holding wrote: > > > Hello RW, > > > > Friday, June 7, 2019, 5:21:01 PM, you wrote: > > > > R> This is the reason: > > R> > >>> X-Originating-IP: 162.208.32.167 > > > > > > R> Perhaps the rule should be m

Re: Loads of FPs caused by FORGED_RELAY_MUA_TO_MX

2019-06-07 Thread RW
On Fri, 7 Jun 2019 11:48:57 -0700 (PDT) John Hardin wrote: > On Fri, 7 Jun 2019, Niamh Holding wrote: > > > > > Hello John, > > > > Friday, June 7, 2019, 3:56:03 PM, you wrote: > > > > JH> If you're getting FPs on this, I suggest you review your > > JH> internal hosts. It looks for reserved IP

Re: Loads of FPs caused by FORGED_RELAY_MUA_TO_MX

2019-06-07 Thread Bill Cole
On 7 Jun 2019, at 12:52, Niamh Holding wrote: Hello RW, Friday, June 7, 2019, 5:21:01 PM, you wrote: R> This is the reason: R> X-Originating-IP: 162.208.32.167 R> Perhaps the rule should be modified to test for by=\S It's certainly not a Received: header so should not be checked. You ar

Re: Loads of FPs caused by FORGED_RELAY_MUA_TO_MX

2019-06-07 Thread John Hardin
On Fri, 7 Jun 2019, Niamh Holding wrote: Hello John, Friday, June 7, 2019, 3:56:03 PM, you wrote: JH> If you're getting FPs on this, I suggest you review your internal hosts. JH> It looks for reserved IP ranges in external Received headers. This? * 3.3 FORGED_RELAY_MUA_TO_MX No description

Re: Loads of FPs caused by FORGED_RELAY_MUA_TO_MX

2019-06-07 Thread Niamh Holding
Hello RW, Friday, June 7, 2019, 5:21:01 PM, you wrote: R> This is the reason: R> >> X-Originating-IP: 162.208.32.167 R> Perhaps the rule should be modified to test for by=\S It's certainly not a Received: header so should not be checked. -- Best regards, Niamh

Re: Loads of FPs caused by FORGED_RELAY_MUA_TO_MX

2019-06-07 Thread RW
On Fri, 7 Jun 2019 17:00:00 +0100 Niamh Holding wrote: > Hello RW, > > Friday, June 7, 2019, 4:43:13 PM, you wrote: > > R> This provides the first section of X-Spam-Relays-Untrusted. > > And there is no other received header with that IP address, so where > is the second entry coming from?

Re: Loads of FPs caused by FORGED_RELAY_MUA_TO_MX

2019-06-07 Thread Niamh Holding
Hello RW, Friday, June 7, 2019, 4:43:13 PM, you wrote: R> This provides the first section of X-Spam-Relays-Untrusted. And there is no other received header with that IP address, so where is the second entry coming from? Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on

Re: Loads of FPs caused by FORGED_RELAY_MUA_TO_MX

2019-06-07 Thread RW
On Fri, 7 Jun 2019 16:30:58 +0100 Niamh Holding wrote: > Hello John, > > Friday, June 7, 2019, 3:56:03 PM, you wrote: > > JH> If you're getting FPs on this, I suggest you review your internal > JH> hosts. It looks for reserved IP ranges in external Received > JH> headers. > > This? > > * 3.

Re: Loads of FPs caused by FORGED_RELAY_MUA_TO_MX

2019-06-07 Thread Niamh Holding
Hello John, Friday, June 7, 2019, 3:56:03 PM, you wrote: JH> If you're getting FPs on this, I suggest you review your internal hosts. JH> It looks for reserved IP ranges in external Received headers. This? * 3.3 FORGED_RELAY_MUA_TO_MX No description available. . . . X-Spam-Relays-Untrusted:

Re: Loads of FPs caused by FORGED_RELAY_MUA_TO_MX

2019-06-07 Thread RW
On Fri, 7 Jun 2019 07:56:03 -0700 (PDT) John Hardin wrote: > On Fri, 7 Jun 2019, Niamh Holding wrote: > > > > > Hello > > > > Since 27/05/19 I've been getting loads of FPs caused by this rule > > scoring over 3, earlier in May and before it was scoring 0.0 > > > > Anyone know why the score has su

Re: Loads of FPs caused by FORGED_RELAY_MUA_TO_MX

2019-06-07 Thread John Hardin
On Fri, 7 Jun 2019, Niamh Holding wrote: Hello Since 27/05/19 I've been getting loads of FPs caused by this rule scoring over 3, earlier in May and before it was scoring 0.0 Anyone know why the score has suddenly rocketed for A rule that doesn't even have a description? The standard answer:

Loads of FPs caused by FORGED_RELAY_MUA_TO_MX

2019-06-07 Thread Niamh Holding
Hello Since 27/05/19 I've been getting loads of FPs caused by this rule scoring over 3, earlier in May and before it was scoring 0.0 Anyone know why the score has suddenly rocketed for A rule that doesn't even have a description? -- Best regards, Niamh mailto:ni...@f