Re: Match returned message headers on any NDR

2010-04-15 Thread Kris Deugau
Kris Deugau wrote: Is there a consistent way to match whatever headers might be available in a returned message? Anyone? Or am I stuck maintaining duplicate (or worse) sets of rules with (almost) the same regex for mimeheader, rawbody, ... I'm a bit surprised rawbody fails; IIRC it use

Re: [sa] Re: Match returned message headers on any NDR

2010-04-15 Thread Charles Gregory
On Wed, 14 Apr 2010, Kris Deugau wrote: I have yet to figure out why people think it's a good idea to relay mail from your domain host to your ISP account (especially when the two are different companies) Do not mistake the following statement for any form of approval :) To many

Re: Match returned message headers on any NDR

2010-04-14 Thread Kris Deugau
Matus UHLAR - fantomas wrote: On 14.04.10 16:16, Kris Deugau wrote: ... In other words, keep track of all of the third-party hosting systems our customers insist on forwarding their domain mail to their ISP account (ie, us) from? Not practical. requiring your users to send mail through yo

Re: Match returned message headers on any NDR

2010-04-14 Thread Matus UHLAR - fantomas
> Michael Scheidell wrote: >> i get NO backscatter here. >> case study for one of our clients, they got 50,000 spams a month >> (normally). they got joe jobbed. they started to get 5MM a month. >> (with no increase in backscatter reaching users. In fact, the client >> never knew.. until the

Re: Match returned message headers on any NDR

2010-04-14 Thread Kris Deugau
Michael Scheidell wrote: i get NO backscatter here. case study for one of our clients, they got 50,000 spams a month (normally). they got joe jobbed. they started to get 5MM a month. (with no increase in backscatter reaching users. In fact, the client never knew.. until the next month when h

Re: Match returned message headers on any NDR

2010-04-14 Thread Michael Scheidell
On 4/14/10 3:57 PM, Kris Deugau wrote: Michael Scheidell wrote: yes, but they are disabled unless you have specific whitelists. the 'original-message content' you are looking for. vbounce rules are disabled, even if you enable them unless you also have this in *.cf whitelist_bounce_relays

Re: Match returned message headers on any NDR

2010-04-14 Thread Kris Deugau
Matt Garretson wrote: Despite conventional wisdom to the contrary, I have been training Bayes on bounces (both spam and ham) for years with at least semi-decent results when it comes to backscatter. That'd be one potential way to get at the original content (when it's available). But I'd advise a

Re: Match returned message headers on any NDR

2010-04-14 Thread Kris Deugau
Michael Scheidell wrote: yes, but they are disabled unless you have specific whitelists. the 'original-message content' you are looking for. vbounce rules are disabled, even if you enable them unless you also have this in *.cf whitelist_bounce_relays {your outbound mail servers} As I sai

Re: Match returned message headers on any NDR

2010-04-14 Thread Matt Garretson
On 4/14/2010 2:23 PM, Kris Deugau wrote: > I'm looking for a way to match on that original-message content - after > all, that's the real spam payload; the rest of the message is perfectly > legitimate. Despite conventional wisdom to the contrary, I have been training Bayes on bounces (both sp

Re: Match returned message headers on any NDR

2010-04-14 Thread Michael Scheidell
On 4/14/10 2:23 PM, Kris Deugau wrote: Michael Scheidell wrote: On 4/14/10 12:21 PM, Kris Deugau wrote: Is there a consistent way to match whatever headers might be available in a returned message? use the vbounce rules. google for sa and vbounce. its already done if you are using a newer

Re: Match returned message headers on any NDR

2010-04-14 Thread Kris Deugau
Michael Scheidell wrote: On 4/14/10 12:21 PM, Kris Deugau wrote: Is there a consistent way to match whatever headers might be available in a returned message? use the vbounce rules. google for sa and vbounce. its already done if you are using a newer version of SA. you need to specifically

Re: Match returned message headers on any NDR

2010-04-14 Thread d . hill
Quoting Michael Scheidell : On 4/14/10 12:21 PM, Kris Deugau wrote: Is there a consistent way to match whatever headers might be available in a returned message? use the vbounce rules. google for sa and vbounce. its already done if you are using a newer version of SA. you need to specifi

Re: Match returned message headers on any NDR

2010-04-14 Thread Michael Scheidell
On 4/14/10 12:21 PM, Kris Deugau wrote: Is there a consistent way to match whatever headers might be available in a returned message? use the vbounce rules. google for sa and vbounce. its already done if you are using a newer version of SA. you need to specifically whitelist the outbound mai

Match returned message headers on any NDR

2010-04-14 Thread Kris Deugau
Is there a consistent way to match whatever headers might be available in a returned message? I've got one customer reporting backscatter spam, and while I've been able to create a number of rules that usually hit, they tend to fail on NDRs that are not "properly" formatted (eg, complete or h