Re: namechep and DOB

2024-07-08 Thread Alex
On Mon, Jul 8, 2024 at 7:33 PM Matija Nalis wrote: > On Mon, Jul 08, 2024 at 05:13:29PM -0400, Alex wrote: > > Are there RBLs available that can be used to determine registrar or date > of > > registration? I understand the limits of querying a registrar but thought > > there might be an RBL out

Re: namechep and DOB

2024-07-08 Thread Matija Nalis
On Mon, Jul 08, 2024 at 05:13:29PM -0400, Alex wrote: > Are there RBLs available that can be used to determine registrar or date of > registration? I understand the limits of querying a registrar but thought > there might be an RBL out there with this info? https://spameatingmonkey.com/services

Re: namechep and DOB

2024-07-08 Thread Alex
Hi, Alex - Check out the FROM_FMBLA_NEWDOM rules. Are you seeing any emails > hitting them? > Yes, got them, from here: https://github.com/fmbla/spamassassin/blob/master/FMBLA.cf Didn't hit. Jul 8 18:02:53.537 [4189153] dbg: dnseval: checking [sendersrv.com] / FROM_NEWDOMAIN_FMBLA / blfmbla /

Re: namechep and DOB

2024-07-08 Thread Mark London
Alex - Check out the FROM_FMBLA_NEWDOM rules.  Are you seeing any emails hitting them? In my case, URIBL_RHS_DOB is no longer working at all.   Is this still working? - Mark On 7/8/2024 5:13 PM, Alex wrote: Hi, I'm seeing emails from smartlendingclub dot com getting through that are

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
On Thursday, July 04, 2024 02:01 AEST, Benny Pedersen wrote: > Simon Wilson via users skrev den 2024-07-03 15:54: > > > header AUTHRES_DKIM_PASS eval:check_authres_result('dkim', 'pass') > > header USER_IN_DKIM_WHITELIST eval:check_for_dkim_whitelist_from() > > keep scores of them neutral >

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
On Thursday, July 04, 2024 01:11 AEST, Bill Cole wrote: > On 2024-07-03 at 10:19:28 UTC-0400 (Thu, 04 Jul 2024 00:19:28 +1000) > Simon Wilson via users > is rumored to have said: > > > On 03.07.24 23:54, Simon Wilson via users wrote: > >> Simon Wilson via users skrev den 2024-07-03 14:56: >

Re: whitelist_auth return_path / from

2024-07-03 Thread Matus UHLAR - fantomas
On 03.07.24 23:54, Simon Wilson via users wrote: Simon Wilson via users skrev den 2024-07-03 14:56: Do I also need to disable the normal SA DKIM plugin evaluation, i.e. trusting my upstream authres_trusted_authserv only? both works in paralel, so no need to disable, best results came from 

Re: whitelist_auth return_path / from

2024-07-03 Thread Benny Pedersen
Simon Wilson via users skrev den 2024-07-03 07:48: whitelist_auth supp...@wasabi.com whitelist_auth *@mmemail.wasabi.com its more simple to set From: "Simon" in mua then both spf and dkim gives pass on same domain, note -d in dkim is not same domain, so you need a new dkim sign key for

Re: whitelist_auth return_path / from

2024-07-03 Thread Benny Pedersen
Simon Wilson via users skrev den 2024-07-03 15:54: header AUTHRES_DKIM_PASS eval:check_authres_result('dkim', 'pass') header USER_IN_DKIM_WHITELIST eval:check_for_dkim_whitelist_from() keep scores of them neutral meta MY_DKIM_FAILS_NOTRUST (AUTHRES_DKIM_PASS && USER_IN_DKIM_WHITELIST)

Re: whitelist_auth return_path / from

2024-07-03 Thread Benny Pedersen
Bill Cole skrev den 2024-07-03 17:11: Not Currently Available For Hire lol :) back to sandbox, hehe

Re: whitelist_auth return_path / from

2024-07-03 Thread Benny Pedersen
Matus UHLAR - fantomas skrev den 2024-07-03 16:14: On 03.07.24 23:54, Simon Wilson via users wrote: Simon Wilson via users skrev den 2024-07-03 14:56: Do I also need to disable the normal SA DKIM plugin evaluation, i.e. trusting my upstream authres_trusted_authserv only? both works in

Re: whitelist_auth return_path / from

2024-07-03 Thread Bill Cole
On 2024-07-03 at 10:19:28 UTC-0400 (Thu, 04 Jul 2024 00:19:28 +1000) Simon Wilson via users is rumored to have said: On 03.07.24 23:54, Simon Wilson via users wrote: Simon Wilson via users skrev den 2024-07-03 14:56: Do I also need to disable the normal SA DKIM plugin evaluation, i.e.

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
Simon Wilson via users skrev den 2024-07-03 14:56: > Do I also need to disable the normal SA DKIM plugin evaluation, i.e. > trusting my upstream authres_trusted_authserv only? both works in paralel, so no need to disable, best results came from  both enabled its up to you to add more

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
On 03.07.24 23:54, Simon Wilson via users wrote: >Simon Wilson via users skrev den 2024-07-03 14:56: >> Do I also need to disable the normal SA DKIM plugin evaluation, i.e. >> trusting my upstream authres_trusted_authserv only? > >both works in paralel, so no need to disable, best results came

Re: whitelist_auth return_path / from

2024-07-03 Thread Matus UHLAR - fantomas
On 03.07.24 23:54, Simon Wilson via users wrote: Simon Wilson via users skrev den 2024-07-03 14:56: Do I also need to disable the normal SA DKIM plugin evaluation, i.e. trusting my upstream authres_trusted_authserv only? both works in paralel, so no need to disable, best results came from 

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
Simon Wilson via users skrev den 2024-07-03 14:56: > Do I also need to disable the normal SA DKIM plugin evaluation, i.e. > trusting my upstream authres_trusted_authserv only? both works in paralel, so no need to disable, best results came from  both enabled its up to you to add more

Re: whitelist_auth return_path / from

2024-07-03 Thread Benny Pedersen
Simon Wilson via users skrev den 2024-07-03 14:56: Do I also need to disable the normal SA DKIM plugin evaluation, i.e. trusting my upstream authres_trusted_authserv only? both works in paralel, so no need to disable, best results came from both enabled its up to you to add more

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
  Simon Wilson via users skrev den 2024-07-03 14:13: > I don't think SA 3.4.6 on RH8 has AuthRes plugin: take it from spamassassin trunc, this plugin works on 3.4.6 aswell, but  was not released or tested on it, i have verify it does work #!/bin/sh svn checkout

Re: whitelist_auth return_path / from

2024-07-03 Thread Benny Pedersen
Simon Wilson via users skrev den 2024-07-03 14:13: I don't think SA 3.4.6 on RH8 has AuthRes plugin: take it from spamassassin trunc, this plugin works on 3.4.6 aswell, but was not released or tested on it, i have verify it does work #!/bin/sh svn checkout

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
On Wednesday, July 03, 2024 22:06 AEST, "Simon Wilson via users" wrote:   Dave Funk skrev den 2024-07-03 09:29: > On Wed, 3 Jul 2024, Simon Wilson via users wrote: > You say "passing SPF and DKIM" however in the SA rules report it  > clearly says: > DKIM_SIGNED=0.1, DKIM_INVALID=0.1 >  >

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
Dave Funk skrev den 2024-07-03 09:29: > On Wed, 3 Jul 2024, Simon Wilson via users wrote: > You say "passing SPF and DKIM" however in the SA rules report it  > clearly says: > DKIM_SIGNED=0.1, DKIM_INVALID=0.1 >  > So eventho you think 'passed DKIM' SA clearly does NOT think it does.  > That

Re: whitelist_auth return_path / from

2024-07-03 Thread Benny Pedersen
Simon Wilson via users skrev den 2024-07-03 09:48: So I guess the question is why SA is not accepting a trusted header with a DKIM pass recorded with the same mail path through the system? I have no AuthRes settings set specifically in local.cf. so add it :) ifplugin

Re: whitelist_auth return_path / from

2024-07-03 Thread Benny Pedersen
Dave Funk skrev den 2024-07-03 09:29: On Wed, 3 Jul 2024, Simon Wilson via users wrote: You say "passing SPF and DKIM" however in the SA rules report it clearly says: DKIM_SIGNED=0.1, DKIM_INVALID=0.1 So eventho you think 'passed DKIM' SA clearly does NOT think it does. That DKIM_INVALID

Re: whitelist_auth return_path / from

2024-07-03 Thread Simon Wilson via users
On Wed, 3 Jul 2024, Simon Wilson via users wrote: > Does whitelist_auth work on From header, or Return-Path? Reason I ask: > >  >  > I have two emails from “support .at. wasabi.com”. Due to their emails usually > triggering KAM rules I have (in > /etc/mail/spamassassin/local.cf): > >  >  > ##

Re: whitelist_auth return_path / from

2024-07-03 Thread Dave Funk
On Wed, 3 Jul 2024, Simon Wilson via users wrote: Does whitelist_auth work on From header, or Return-Path? Reason I ask: I have two emails from “support .at. wasabi.com”. Due to their emails usually triggering KAM rules I have (in /etc/mail/spamassassin/local.cf): ## Whitelist Wasabi,

Re: help with ubuntu 22.04

2024-07-01 Thread Matus UHLAR - fantomas
On 29.06.24 17:07, Rick Gutierrez wrote: hi list , The latest version of spamassassin on Ubuntu 22.04 does not exist or they did not create the deb package, someone on the list who has the deb package and wants to share it. https://packages.ubuntu.com/search?keywords=spamassassin perhaps you

Re: ChatGPT > Spamassassin? :)

2024-06-28 Thread Marcin Mirosław
W dniu 2024-06-25 15:55, John Hardin napisał(a): On Mon, 24 Jun 2024, Mark London wrote: I received a spam email with the text below, that wasn't caught by Spamassasin (at least mine). The text actually looks like something that was generated using ChatGPT. In any event, I put the text

Sv: Re: ChatGPT > Spamassassin? :)

2024-06-25 Thread Anders Gustafsson
That is the way some email clients, say GroupWise does it. There is an option to put all mail from new receivers in the junk folder for perusal. OTOH should simple graylisting do the same thing. But yes, an option to deduct points from previously unseen senders would be useful. -- Med vänlig

Re: ChatGPT > Spamassassin? :)

2024-06-25 Thread Bill Cole
On 2024-06-25 at 17:38:28 UTC-0400 (Tue, 25 Jun 2024 17:38:28 -0400) Mark London is rumored to have said: Bill - Thanks for the response.  As an aside, it would be nice (though impossible?) for a spam filter to be more suspicious of emails coming from a new email address, that is not in my

Re: ChatGPT > Spamassassin? :)

2024-06-25 Thread Matija Nalis
On Tue, Jun 25, 2024 at 05:38:28PM -0400, Mark London wrote: > Bill - Thanks for the response.  As an aside, it would be nice (though > impossible?) for a spam filter to be more suspicious of emails coming from a > new email address, that is not in my Sent folder or my Inbox. FWIW. - Mark

Re: ChatGPT > Spamassassin? :)

2024-06-25 Thread Mark London
Bill - Thanks for the response.  As an aside, it would be nice (though impossible?) for a spam filter to be more suspicious of emails coming from a new email address, that is not in my Sent folder or my Inbox. FWIW. - Mark On 6/25/2024 11:21 AM, Bill Cole wrote: Mark London is rumored to

Re: ChatGPT > Spamassassin? :) -- move along, this is not the reply you are looking for.

2024-06-25 Thread Grant Taylor via users
On 6/25/24 12:21 PM, Adam Bowen wrote: I asked a well known chatbot: What would Bill Cole say if he was asked about integrating AI in to spamassassin? LOL I needed that laugh. Thank you Adam. -- Grant. . . . unix || die

Re: ChatGPT > Spamassassin? :)

2024-06-25 Thread Adam Bowen
On 25/06/2024 16:21, Bill Cole wrote: On 2024-06-24 at 17:18:11 UTC-0400 (Mon, 24 Jun 2024 17:18:11 -0400) Mark London is rumored to have said: I received a spam email with the text below, that wasn't caught by Spamassasin (at least mine).   The text actually looks like something that was

Re: ChatGPT > Spamassassin? :)

2024-06-25 Thread Bill Cole
On 2024-06-24 at 17:18:11 UTC-0400 (Mon, 24 Jun 2024 17:18:11 -0400) Mark London is rumored to have said: I received a spam email with the text below, that wasn't caught by Spamassasin (at least mine). The text actually looks like something that was generated using ChatGPT. In any event,

Re: ChatGPT > Spamassassin? :)

2024-06-25 Thread John Hardin
On Mon, 24 Jun 2024, Mark London wrote: I received a spam email with the text below, that wasn't caught by Spamassasin (at least mine). The text actually looks like something that was generated using ChatGPT. In any event, I put the text through ChatGPT, and asked if it looked like spam.

Re: ChatGPT > Spamassassin? :)

2024-06-24 Thread jarland
I'm very interested in the concept. I imagine you'd need to have a locally running LLM rather than using an API, both for concerns of privacy and performance. Even if not SpamAssassin, I'd love to find anyone's open source implementation of AI for spam filtering. On 2024-06-24 16:18, Mark

Re: BayesStore MariaDB on EL9

2024-06-24 Thread Lucas Rolff
ubject: Re: BayesStore MariaDB on EL9 Hi, for your information and anyone who comes across this problem: I have opened an issue with RedHat. https://issues.redhat.com/browse/RHEL-43418 It probably will be backported, but may take some time, maybe in 9.5 or possibly later. We'll see... Regards,

Re: BayesStore MariaDB on EL9

2024-06-24 Thread Gerald Vogt
Hi, for your information and anyone who comes across this problem: I have opened an issue with RedHat. https://issues.redhat.com/browse/RHEL-43418 It probably will be backported, but may take some time, maybe in 9.5 or possibly later. We'll see... Regards, Gerald On 19.06.24 08:41,

Re: Mail::SpamAssassin::Plugin::Phishing PhishStats[.]info domain expired

2024-06-24 Thread giovanni
On 6/23/24 10:26 PM, Larry Nedry via users wrote: On 7/21/23 9:10 AM, Giovanni Bechis wrote: Hi, phishstats[.]info domain has recently moved to a parking domain, if you are using Mail::SpamAssassin::Plugin::Phishing plugin with data downloaded from PhishStats[.]info it would be better to

Re: Mail::SpamAssassin::Plugin::Phishing PhishStats[.]info domain expired

2024-06-23 Thread Larry Nedry via users
On 7/21/23 9:10 AM, Giovanni Bechis wrote: Hi, phishstats[.]info domain has recently moved to a parking domain, if you are using Mail::SpamAssassin::Plugin::Phishing plugin with data downloaded from PhishStats[.]info it would be better to comment "phishing_phishstats_feed" configuration line.

Re: Questions about spamassassin

2024-06-22 Thread Matus UHLAR - fantomas
Paul Schmehl skrev den 2024-06-21 01:17: bayes_path /usr/local/etc/mail/spamassassin/bayes/bayes On 22.06.24 16:30, Benny Pedersen wrote: this need spamd running as root :/ according to OP mail the directory is owned by spamd user https://marc.info/?l=spamassassin-users=171891451702472=2

Re: Questions about spamassassin

2024-06-22 Thread Benny Pedersen
Paul Schmehl skrev den 2024-06-21 01:17: bayes_path /usr/local/etc/mail/spamassassin/bayes/bayes this need spamd running as root :/ bayes_path ~/.spamassassin/bayes path is not a file, just a dir expanded without ~ is in gentoo /var/lib/spamd this support any system users, spamd homedir

Re: Question about sa-updates

2024-06-22 Thread Benny Pedersen
Paul Schmehl skrev den 2024-06-22 07:44: It’s not clear to me from your answer. Does SA read rules in both places? it eveal first sa-update rules, then later host rules Or only in /etc/mail/spamassassin/? this is host rules, you define all global configs here, and it will never be

Re: Question about sa-updates

2024-06-22 Thread David B Funk
On Sat, 22 Jun 2024, Paul Schmehl wrote: On Jun 22, 2024, at 12:28 AM, Kenneth Porter wrote: On 6/21/2024 8:56 PM, Paul Schmehl wrote: I scratched my head, then looked up the man page for sa-update on the web. Sure enough, that’s where the rules go. Is that where my

Re: Question about sa-updates

2024-06-21 Thread Paul Schmehl
> On Jun 22, 2024, at 12:28 AM, Kenneth Porter wrote: > > On 6/21/2024 8:56 PM, Paul Schmehl wrote: >> I scratched my head, then looked up the man page for sa-update on the web. >> Sure enough, that’s where the rules go. Is that where my local.cf file >> should be located? Right now it’s in

Re: Question about sa-updates

2024-06-21 Thread Kenneth Porter
On 6/21/2024 8:56 PM, Paul Schmehl wrote: I scratched my head, then looked up the man page for sa-update on the web. Sure enough, that’s where the rules go. Is that where my local.cf file should be located? Right now it’s in /etc/mail/spamassassin. There’s a default local.cf file in

Re: Questions about spamassassin

2024-06-21 Thread Paul Schmehl
> On Jun 21, 2024, at 8:24 AM, Bill Cole > wrote: > > On 2024-06-20 at 19:17:19 UTC-0400 (Thu, 20 Jun 2024 18:17:19 -0500) > Paul Schmehl > is rumored to have said: > >> Here’s every line with bayes_ in it: >> bayes_#auto_learn 1 >> bayes_learn_to_journal 1 >> bayes_path

Re: MSGID_BELONGS_RECIPIENT and DKIMWL

2024-06-21 Thread Alex
Kris, thanks so much for the direction. It was enough for me to investigate and make some changes. I hadn't realized I still had Paul Stead's rules locally as well as updated rules in SA proper. Thanks, Alex On Thu, Jun 20, 2024 at 11:23 AM Kris Deugau wrote: > Alex wrote: > > Hi, > > > > I

Re: Questions about spamassassin

2024-06-21 Thread Bill Cole
On 2024-06-20 at 19:17:19 UTC-0400 (Thu, 20 Jun 2024 18:17:19 -0500) Paul Schmehl is rumored to have said: > Here’s every line with bayes_ in it: > bayes_#auto_learn 1 > bayes_learn_to_journal 1 > bayes_path /usr/local/etc/mail/spamassassin/bayes/bayes > bayes_file_mode 0775 >

Re: Questions about spamassassin

2024-06-20 Thread Paul Schmehl
> On Jun 20, 2024, at 6:05 PM, Bill Cole > wrote: > > On 2024-06-20 at 16:14:47 UTC-0400 (Thu, 20 Jun 2024 15:14:47 -0500) > Paul Schmehl mailto:paul.schm...@gmail.com>> > is rumored to have said: > >> I’m running spamassassin (SA) 3.4, postfix 3.9.0-1, and dovecot 2.2.36-8 on >> a linux

Re: Questions about spamassassin

2024-06-20 Thread Bill Cole
On 2024-06-20 at 16:14:47 UTC-0400 (Thu, 20 Jun 2024 15:14:47 -0500) Paul Schmehl is rumored to have said: I’m running spamassassin (SA) 3.4, postfix 3.9.0-1, and dovecot 2.2.36-8 on a linux server. I have some questions about SA that I can’t seem to find answers for on the web. The SA conf

Re: MSGID_BELONGS_RECIPIENT and DKIMWL

2024-06-20 Thread Kris Deugau
Alex wrote: Hi, I had an obit email very unfortunately get tagged as spam for what appears to be the result of a few DKIMWL rules and MSGID_BELONGS_RECIPIENT.  *  1.0 DKIMWL_BULKMAILER_LOW ASKDNS: DKIMwl.org - Low scoring bulkmailer  *      

Re: Docs confusion and missing dependency on EL9

2024-06-19 Thread Bill Cole
On 2024-06-19 at 01:28:20 UTC-0400 (Wed, 19 Jun 2024 07:28:20 +0200) Gerald Vogt is rumored to have said: Hi, for testing I tried to install spamassassin 4.0.1 on EL9 (AlmaLinux 9.4). I have noticed some dependencies are not mentioned on the INSTALL page: I have had to install

Re: BayesStore MariaDB on EL9

2024-06-19 Thread Gerald Vogt
On 18.06.24 22:23, Bill Cole wrote: On 2024-06-18 at 14:58:15 UTC-0400 (Tue, 18 Jun 2024 20:58:15 +0200) Gerald Vogt is rumored to have said: Hi, for a test, I have increased the column length of token to binary(32) and used a test file to import containing a single token. This time it

Re: BayesStore MariaDB on EL9

2024-06-18 Thread Bill Cole
On 2024-06-18 at 14:58:15 UTC-0400 (Tue, 18 Jun 2024 20:58:15 +0200) Gerald Vogt is rumored to have said: Hi, for a test, I have increased the column length of token to binary(32) and used a test file to import containing a single token. This time it went through. However, as I suspected,

Re: BayesStore MariaDB on EL9

2024-06-18 Thread Gerald Vogt
Hi, for a test, I have increased the column length of token to binary(32) and used a test file to import containing a single token. This time it went through. However, as I suspected, the token length is not 5 byte. Token line from backup: t 1 0 1718024618 027121926a

Re: Sv: Re: Question about a rule

2024-06-18 Thread Laurent S.
I'd also strongly recommend adding boundaries: /\b(blah1|blah2|blah3)\b/i Otherwise, you might have a whole *pano*ply of words that will make legit mails marked a spam. You need to be super sure about poison pills rules, or in french - *pillu*le empoisonnée. Good luck. On 18.06.24 13:35, Axb

Re: Sv: Re: Question about a rule

2024-06-18 Thread Axb
You need to enclose in brackets body LOCAL_BLAH /(blah1|blah2|blah3)/i On 6/18/24 13:05, Anders Gustafsson wrote: Sure: body LOCAL_PORN_RULE /kiimainen|naida|sexikäs|nussikas|nussia|pillu|pano|kinky|bdsm|pillua|x69-JOOGA/i score LOCAL_PORN_RULE 8 describe LOCAL_PORN_RULE This

Re: Sv: Re: Question about a rule

2024-06-18 Thread Matus UHLAR - fantomas
On 18.06.24 14:05, Anders Gustafsson wrote: body LOCAL_PORN_RULE /kiimainen|naida|sexikäs|nussikas|nussia|pillu|pano|kinky|bdsm|pillua|x69-JOOGA/i score LOCAL_PORN_RULE 8 describe LOCAL_PORN_RULE This catches peter's porn spam Sorry again for mailing directly. No idea why it suggests

Sv: Re: Question about a rule

2024-06-18 Thread Anders Gustafsson
Sure: body LOCAL_PORN_RULE /kiimainen|naida|sexikäs|nussikas|nussia|pillu|pano|kinky|bdsm|pillua|x69-JOOGA/i score LOCAL_PORN_RULE 8 describe LOCAL_PORN_RULE This catches peter's porn spam Sorry again for mailing directly. No idea why it suggests the user and not users@ -- Med vänlig

Re: Question about a rule

2024-06-18 Thread Matus UHLAR - fantomas
On 18.06.24 13:50, Anders Gustafsson wrote: body LOCAL_PORN_RULE /word1|word2.|x69-JOOGA/i score LOCAL_PORN_RULE 8 describe LOCAL_PORN_RULE This catches peter's porn spam Funny thing is that it seems to trigger on messages that contain none of those words. I have removed the actual

Sv: Re: Need some help decoding an SA analysis

2024-06-17 Thread Anders Gustafsson
Read the document. Upgraded. Ran sa-update (always forget that) We really have a very simple setup, except for our homegrown integration wiith our email system. So I added enable_compat welcomelist_blocklist" to init.pre Then did a search/replace of local.cf for all whitelist_from and

Re: Need some help decoding an SA analysis

2024-06-16 Thread Benny Pedersen
Anders Gustafsson skrev den 2024-06-16 13:42: This one: Return-path: X-Spam-Checker-Version: SpamAssassin 3.4.5 (2021-03-20) on xx X-Spam-Level: X-Spam-Status: No, score=-95.6 required=5.0 tests=BAYES_00,HTML_MESSAGE, MIME_HTML_ONLY,RCVD_IN_MSPIKE_BL,RCVD_IN_MSPIKE_L5,RDNS_NONE,

Re: Need some help decoding an SA analysis

2024-06-16 Thread Matus UHLAR - fantomas
On 16.06.24 14:42, Anders Gustafsson wrote: Return-path: X-Spam-Checker-Version: SpamAssassin 3.4.5 (2021-03-20) on xx X-Spam-Level: X-Spam-Status: No, score=-95.6 required=5.0 tests=BAYES_00,HTML_MESSAGE, MIME_HTML_ONLY,RCVD_IN_MSPIKE_BL,RCVD_IN_MSPIKE_L5,RDNS_NONE,

Re: Where are your test definitions?

2024-06-15 Thread Matus UHLAR - fantomas
Am 2024-06-14 21:20, schrieb Matus UHLAR - fantomas: If you want to find out more, feed the mail to "spamassassin -D" and that should explain which text matched which rules. and as we told you already, your client should NOT play with small or semi-invisible text in mail. That's what spamers

Re: Where are your test definitions?

2024-06-14 Thread John Hardin
On Fri, 14 Jun 2024, Bowie Bailey wrote: On 6/14/2024 10:39 AM, Thomas Barth via users wrote: Hello, I would like to explain a sender what he can do to create an email that is not classified as spam. X-Spam-Status: Yes, score=6.248 tagged_above=1 required=5  tests=[BAYES_00=-1.9,

Re: Where are your test definitions?

2024-06-14 Thread Bill Cole
On 2024-06-14 at 17:33:22 UTC-0400 (Fri, 14 Jun 2024 23:33:22 +0200) Thomas Barth via users is rumored to have said: Am 2024-06-14 21:20, schrieb Matus UHLAR - fantomas: grep -ri "FONT_INVIS_NORDNS" /var/lib/spamassassin/ | grep describe

Re: Where are your test definitions?

2024-06-14 Thread Thomas Barth via users
Am 2024-06-14 21:20, schrieb Matus UHLAR - fantomas: grep -ri "FONT_INVIS_NORDNS" /var/lib/spamassassin/ | grep describe /var/lib/spamassassin/4.00/updates_spamassassin_org/72_active.cf: describe FONT_INVIS_NORDNS Invisible text + no rDNS In my case, I can say with certainty that the mail

Re: Where are your test definitions?

2024-06-14 Thread Matus UHLAR - fantomas
Am 2024-06-14 18:24, schrieb Matus UHLAR - fantomas: 1. as I said it's hard to find out without the body 2. hiding data indicates a spammer. On 14.06.24 19:15, Thomas Barth via users wrote: Yes, I've now realized that I can simply grep for the descriptions. grep -ri "FONT_INVIS_NORDNS"

Re: Where are your test definitions?

2024-06-14 Thread Bill Cole
On 2024-06-14 at 10:39:36 UTC-0400 (Fri, 14 Jun 2024 16:39:36 +0200) Thomas Barth via users is rumored to have said: Hello, I would like to explain a sender what he can do to create an email that is not classified as spam. X-Spam-Status: Yes, score=6.248 tagged_above=1 required=5

Re: Where are your test definitions?

2024-06-14 Thread Thomas Barth via users
Am 2024-06-14 18:24, schrieb Matus UHLAR - fantomas: 1. as I said it's hard to find out without the body 2. hiding data indicates a spammer. Yes, I've now realized that I can simply grep for the descriptions. grep -ri "FONT_INVIS_NORDNS" /var/lib/spamassassin/ | grep describe

Re: Where are your test definitions?

2024-06-14 Thread Matus UHLAR - fantomas
Am 2024-06-14 17:11, schrieb Matus UHLAR - fantomas: FONT_INVIS_NORDNS=1.544 HTML_FONT_TINY_NORDNS=1.514 RDNS_NONE=0.793 working fcrdns would fix much for them. However, not doing stupid shit with fonts would help even more: FONT_INVIS_MSGID=2.497 FONT_INVIS_NORDNS=1.544

Re: Lots of FN because of VALIDITY* rules

2024-06-14 Thread Anne P. Mitchell, Esq.
> On Jun 3, 2024, at 4:09 AM, Matus UHLAR - fantomas wrote: > > I forgot to add that I have "lowered" (increased to small negative number) > scores for RCVD_IN_VALIDITY_*, RCVD_IN_DNSWL_* and RCVD_IN_IADB_* > because I has similar bad experience with them. Matus, if you EVER have a bad

Re: Where are your test definitions?

2024-06-14 Thread Bowie Bailey
On 6/14/2024 10:39 AM, Thomas Barth via users wrote: Hello, I would like to explain a sender what he can do to create an email that is not classified as spam. X-Spam-Status: Yes, score=6.248 tagged_above=1 required=5  tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1,

Re: Where are your test definitions?

2024-06-14 Thread Thomas Barth via users
Am 2024-06-14 17:11, schrieb Matus UHLAR - fantomas: FONT_INVIS_NORDNS=1.544 HTML_FONT_TINY_NORDNS=1.514 RDNS_NONE=0.793 working fcrdns would fix much for them. However, not doing stupid shit with fonts would help even more: FONT_INVIS_MSGID=2.497 FONT_INVIS_NORDNS=1.544

Re: Where are your test definitions?

2024-06-14 Thread Noel Butler
On 15/06/2024 01:04, Thomas Barth via users wrote: Am 2024-06-14 16:44, schrieb Reindl Harald (privat): with RDNS_NONE nobody on this planet should accept mails from that machine and the admin has to be fired, the message should be jejected at SMTP level long before spamassassin And you

Re: Where are your test definitions?

2024-06-14 Thread Thomas Barth via users
Am 2024-06-14 16:44, schrieb Reindl Harald (privat): with RDNS_NONE nobody on this planet should accept mails from that machine and the admin has to be fired, the message should be jejected at SMTP level long before spamassassin And you would have been dismissed because of your pathological

Re: Where are your test definitions?

2024-06-14 Thread Matus UHLAR - fantomas
On 14.06.24 16:39, Thomas Barth via users wrote: I would like to explain a sender what he can do to create an email that is not classified as spam. X-Spam-Status: Yes, score=6.248 tagged_above=1 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1,

Re: DKIM ... KAPUT

2024-06-12 Thread Noel Butler
On 13/06/2024 08:59, Rupert Gallagher wrote: Yesterday I disabled DKIM as a spam indicator, because I got tired of adding exceptions. Non-compliant relays should fail hard, but they do not. This is a tragedy. I have NFI why you wasted your time telling us this DKIM only proves it was

Re: Warning: Your Pyzor may be broken.

2024-06-11 Thread Matus UHLAR - fantomas
On 2024-06-08 14:45:34, Bill Cole wrote: I went looking for a better fix and found a reported issue at https://github.com/SpamExperts/pyzor/issues/155 matching my original symptoms in which a workaround was provided: install directly from the GitHub project's master.zip link, i.e. a snapshot

Re: Warning: Your Pyzor may be broken.

2024-06-10 Thread Lucas Rolff
he.org Subject: Re: Warning: Your Pyzor may be broken. On 10-06-2024 15:05, giova...@paclan.it wrote: > On 6/9/24 7:31 PM, John Hardin wrote: >> On Sun, 9 Jun 2024, Michael Orlitzky wrote: >> >>> On 2024-06-08 14:45:34, Bill Cole wrote: >>> >>>> I went

Re: Warning: Your Pyzor may be broken.

2024-06-10 Thread Tom Hendrikx
On 10-06-2024 15:05, giova...@paclan.it wrote: On 6/9/24 7:31 PM, John Hardin wrote: On Sun, 9 Jun 2024, Michael Orlitzky wrote: On 2024-06-08 14:45:34, Bill Cole wrote: I went looking for a better fix and found a reported issue at https://github.com/SpamExperts/pyzor/issues/155 matching

Re: Warning: Your Pyzor may be broken.

2024-06-10 Thread giovanni
On 6/9/24 7:31 PM, John Hardin wrote: On Sun, 9 Jun 2024, Michael Orlitzky wrote: On 2024-06-08 14:45:34, Bill Cole wrote: I went looking for a better fix and found a reported issue at https://github.com/SpamExperts/pyzor/issues/155 matching my original symptoms in which a workaround was

Re: Warning: Your Pyzor may be broken.

2024-06-09 Thread John Hardin
On Sun, 9 Jun 2024, Michael Orlitzky wrote: On 2024-06-08 14:45:34, Bill Cole wrote: I went looking for a better fix and found a reported issue at https://github.com/SpamExperts/pyzor/issues/155 matching my original symptoms in which a workaround was provided: install directly from the GitHub

Re: Warning: Your Pyzor may be broken.

2024-06-09 Thread Michael Orlitzky
On 2024-06-08 14:45:34, Bill Cole wrote: > I went looking for a better fix and found a reported issue at > https://github.com/SpamExperts/pyzor/issues/155 matching my original > symptoms in which a workaround was provided: install directly from > the GitHub project's master.zip link, i.e. a

Re: Warning: Your Pyzor may be broken.

2024-06-08 Thread Bill Cole
On 2024-06-08 at 15:35:01 UTC-0400 (Sat, 08 Jun 2024 21:35:01 +0200) Benny Pedersen is rumored to have said: > Bill Cole skrev den 2024-06-08 20:45: > >> I've chosen #3 for myself, but it's not great. > > is why cpanel provided a perl pyzor client ? I had forgotten about that. Thank you, Benny.

Re: Warning: Your Pyzor may be broken.

2024-06-08 Thread Benny Pedersen
Bill Cole skrev den 2024-06-08 20:45: I've chosen #3 for myself, but it's not great. is why cpanel provided a perl pyzor client ? ifplugin Mail::SpamAssassin::Plugin::Pyzor use_pyzor 1 pyzor_count_min 1 pyzor_welcomelist_min 1 pyzor_welcomelist_factor 0.2 pyzor_fork 0

Re: [mailop] SORBS Closing.

2024-06-08 Thread A. Schulze
Am 07.06.24 um 23:33 schrieb Bill Cole: You do not even need to do that. All SORBS-referencing rules were removed from the updates.spamasssassin.org rules channel earlier this week. Scanning the latest deployed (by sa-update) version r1918114 I see no surviving references to SORBS. since

Re: [mailop] SORBS Closing.

2024-06-07 Thread Bill Cole
On 2024-06-06 at 19:53:02 UTC-0400 (Thu, 6 Jun 2024 19:53:02 -0400) J Doe is rumored to have said: [...] > Hi Rob and list, > > Speaking as a small user of SORBS via SpamAssassin 4.0, I assume the > correct response to disable use of SORBS is to place the following in my > local.cf file: > >

Re: RCVD_IN_RP_CERTIFIED always -3

2024-06-07 Thread Bill Cole
On 2024-06-06 at 12:08:54 UTC-0400 (Thu, 6 Jun 2024 18:08:54 +0200) is rumored to have said: > Thanks for your answer Harald. > > Regarding "there is no such configuration option in SpamAssassin": The conf > snipplet I posted below comes from the repository, however it's an older > version,

Re: AW: RCVD_IN_RP_CERTIFIED always -3

2024-06-07 Thread Matus UHLAR - fantomas
On 06.06.24 21:17, hostmas...@audiogen.ch wrote: I just got the latest rules. I'm okay with poor performance for some of the rules as there isn't much load on the related system. And yes, you're right, on Ubuntu 20.04.06 the rules are installed in /usr/share/spamassassin. sa-update has placed

Re: TxRep does not evaluate EMAIL_IP reputation

2024-06-07 Thread Tomohiro Hosaka
Thanks for the reply. I will try to register it in bugzilla little by little. 2024-06-03 17:04 に giova...@paclan.it さんは書きました: On 6/3/24 1:10 AM, Tomohiro Hosaka wrote: Slight correction. 2024-06-03 07:55 に Tomohiro Hosaka さんは書きました: Here $rc is dualvar. https://metacpan.org/pod/DBI#execute

Re: Fwd: [mailop] SORBS Closing.

2024-06-06 Thread J Doe
On 2024-06-05 04:44, Rob McEwen via users wrote: From "Frido Otten" mailto:fr...@0tten.nl>> So is there anything that needs to be done to prevent false positives happening right after the shutdown? They said they were emptying the zone files, not actually "listing the world" - so this

Re: RCVD_IN_RP_CERTIFIED always -3

2024-06-06 Thread Kris Deugau
hostmas...@audiogen.ch wrote: I found the related configuration in 20_dnsbl_tests.cf: /# ---/ /# Return Path Certified:/ /# https://www.returnpath.net/internetserviceprovider/certification// /# (replaces

Re: Lots of FN because of VALIDITY* rules

2024-06-05 Thread postgarage Graz IT
On 6/5/24 13:14, Matus UHLAR - fantomas wrote: On 2024-06-03 at 08:35:32 UTC-0400 (Mon, 3 Jun 2024 14:35:32 +0200) postgarage Graz IT is rumored to have said: I think that the active.list file should be updated, when there are new rules, shouldn't it? On 03.06.24 08:52, Bill Cole wrote:

Re: Lots of FN because of VALIDITY* rules

2024-06-05 Thread Matus UHLAR - fantomas
On 2024-06-03 at 08:35:32 UTC-0400 (Mon, 3 Jun 2024 14:35:32 +0200) postgarage Graz IT is rumored to have said: I think that the active.list file should be updated, when there are new rules, shouldn't it? On 03.06.24 08:52, Bill Cole wrote: It is updated where it is actually used, on the ASF

Re: Lots of FN because of VALIDITY* rules

2024-06-05 Thread postgarage Graz IT
On 6/5/24 11:14, postgarage Graz IT wrote: On 6/5/24 09:17, Matus UHLAR - fantomas wrote: On 2024-06-03 at 08:35:32 UTC-0400 (Mon, 3 Jun 2024 14:35:32 +0200) postgarage Graz IT is rumored to have said: I think that the active.list file should be updated, when there are new rules,

Re: Lots of FN because of VALIDITY* rules

2024-06-05 Thread postgarage Graz IT
On 6/5/24 09:17, Matus UHLAR - fantomas wrote: On 2024-06-03 at 08:35:32 UTC-0400 (Mon, 3 Jun 2024 14:35:32 +0200) postgarage Graz IT is rumored to have said: I think that the active.list file should be updated, when there are new rules, shouldn't it? On 03.06.24 08:52, Bill Cole wrote:

Re: Fwd: [mailop] SORBS Closing.

2024-06-05 Thread Rob McEwen via users
From "Frido Otten" So is there anything that needs to be done to prevent false positives happening right after the shutdown? They said they were emptying the zone files, not actually "listing the world" - so this shouldn't cause false any positives - but might cause some false negatives,

Re: [mailop] SORBS Closing.

2024-06-05 Thread Michelle Sullivan
Nothing will *need* to be done.SORBS *should* be removed from all configurations at the earliest opportunity.SORBS will be shut down properly with the DNS servers and zones returning delagation and empty zones for multiple years (should be 10+.. but that depends on whether Proofpoint exists in 10

  1   2   3   4   5   6   7   8   9   10   >