Re-2: A rule to check X-ASN header

2015-11-23 Thread steve
> > Hi all, > > > > I'm trying to create a rule which will check the results of the ASN > > plugin. > ... > > As a test I have the following... > > > > ifplugin Mail::SpamAssassin::Plugin::ASN > >header T_SCS_ASN_EXISTS exists:X-ASN > >header T_SCS_ASN_ANYTHING

Re-2: A rule to check X-ASN header

2015-11-23 Thread steve
> > The example i saw last week was from "Google Audit" > co.uk>, was DKIM signed and valid [but obviously not by Google's key :)] > > and was asking a user to verifiy thier account... URIs weren't blacklisted > > at the time. > > My thought process was that emails with Google in the Senders N

Re: Re-2: A rule to check X-ASN header

2015-11-23 Thread Axb
On 11/23/2015 01:31 PM, steve wrote: My thought process was that emails with Google in the Senders Name or email address should only really originate from IP addresses / ASN's Google own (initial invesgation suggest gmail.com comes from AS15169 thought I've not thrown a wide net yet). a meta ru

Re: Re-2: A rule to check X-ASN header

2015-11-23 Thread Benny Pedersen
steve skrev den 2015-11-23 13:31: asn plugin currently does not work with ipv6 I'll cross that bridge when I come to it. i just still need self to debug why it fails, currently i have seen 2.0.0.0/8 when ipv6 recieved in 26xx: :=) and if you see mails pretending sent from google/gmail it

Re-2: A rule to check X-ASN header

2015-11-23 Thread steve
Hi Benny, >> asn plugin currently does not work with ipv6 I'll cross that bridge when I come to it. > and if you see mails pretending sent from google/gmail it wont be dkim > pass and spf pass The example i saw last week was from "Google Audit" , was DKIM signed and valid [but obviously not