Self addressed spam

2011-08-10 Thread akrohnke
this message in context: http://old.nabble.com/Self-addressed-spam-tp32232660p32232660.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Self addressed spam

2011-08-10 Thread Marcin Mirosław
W dniu 10.08.2011 12:00, akrohnke pisze: Hello, Currently one of our clients are getting spam that looks like it comes from the sender itself. Spamassassin only occasionally catches it. Hello! It should be done at smtp level. if (sender domain is my domain) and sender didn't authenticated

Re: Self addressed spam

2011-08-10 Thread J4K
On 08/10/2011 12:08 PM, Marcin Mirosław wrote: W dniu 10.08.2011 12:00, akrohnke pisze: Hello, Currently one of our clients are getting spam that looks like it comes from the sender itself. Spamassassin only occasionally catches it. Hello! It should be done at smtp level. if (sender

Re: Self addressed spam

2011-08-10 Thread Benny Pedersen
On Wed, 10 Aug 2011 03:00:56 -0700 (PDT), akrohnke wrote: Currently one of our clients are getting spam that looks like it comes from the sender itself. Spamassassin only occasionally catches it. spf fail ? header EXTRA_INCOME Subject =~ /extra inkomster/ header EXTRA_INCOME Subject =~

Re: Self addressed spam

2011-08-10 Thread Dominic Benson
On 10/08/11 11:14, J4K wrote: On 08/10/2011 12:08 PM, Marcin Mirosław wrote: W dniu 10.08.2011 12:00, akrohnke pisze: Hello, Currently one of our clients are getting spam that looks like it comes from the sender itself. Spamassassin only occasionally catches it. Hello! It should be done at

Re: Self addressed spam

2011-08-10 Thread Benny Pedersen
On Wed, 10 Aug 2011 12:08:03 +0200, Marcin Mirosław wrote: It should be done at smtp level. if (sender domain is my domain) and sender didn't authenticated then reject mail . http://old.nabble.com/postfwd-stop-equal-sender-recipient-spams-td21164908.html

Re: Self addressed spam

2011-08-10 Thread Benny Pedersen
On Wed, 10 Aug 2011 12:14:28 +0200, J4K wrote: . How does this work on a server with 1,000 virtual domains on it? like it would do for one domain ?, btw spf test in mta level will catch this kind of spams if recipient is spf protected, if no spf see

Re: Self addressed spam

2011-08-10 Thread akrohnke
this message in context: http://old.nabble.com/Self-addressed-spam-tp32232660p32233487.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Self addressed spam

2011-08-10 Thread John Hardin
On Wed, 10 Aug 2011, akrohnke wrote: Currently one of our clients are getting spam that looks like it comes from the sender itself. Spamassassin 3.2.5 Are you able to upgrade? There are to==from rules in 3.3. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/

Re: Self addressed spam

2011-08-10 Thread Benny Pedersen
On Wed, 10 Aug 2011 05:13:12 -0700 (PDT), akrohnke wrote: I installed `perl-Mail-SPF`, that should make SA check the SPF record and add points if necessary, correct? Doesn't seem to have any effect, they still slip through. Also looked for a `smf-spf` RPM for CentOS to no avail.

Re: Self addressed spam

2011-08-10 Thread Benny Pedersen
On Wed, 10 Aug 2011 06:19:01 -0700 (PDT), John Hardin wrote: Are you able to upgrade? There are to==from rules in 3.3. i have my own from.pm plugin that checks most on this issue, just liked to use maillist.pm before release it, need help on this :( and could one put in sandbox for me ?

Re: Self addressed spam

2011-08-10 Thread John Hardin
On Wed, 10 Aug 2011, Benny Pedersen wrote: and could one put in sandbox for me ? meta SPF_NICE_PASS (SPF_HELO_PASS SPF_PASS) meta SPF_RANDOM_SENDER (SPF_HELO_PASS !SPF_PASS) both are fine for me :-) Will do, as subrules. -- John Hardin KA7OHZ

Re: Self addressed spam

2011-08-10 Thread Benny Pedersen
On Wed, 10 Aug 2011 17:53:35 -0700 (PDT), John Hardin wrote: meta SPF_NICE_PASS (SPF_HELO_PASS SPF_PASS) meta SPF_RANDOM_SENDER (SPF_HELO_PASS !SPF_PASS) Will do, as subrules. tflags nopublish ? i liked to test scores in sandbox, not make it live

Re: Self addressed spam

2011-08-10 Thread John Hardin
On Thu, 11 Aug 2011, Benny Pedersen wrote: On Wed, 10 Aug 2011 17:53:35 -0700 (PDT), John Hardin wrote: meta SPF_NICE_PASS (SPF_HELO_PASS SPF_PASS) meta SPF_RANDOM_SENDER (SPF_HELO_PASS !SPF_PASS) Will do, as subrules. tflags nopublish Metas are cheap, and subrules don't

Re: Self addressed spam

2011-08-10 Thread John Hardin
On Wed, 10 Aug 2011, Benny Pedersen wrote: meta SPF_NICE_PASS (SPF_HELO_PASS SPF_PASS) Already in as __SPF_FULL_PASS -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4

Re: Self addressed spam

2011-08-10 Thread Benny Pedersen
On Wed, 10 Aug 2011 20:28:27 -0700 (PDT), John Hardin wrote: On Thu, 11 Aug 2011, Benny Pedersen wrote: On Wed, 10 Aug 2011 17:53:35 -0700 (PDT), John Hardin wrote: meta SPF_NICE_PASS (SPF_HELO_PASS SPF_PASS) meta SPF_RANDOM_SENDER (SPF_HELO_PASS !SPF_PASS) Will do, as subrules.

Re: Self addressed spam

2011-08-10 Thread Benny Pedersen
On Wed, 10 Aug 2011 20:34:09 -0700 (PDT), John Hardin wrote: On Wed, 10 Aug 2011, Benny Pedersen wrote: meta SPF_NICE_PASS (SPF_HELO_PASS SPF_PASS) Already in as __SPF_FULL_PASS super, will use it so