Re: Did the whitelist_from_rcvd semantics change?

2023-05-01 Thread Bill Cole
If you're going to engage with RH, leave me out of it. On 2023-05-01 at 11:14:12 UTC-0400 (Mon, 1 May 2023 09:14:12 -0600) Philip Prindeville is rumored to have said: On May 1, 2023, at 3:48 AM, Reindl Harald wrote: Am 30.04.23 um 20:54 schrieb Philip Prindeville: On Apr 28, 2023, at

Re: Did the whitelist_from_rcvd semantics change?

2023-05-01 Thread Philip Prindeville
> On May 1, 2023, at 3:48 AM, Reindl Harald wrote: > > > > Am 30.04.23 um 20:54 schrieb Philip Prindeville: >>> On Apr 28, 2023, at 12:17 PM, Philip Prindeville >>> wrote: >>> >>> >>> On Apr 28, 2023, at 10:24 AM, Reindl Harald wrote: Am 28.04.23 um 18:11

Re: Did the whitelist_from_rcvd semantics change?

2023-04-30 Thread Philip Prindeville
> On Apr 28, 2023, at 12:17 PM, Philip Prindeville > wrote: > > > >> On Apr 28, 2023, at 10:24 AM, Reindl Harald wrote: >> >> >> >> Am 28.04.23 um 18:11 schrieb Philip Prindeville: On Apr 25, 2023, at 6:28 AM, Bill Cole wrote: On 2023-04-24 at 16:32:55 UTC-0400

Re: Did the whitelist_from_rcvd semantics change?

2023-04-28 Thread Philip Prindeville
> On Apr 28, 2023, at 10:24 AM, Reindl Harald wrote: > > > > Am 28.04.23 um 18:11 schrieb Philip Prindeville: >>> On Apr 25, 2023, at 6:28 AM, Bill Cole >>> wrote: >>> >>> On 2023-04-24 at 16:32:55 UTC-0400 (Mon, 24 Apr 2023 14:32:55 -0600) >>> Philip Prindeville >>> is rumored to have

Re: Did the whitelist_from_rcvd semantics change?

2023-04-28 Thread Bill Cole
On 2023-04-28 at 12:11:02 UTC-0400 (Fri, 28 Apr 2023 10:11:02 -0600) Philip Prindeville is rumored to have said: On Apr 25, 2023, at 6:28 AM, Bill Cole wrote: On 2023-04-24 at 16:32:55 UTC-0400 (Mon, 24 Apr 2023 14:32:55 -0600) Philip Prindeville is rumored to have said: I thought the

Re: Did the whitelist_from_rcvd semantics change?

2023-04-28 Thread Philip Prindeville
> On Apr 25, 2023, at 6:28 AM, Bill Cole > wrote: > > On 2023-04-24 at 16:32:55 UTC-0400 (Mon, 24 Apr 2023 14:32:55 -0600) > Philip Prindeville > is rumored to have said: > >> I thought the matching included subdomains, and seem to remember that >> working. > > It never has. At least not

Re: Did the whitelist_from_rcvd semantics change?

2023-04-25 Thread Bill Cole
On 2023-04-24 at 16:32:55 UTC-0400 (Mon, 24 Apr 2023 14:32:55 -0600) Philip Prindeville is rumored to have said: I thought the matching included subdomains, and seem to remember that working. It never has. At least not in the past 17 years. -- Bill Cole b...@scconsult.com or

Re: Did the whitelist_from_rcvd semantics change?

2023-04-24 Thread Kevin A. McGrail
:32 PM, Philip Prindeville wrote: Hi, I have the following line: whitelist_from_rcvd *@ceipalmm.com mailgun.net And tried it on a message that had: Return-Path: But it didn't get whitelisted. If I change the pattern above to "*@mg2.ceipalmm.com" it works. I thought the matchin

Re: Did the whitelist_from_rcvd semantics change?

2023-04-24 Thread Philip Prindeville
Oh, and this is on Fedora, so I'm running 3.4.6... > On Apr 24, 2023, at 2:32 PM, Philip Prindeville > wrote: > > Hi, > > I have the following line: > > whitelist_from_rcvd *@ceipalmm.com mailgun.net > > And tried it on a message that had: > >

Did the whitelist_from_rcvd semantics change?

2023-04-24 Thread Philip Prindeville
Hi, I have the following line: whitelist_from_rcvd *@ceipalmm.com mailgun.net And tried it on a message that had: Return-Path: But it didn't get whitelisted. If I change the pattern above to "*@mg2.ceipalmm.com" it works. I thought the matching included subdomains,

Re: whitelist_from_rcvd hits only sometimes

2019-03-01 Thread Matus UHLAR - fantomas
On 28.02.19 12:44, Helmut Schneider wrote: >I'm trying to find out why a message sometimes hits >whitelist_from_rcvd and sometimes does not. I checked the headers >again and again but cannot see the difference. > >whitelist_from_rcvd quarant...@eu.quarantine.symantec.com &

Re: whitelist_from_rcvd hits only sometimes

2019-03-01 Thread RW
On Fri, 1 Mar 2019 17:46:55 +0100 Matus UHLAR - fantomas wrote: > On 28.02.19 12:44, Helmut Schneider wrote: > >I'm trying to find out why a message sometimes hits > >whitelist_from_rcvd and sometimes does not. I checked the headers > >again and again but cann

Re: whitelist_from_rcvd hits only sometimes

2019-03-01 Thread Matus UHLAR - fantomas
On 28.02.19 12:44, Helmut Schneider wrote: I'm trying to find out why a message sometimes hits whitelist_from_rcvd and sometimes does not. I checked the headers again and again but cannot see the difference. whitelist_from_rcvd quarant...@eu.quarantine.symantec.com messagelabs.com

Re: whitelist_from_rcvd hits only sometimes

2019-03-01 Thread RW
On Thu, 28 Feb 2019 12:44:16 +0100 Helmut Schneider wrote: > Hi, > > I'm trying to find out why a message sometimes hits > whitelist_from_rcvd and sometimes does not. I checked the headers > again and again but cannot see the difference. I couldn't reproduce this with the

whitelist_from_rcvd hits only sometimes

2019-02-28 Thread Helmut Schneider
Hi, I'm trying to find out why a message sometimes hits whitelist_from_rcvd and sometimes does not. I checked the headers again and again but cannot see the difference. whitelist_from_rcvd quarant...@eu.quarantine.symantec.com messagelabs.com whitelist_from_rcvd quarant

whitelist_from_rcvd Not Working

2015-08-29 Thread websiterepairguy .
I'm trying to get the following line to work in my user_prefs file: whitelist_from_rcvd *bankofamerica.com bankofamerica.com Of course, this works: whitelist_from *bankofamerica.com So, the simple whitelist_from works, but the whitelist_from_rcvd does not work. Why is this? Looks like I have

Re: whitelist_from_rcvd Not Working

2015-08-29 Thread Reindl Harald
Am 29.08.2015 um 12:40 schrieb websiterepairguy.: I'm trying to get the following line to work in my user_prefs file: whitelist_from_rcvd*bankofamerica.com http://bankofamerica.com/bankofamerica.com http://bankofamerica.com/ Of course, this works: whitelist_from*bankofamerica.com http

Re: whitelist_from_rcvd Not Working

2015-08-29 Thread Reindl Harald
Am 29.08.2015 um 13:46 schrieb RW: On Sat, 29 Aug 2015 12:45:27 +0200 Reindl Harald wrote: Am 29.08.2015 um 12:40 schrieb websiterepairguy.: I'm trying to get the following line to work in my user_prefs file: whitelist_from_rcvd*bankofamerica.com http://bankofamerica.com/bankofamerica.com

Re: whitelist_from_rcvd Not Working

2015-08-29 Thread RW
, the problem is the rdn= . SpamAssassin doesn't do its own rdns lookups, so if the information isn't recorded in the received header by the server you can't use whitelist_from_rcvd agreed in conext of rdns, but even if it is resolved, the machines sending as @ealerts.bankofamerica.com

Re: whitelist_from_rcvd Not Working

2015-08-29 Thread RW
On Sat, 29 Aug 2015 12:45:27 +0200 Reindl Harald wrote: Am 29.08.2015 um 12:40 schrieb websiterepairguy.: I'm trying to get the following line to work in my user_prefs file: whitelist_from_rcvd*bankofamerica.com http://bankofamerica.com/bankofamerica.com http://bankofamerica.com

Re: whitelist_from_rcvd not working, WAIDW

2015-02-28 Thread Dave Funk
On Fri, 27 Feb 2015, Ian Zimmerman wrote: Header of test message, massaged for privacy, is here: http://pastebin.com/EV6g15aN I have this in user_prefs: trusted_networks 198.1.2.3/32 [...lots snipped...] whitelist_from_rcvd *@wetransfer.com *.wetransfer.com Why is the whitelist not firing

Re: whitelist_from_rcvd not working, WAIDW

2015-02-28 Thread Ian Zimmerman
On Sat, 28 Feb 2015 13:37:29 +0100, Mark Martinec mark.martinec...@ijs.si wrote: Ian trusted_networks 198.1.2.3/32 Ian [...lots snipped...] Ian whitelist_from_rcvd *@wetransfer.com *.wetransfer.com Mark It seems the: Mark Received: (from itz@localhost) Mark by myalias.trusted.mx (8.14.4/8.14.4

Re: whitelist_from_rcvd not working, WAIDW

2015-02-28 Thread Reindl Harald
Am 27.02.2015 um 22:11 schrieb Ian Zimmerman: Header of test message, massaged for privacy, is here: http://pastebin.com/EV6g15aN I have this in user_prefs: trusted_networks 198.1.2.3/32 [...lots snipped...] whitelist_from_rcvd *@wetransfer.com *.wetransfer.com Why is the whitelist

Re: whitelist_from_rcvd not working, WAIDW

2015-02-28 Thread Reindl Harald
Am 28.02.2015 um 16:53 schrieb Ian Zimmerman: On Sat, 28 Feb 2015 13:37:29 +0100, Mark Martinec mark.martinec...@ijs.si wrote: Ian trusted_networks 198.1.2.3/32 Ian [...lots snipped...] Ian whitelist_from_rcvd *@wetransfer.com *.wetransfer.com Mark It seems the: Mark Received: (from itz

Re: whitelist_from_rcvd not working, WAIDW

2015-02-28 Thread Mark Martinec
http://pastebin.com/EV6g15aN I have this in user_prefs: trusted_networks 198.1.2.3/32 [...lots snipped...] whitelist_from_rcvd *@wetransfer.com *.wetransfer.com Why is the whitelist not firing? It seems the: Received: (from itz@localhost) by myalias.trusted.mx (8.14.4/8.14.4

Re: whitelist_from_rcvd not working, WAIDW

2015-02-28 Thread Benny Pedersen
Ian Zimmerman skrev den 2015-02-28 16:53: On Sat, 28 Feb 2015 13:37:29 +0100, Mark Martinec mark.martinec...@ijs.si wrote: Ian trusted_networks 198.1.2.3/32 Ian [...lots snipped...] Ian whitelist_from_rcvd *@wetransfer.com *.wetransfer.com Mark It seems the: Mark Received: (from itz@localhost

whitelist_from_rcvd not working, WAIDW

2015-02-27 Thread Ian Zimmerman
Header of test message, massaged for privacy, is here: http://pastebin.com/EV6g15aN I have this in user_prefs: trusted_networks 198.1.2.3/32 [...lots snipped...] whitelist_from_rcvd *@wetransfer.com *.wetransfer.com Why is the whitelist not firing? -- Please *no* private copies

Re: whitelist_from_rcvd / trusted_networks

2014-11-11 Thread RW
will source from an IP address that will cause it to score above 5. ... I would like to use whitelist_from_rcvd as the envelope from (RFC5321.MailFrom) and sending system is not exactly static, but close enough that the globing should work. The issue is that SA is running on our MXes via a milter

whitelist_from_rcvd / trusted_networks

2014-11-10 Thread Derek Diget
would like to use whitelist_from_rcvd as the envelope from (RFC5321.MailFrom) and sending system is not exactly static, but close enough that the globing should work. The issue is that SA is running on our MXes via a milter and since SA (and these boxes) only see MX traffic, trusted_networks

Re: whitelist_from_rcvd / trusted_networks

2014-11-10 Thread David B Funk
-heel of milters). Are the messages DKIM authenticated? (Either DK signed or SPF listed)? IE can you use whitelist_auth ? It's more reliable than whitelist_from_rcvd which depends upon finding the correct DNS names of all the SMTP exit points. It also depends upon the Envelope From address being

Re: whitelist_from_rcvd when rDNS fails

2012-02-16 Thread Matus UHLAR - fantomas
I need to whitelist a sender, and I typically use whitelist_from_rcvd, but it's not working in this case, and I suspect because rDNS fails:    Received: from ideascollide1.ablehost.com (unknown [208.81.177.83]) Is the next best approach to create a rule that deducts points or is there another

whitelist_from_rcvd when rDNS fails

2012-02-15 Thread Alex
Hi, I need to whitelist a sender, and I typically use whitelist_from_rcvd, but it's not working in this case, and I suspect because rDNS fails: Received: from ideascollide1.ablehost.com (unknown [208.81.177.83]) Is the next best approach to create a rule that deducts points

Re: whitelist_from_rcvd when rDNS fails

2012-02-15 Thread Alex
Hi, I need to whitelist a sender, and I typically use whitelist_from_rcvd, but it's not working in this case, and I suspect because rDNS fails:    Received: from ideascollide1.ablehost.com (unknown [208.81.177.83]) Is the next best approach to create a rule that deducts points

Re: whitelist_from_rcvd when rDNS fails

2012-02-15 Thread Henrik K
On Wed, Feb 15, 2012 at 04:44:09PM -0500, Alex wrote: Hi, I need to whitelist a sender, and I typically use whitelist_from_rcvd, but it's not working in this case, and I suspect because rDNS fails: Received: from ideascollide1.ablehost.com (unknown [208.81.177.83]) Is the next best

Re: whitelist_from_rcvd when rDNS fails

2012-02-15 Thread Henrik K
On Thu, Feb 16, 2012 at 07:49:15AM +0200, Henrik K wrote: On Wed, Feb 15, 2012 at 04:44:09PM -0500, Alex wrote: Hi, I need to whitelist a sender, and I typically use whitelist_from_rcvd, but it's not working in this case, and I suspect because rDNS fails: Received: from

whitelist_from_rcvd question (and more n+1 rules that score 6 points)

2011-07-27 Thread Michael Scheidell
, in the interests of being friendly, will this work? whitelist_from_rcvd *@* smtpout.zixmail.net (no, they don't have spf :-) and even if they did, it would not work anyway since they 'forge' the email address of the sender's domain. Received: from smtpout.zixmail.net (smtpout.zixmail.net [63.71.8.106

Re: whitelist_from_rcvd question (and more n+1 rules that score 6 points)

2011-07-27 Thread John Hardin
On Wed, 27 Jul 2011, Michael Scheidell wrote: Seems zixmail has not only decided to bastardize 'email' off the net, but now, when informing someone they got one, makes suck bad freeking headers that SA wants to tag it spam. take the bayes credit out and you have 8 points on a legit email.

Re: whitelist_from_rcvd question (and more n+1 rules that score 6 points)

2011-07-27 Thread John Hardin
, in the interests of being friendly, will this work? whitelist_from_rcvd *@* smtpout.zixmail.net It should. Perhaps that should go in the default whitelist. Open a bug? Received: from smtpout.zixmail.net (smtpout.zixmail.net [63.71.8.106]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits

Re: Trouble whitelisting domain users with whitelist_from_rcvd

2010-07-31 Thread Benny Pedersen
On ons 28 jul 2010 17:37:51 CEST, Jeff Mincy wrote meta __TRUSTED_NETWORKS (NO_RELAYS || ALL_TRUSTED) header __LOCAL_SENDER From =~ /\...@mydomain\.com/i that can and will be forged in its own, to solve: header __LOCAL_SENDER Return-Path:addr =~ /\...@mydomain\.com/i mta newer sets

RE: Trouble whitelisting domain users with whitelist_from_rcvd

2010-07-31 Thread Benny Pedersen
On ons 28 jul 2010 19:21:53 CEST, Rosenbaum, Larry M. wrote What is the best way to completely whitelist all internal emails so that there is no danger of any internal emails being blacklisted The best way is to not feed internal emails to SpamAssassin. best as in ones own ip can be

Re: Trouble whitelisting domain users with whitelist_from_rcvd

2010-07-30 Thread Matus UHLAR - fantomas
whitelist_from_rcvd is applicable to whitelisting internal mail?? as I said, it is not. you can whitelist only mail coming from remote network, your mail did not. Couple of things to note , we use Active Directory which means the FQDN name of all our machines end in *.local rather than *.com. Should

Trouble whitelisting domain users with whitelist_from_rcvd

2010-07-28 Thread keithcommins
Hi there , Having some trouble getting this to work correctly , it would seem.. Firstly, here is my whitelist_from rcvd config from my local.cf file. whitelist_from_rcvd *...@mydomain.com mydomain.local trusted_networks 172.16.1/24 172.16.2/24 172.16.3/24 172.16.5/24 xx.xx.xx.xx

Re: Trouble whitelisting domain users with whitelist_from_rcvd

2010-07-28 Thread Matus UHLAR - fantomas
On 28.07.10 07:57, keithcommins wrote: Having some trouble getting this to work correctly , it would seem.. Firstly, here is my whitelist_from rcvd config from my local.cf file. whitelist_from_rcvd *...@mydomain.com mydomain.local trusted_networks 172.16.1/24 172.16.2/24 172.16.3

Re: Trouble whitelisting domain users with whitelist_from_rcvd

2010-07-28 Thread keithcommins
Matus UHLAR - fantomas wrote: On 28.07.10 07:57, keithcommins wrote: Having some trouble getting this to work correctly , it would seem.. Firstly, here is my whitelist_from rcvd config from my local.cf file. whitelist_from_rcvd *...@mydomain.com mydomain.local

Re: Trouble whitelisting domain users with whitelist_from_rcvd

2010-07-28 Thread Jari Fredriksson
On 28.7.2010 17:57, keithcommins wrote: Hi there , Having some trouble getting this to work correctly , it would seem.. Firstly, here is my whitelist_from rcvd config from my local.cf file. whitelist_from_rcvd *...@mydomain.com mydomain.local trusted_networks 172.16.1/24

Re: Trouble whitelisting domain users with whitelist_from_rcvd

2010-07-28 Thread Jeff Mincy
whitelist_from_rcvd on internal email. You don't have an external relay to match against. It doesn't matter if your machine ends in .local or not. Note the FH_DATE_PAST_20XX. You probably need to run sa-update sometime this year. The ALL_TRUSTED should be enough by itself. If you need to have

Re: Trouble whitelisting domain users with whitelist_from_rcvd

2010-07-28 Thread Karsten Bräckelmann
On Wed, 2010-07-28 at 07:57 -0700, keithcommins wrote: X-Spam-Checker-Version: SpamAssassin 3.2.5 ( 2008-06-10 ) on mail.mydomain.com X-Spam-Level: *** X-Spam-Status: No, score=3.8 required=8.0 tests=ALL_TRUSTED,FH_DATE_PAST_20XX, ^ Run sa-update.

Re: Trouble whitelisting domain users with whitelist_from_rcvd

2010-07-28 Thread keithcommins
-whitelisting-domain-users-with-whitelist_from_rcvd-tp29287372p29288192.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

RE: Trouble whitelisting domain users with whitelist_from_rcvd

2010-07-28 Thread Rosenbaum, Larry M.
What is the best way to completely whitelist all internal emails so that there is no danger of any internal emails being blacklisted The best way is to not feed internal emails to SpamAssassin.

clarification on whitelist_from_rcvd

2009-12-09 Thread Lucio Chiappetti
). We have this in the spamassassin systemwide local.cf whitelist_from x...@lambrate.inaf.it whitelist_from x...@iasf-milano.inaf.it whitelist_from_rcvd *...@lambrate.inaf.it lambrate.inaf.it whitelist_from_rcvd *...@iasf

Re: clarification on whitelist_from_rcvd

2009-12-09 Thread Michael Scheidell
Lucio Chiappetti wrote: whitelist_from x...@lambrate.inaf.it whitelist_from x...@iasf-milano.inaf.it whitelist_from_rcvd *...@lambrate.inaf.it lambrate.inaf.it whitelist_from_rcvd *...@iasf-milano.inaf.it lambrate.inaf.it

Re: clarification on whitelist_from_rcvd

2009-12-09 Thread Mark Martinec
per month). We have this in the spamassassin systemwide local.cf whitelist_from x...@lambrate.inaf.it whitelist_from x...@iasf-milano.inaf.it whitelist_from_rcvd *...@lambrate.inaf.it lambrate.inaf.it whitelist_from_rcvd

Re: Problems with whitelist_from_rcvd

2009-10-06 Thread Igor Bogomazov
Ignore the text immediately after the from, in this case SUB.MYDOMAIN.MAIL. That is _not_ rDNS data, that is whatever the client sent in its SMTP HELO, and can be _anything_. If you see the correct hostname there it just means that computer is sending its correct hostname when it says HELO.

Re: Problems with whitelist_from_rcvd

2009-10-06 Thread John Hardin
On Tue, 6 Oct 2009, Igor Bogomazov wrote: Exactly how are you checking the rDNS of that IP address? Can you demonstrate? Are you performing your rDNS tests on the MTA computer? It looks to me like the DNS setup on it is misconfigured somehow and it can't perform rDNS queries successfully.

Re: Problems with whitelist_from_rcvd

2009-10-05 Thread Igor Bogomazov
On Fri, 2 Oct 2009, Bill Landry wrote: John Hardin wrote: On Fri, 2 Oct 2009, Igor Bogomazov wrote: I've checked rDNS of the prefix.domain.mail with 'host' utility - it's all right. You don't check rDNS using host, you check it using dig -x host.ip.addr.here Why

Re: Problems with whitelist_from_rcvd

2009-10-05 Thread John Hardin
On Mon, 5 Oct 2009, Igor Bogomazov wrote: John Hardin wrote: On Fri, 2 Oct 2009, Igor Bogomazov wrote: I've checked rDNS of the prefix.domain.mail with 'host' utility - it's all right. Igor, can you show us how you used host and what it output? Here's both headers, tagged Received:

Problems with whitelist_from_rcvd

2009-10-02 Thread Igor Bogomazov
Hi, When I add the string like: whitelist_from s...@domain.mail it works OK. But: whitelist_from_rcvd s...@domain.mail prefix.domain.mail doesn't work. I've checked rDNS of the prefix.domain.mail with 'host' utility - it's all right. And the appropriate mail header seems to be correct

Re: Problems with whitelist_from_rcvd

2009-10-02 Thread Benny Pedersen
On fre 02 okt 2009 10:34:55 CEST, Igor Bogomazov wrote And the appropriate mail header seems to be correct: Received: from prefix.domain.mail (unknown [12.12.12.12]) What's the matter? unknown reverse dns is postfix answer for not found reverse dns, so host was in the test you did wrong

Re: Problems with whitelist_from_rcvd

2009-10-02 Thread Jeff Mincy
From: Igor Bogomazov b...@hl.ru Date: Fri, 2 Oct 2009 12:34:55 +0400 When I add the string like: whitelist_from s...@domain.mail it works OK. But: whitelist_from_rcvd s...@domain.mail prefix.domain.mail doesn't work. I've checked rDNS

Re: Problems with whitelist_from_rcvd

2009-10-02 Thread John Hardin
On Fri, 2 Oct 2009, Igor Bogomazov wrote: whitelist_from_rcvd s...@domain.mail prefix.domain.mail doesn't work. I've checked rDNS of the prefix.domain.mail with 'host' utility - it's all right. You don't check rDNS using host, you check it using dig -x host.ip.addr.here

Re: Problems with whitelist_from_rcvd

2009-10-02 Thread Kris Deugau
John Hardin wrote: You don't check rDNS using host, you check it using dig -x host.ip.addr.here Actually, unless your DNS configuration is doing something bizarre, they should give back the same basic info - dig is just a lot more verbose: [kdeu...@turboprop ~]$ host 209.91.179.62

Re: Problems with whitelist_from_rcvd

2009-10-02 Thread Bill Landry
John Hardin wrote: On Fri, 2 Oct 2009, Igor Bogomazov wrote: whitelist_from_rcvd s...@domain.mail prefix.domain.mail doesn't work. I've checked rDNS of the prefix.domain.mail with 'host' utility - it's all right. You don't check rDNS using host, you check it using dig -x

Re: Problems with whitelist_from_rcvd

2009-10-02 Thread John Hardin
On Fri, 2 Oct 2009, Kris Deugau wrote: John Hardin wrote: You don't check rDNS using host, you check it using dig -x host.ip.addr.here Actually, unless your DNS configuration is doing something bizarre, they should give back the same basic info - dig is just a lot more verbose: -kgd,

Re: Problems with whitelist_from_rcvd

2009-10-02 Thread John Hardin
On Fri, 2 Oct 2009, Bill Landry wrote: John Hardin wrote: On Fri, 2 Oct 2009, Igor Bogomazov wrote: I've checked rDNS of the prefix.domain.mail with 'host' utility - it's all right. You don't check rDNS using host, you check it using dig -x host.ip.addr.here Why not, they come up with

whitelist_from_rcvd and short circuit

2009-08-13 Thread Chris
It appears as though I don't understand how this is supposed to work. I have a file in /etc/mail/spamassassin called my-whitelist.cf. In it I have entries such as: whitelist_from_rcvd serv...@freenet.de freenet.de whitelist_from_rcvd harley-requ...@the-hed.net the-hed.net In my local.cf I have

Re: whitelist_from_rcvd and short circuit

2009-08-13 Thread Matt Kettler
Chris wrote: It appears as though I don't understand how this is supposed to work. I have a file in /etc/mail/spamassassin called my-whitelist.cf. In it I have entries such as: snip whitelist_from_rcvd harley-requ...@the-hed.net the-hed.net snip however, a message from the 2nd

whitelist_from_rcvd and trusted_networks

2009-08-08 Thread Chris
I have an entry in a what I call my-whitelist.cf in /etc/mail/spamassassin: whitelist_from_rcvd blackwell_...@yahoo.com yahoo.com If I run a message from this person with spamassassin -D -t msg shouldn't I get a hit on USER_IN_WHITELIST or not? Also, I'm still not sure I have my

Re: whitelist_from_rcvd and trusted_networks

2009-08-08 Thread RW
On Sat, 08 Aug 2009 17:10:01 -0500 Chris cpoll...@embarqmail.com wrote: I have an entry in a what I call my-whitelist.cf in /etc/mail/spamassassin: whitelist_from_rcvd blackwell_...@yahoo.com yahoo.com If I run a message from this person with spamassassin -D -t msg shouldn't I get a hit

Re: whitelist_from_rcvd and trusted_networks

2009-08-08 Thread Chris
On Sun, 2009-08-09 at 00:56 +0100, RW wrote: The trouble with whitelist_from_rcvd is that it relies on the MX server recording reverse DNS - most do, some don't. Also, I'm still not sure I have my trusted_networks setting correct. I have this in my local.cf: trusted_networks

Re: whitelist_from_rcvd and trusted_networks

2009-08-08 Thread Chris
On Sun, 2009-08-09 at 00:56 +0100, RW wrote: Also, I'm still not sure I have my trusted_networks setting correct. I have this in my local.cf: trusted_networks 192.168/16 71.48.160.0/20 71.54.96/19 Here is a line of Received: from headers from a test mail to myself: Received:

Re: Problem with whitelist_from_rcvd and forged reverse lookup

2009-07-31 Thread Matus UHLAR - fantomas
On Thu, 2009-07-30 at 16:46 +0200, Sebastian Wiesinger wrote: * Matus UHLAR - fantomas uh...@fantomas.sk [2009-07-30 16:35]: On 30.07.09 14:03, Sebastian Wiesinger wrote: I was under the impression that whitelist_from_rcvd checks if the reverse lookup is forged. But still

Problem with whitelist_from_rcvd and forged reverse lookup

2009-07-30 Thread Sebastian Wiesinger
Hi, I was under the impression that whitelist_from_rcvd checks if the reverse lookup is forged. But still with the following rule whitelist_from_rcvd *...@alita.karotte.org localhost the attached mail is whitelisted because 220.231.127.15 resolves to localhost. Am I doing something wrong

Re: Problem with whitelist_from_rcvd and forged reverse lookup

2009-07-30 Thread Sebastian Wiesinger
* Matus UHLAR - fantomas uh...@fantomas.sk [2009-07-30 16:35]: On 30.07.09 14:03, Sebastian Wiesinger wrote: I was under the impression that whitelist_from_rcvd checks if the reverse lookup is forged. But still with the following rule whitelist_from_rcvd *...@alita.karotte.org localhost

Re: Problem with whitelist_from_rcvd and forged reverse lookup

2009-07-30 Thread John Hardin
On Thu, 30 Jul 2009, Sebastian Wiesinger wrote: So how can I whitelist mails which come from the server where my SpamAssassin is running? Tell your glue layer that messages originating on that server should not be passed to SA at all. If you describe how SA is glued to your MTA we might be

Re: Problem with whitelist_from_rcvd and forged reverse lookup

2009-07-30 Thread Sebastian Wiesinger
* John Hardin jhar...@impsec.org [2009-07-30 17:24]: On Thu, 30 Jul 2009, Sebastian Wiesinger wrote: So how can I whitelist mails which come from the server where my SpamAssassin is running? Tell your glue layer that messages originating on that server should not be passed to SA at all.

Re: Problem with whitelist_from_rcvd and forged reverse lookup

2009-07-30 Thread Benny Pedersen
On Thu, July 30, 2009 16:46, Sebastian Wiesinger wrote: * Matus UHLAR - fantomas uh...@fantomas.sk [2009-07-30 16:35]: On 30.07.09 14:03, Sebastian Wiesinger wrote: I was under the impression that whitelist_from_rcvd checks if the reverse lookup is forged. But still with the following rule

Re: Problem with whitelist_from_rcvd and forged reverse lookup

2009-07-30 Thread Benny Pedersen
On Thu, July 30, 2009 17:17, Sebastian Wiesinger wrote: the attached mail is whitelisted because 220.231.127.15 resolves to localhost. Am I doing something wrong or is this a bug? non working dns is not a spamassassin bug a bug apparently. JFYI, I created a bugreport for this:

Re: Problem with whitelist_from_rcvd and forged reverse lookup

2009-07-30 Thread John Hardin
On Thu, 30 Jul 2009, Sebastian Wiesinger wrote: * John Hardin jhar...@impsec.org [2009-07-30 17:24]: On Thu, 30 Jul 2009, Sebastian Wiesinger wrote: So how can I whitelist mails which come from the server where my SpamAssassin is running? Tell your glue layer that messages originating on

Re: Problem with whitelist_from_rcvd and forged reverse lookup

2009-07-30 Thread Sebastian Wiesinger
* Benny Pedersen m...@junc.org [2009-07-30 17:37]: On Thu, July 30, 2009 17:17, Sebastian Wiesinger wrote: the attached mail is whitelisted because 220.231.127.15 resolves to localhost. Am I doing something wrong or is this a bug? non working dns is not a spamassassin bug

Re: Problem with whitelist_from_rcvd and forged reverse lookup

2009-07-30 Thread John Hardin
On Thu, 30 Jul 2009, Benny Pedersen wrote: On Thu, July 30, 2009 17:17, Sebastian Wiesinger wrote: the attached mail is whitelisted because 220.231.127.15 resolves to localhost. Am I doing something wrong or is this a bug? non working dns is not a spamassassin bug How do you get

Re: Problem with whitelist_from_rcvd and forged reverse lookup

2009-07-30 Thread Jeff Mincy
From: Sebastian Wiesinger spamassassin.us...@ml.karotte.org Date: Thu, 30 Jul 2009 17:48:09 +0200 * John Hardin jhar...@impsec.org [2009-07-30 17:39]: Sendmail - Procmail - SA (spamc) Cool, that should be simple. Can you send: (1) the Received: headers from

Re: Problem with whitelist_from_rcvd and forged reverse lookup

2009-07-30 Thread John Hardin
On Thu, 30 Jul 2009, Jeff Mincy wrote: From: Sebastian Wiesinger spamassassin.us...@ml.karotte.org Date: Thu, 30 Jul 2009 17:48:09 +0200 * John Hardin jhar...@impsec.org [2009-07-30 17:39]: Sendmail - Procmail - SA (spamc) Cool, that should be simple. Can you send:

Re: Problem with whitelist_from_rcvd and forged reverse lookup

2009-07-30 Thread Karsten Bräckelmann
On Thu, 2009-07-30 at 09:39 -0700, John Hardin wrote: On Thu, 30 Jul 2009, Jeff Mincy wrote: Processing locally generated email that contain spam URLs through SpamAssassin is not a particularly good idea. If you have Bayes enabled then you are training your Bayes that spam URLs and

Re: Problem with whitelist_from_rcvd and forged reverse lookup

2009-07-30 Thread Benny Pedersen
On Thu, July 30, 2009 17:41, Sebastian Wiesinger wrote: * Benny Pedersen m...@junc.org [2009-07-30 17:37]: On Thu, July 30, 2009 17:17, Sebastian Wiesinger wrote: the attached mail is whitelisted because 220.231.127.15 resolves to localhost. Am I doing something wrong or is this a bug?

Re: Problem with whitelist_from_rcvd and forged reverse lookup

2009-07-30 Thread Karsten Bräckelmann
On Thu, 2009-07-30 at 16:46 +0200, Sebastian Wiesinger wrote: * Matus UHLAR - fantomas uh...@fantomas.sk [2009-07-30 16:35]: On 30.07.09 14:03, Sebastian Wiesinger wrote: I was under the impression that whitelist_from_rcvd checks if the reverse lookup is forged. But still

Re: Problem with whitelist_from_rcvd and forged reverse lookup

2009-07-30 Thread John Hardin
On Thu, 30 Jul 2009, Benny Pedersen wrote: On Thu, July 30, 2009 17:41, Sebastian Wiesinger wrote: * Benny Pedersen m...@junc.org [2009-07-30 17:37]: On Thu, July 30, 2009 17:17, Sebastian Wiesinger wrote: the attached mail is whitelisted because 220.231.127.15 resolves to localhost. Am I

Re: Problem with whitelist_from_rcvd and forged reverse lookup

2009-07-30 Thread Anthony Cartmell
[sebast...@alita:~]$ host 220.231.127.15 15.127.231.220.in-addr.arpa domain name pointer localhost. this is your dns error, it does not make sense You are correct, but the problem is not in Sebastian's DNS - it is in the rDNS of the IP that contacted his MTA. Not quite the same thing,

Re: Problem with whitelist_from_rcvd and forged reverse lookup

2009-07-30 Thread John Hardin
On Thu, 30 Jul 2009, Sebastian Wiesinger wrote: Received: from alside.com (localhost [220.231.127.15] (may be forged)) by alita.karotte.org (8.14.3/8.14.3/Debian-5) with SMTP id n6UBn1BJ021997 for webmas...@alita.karotte.org; Thu, 30 Jul 2009 13:49:05 +0200 That nonsense should

Re: whitelist_from_rcvd parsing error

2008-12-02 Thread Martin Gregorie
On Tue, 2008-12-02 at 05:55 -0500, Matt Kettler wrote: You need a second parameter to whitelist_from_rcvd. The second parameter is the hostname (or fragment thereof) that should be found in the Received: headers generated by the last internal host (ie: your mx). This part does assume that you

whitelist_from_rcvd parsing error

2008-12-02 Thread Martin Gregorie
I've been reading threads saying that whitelist_from is spoofable and that I should be using whitelist_from_rcvd instead, so I checked the three whitelist entries I use to whitelist_from_rcvd. Here is an example: whitelist_from_rcvd [EMAIL PROTECTED] However, I'm getting them rejected

Re: whitelist_from_rcvd parsing error

2008-12-02 Thread Matt Kettler
Martin Gregorie wrote: I've been reading threads saying that whitelist_from is spoofable and that I should be using whitelist_from_rcvd instead, so I checked the three whitelist entries I use to whitelist_from_rcvd. Here is an example: whitelist_from_rcvd [EMAIL PROTECTED] However, I'm

Re: whitelist_from_rcvd parsing error

2008-12-02 Thread Kai Schaetzl
Martin Gregorie wrote on Tue, 02 Dec 2008 12:42:37 +: at the end of the INSTALL document it says to look at the USAGE document, but if this still exists it is not mentioned on the 'Doc' page. /usr/share/doc/spamassassin-3.2.5/USAGE I admit I skipped over the Mail::Spamassassin::Conf

Re: whitelist_from_rcvd parsing error

2008-12-02 Thread Kai Schaetzl
Martin Gregorie wrote on Tue, 02 Dec 2008 10:27:05 +: I can't find anything in the wiki or on the SA website that shows the valid arguments for whitelist_from_rcvd, so what am I doing wrong? Please? http://spamassassin.apache.org/full/3.2.x/doc/Mail_SpamAssassin_Conf.html

Re: whitelist_from_rcvd parsing error

2008-12-02 Thread Martin Gregorie
On Tue, 2008-12-02 at 11:55 +0100, Kai Schaetzl wrote: Martin Gregorie wrote on Tue, 02 Dec 2008 10:27:05 +: I can't find anything in the wiki or on the SA website that shows the valid arguments for whitelist_from_rcvd, so what am I doing wrong? Please? http

enchanced whitelist_from_rcvd ?

2008-11-07 Thread Per Jessen
Occasionally I'd like to do something like this: whitelist_from_rcvd [EMAIL PROTECTED] /^smtp[0-9]+\.orange\.fr$/ The situation is that domain.fr is relaying mail through their provider, which has a number of smtp servers named smtpNN.orange.fr. If I were to stick to the current

Re: enchanced whitelist_from_rcvd ?

2008-11-07 Thread mouss
Per Jessen wrote: Occasionally I'd like to do something like this: whitelist_from_rcvd [EMAIL PROTECTED] /^smtp[0-9]+\.orange\.fr$/ The situation is that domain.fr is relaying mail through their provider, which has a number of smtp servers named smtpNN.orange.fr. If I were to stick

Re: enchanced whitelist_from_rcvd ?

2008-11-07 Thread Matt Kettler
Per Jessen wrote: Occasionally I'd like to do something like this: whitelist_from_rcvd [EMAIL PROTECTED] /^smtp[0-9]+\.orange\.fr$/ One problem.. That involves a regex, but whitelist_from is a regular user config option. In general, regular expressions are intentionally not used

Re: enchanced whitelist_from_rcvd ?

2008-11-07 Thread Henrik K
of asking for a lacking addition to a poor whitelisting method (in this case), we should enhance whitelist_from_rcvd to process received paths: whitelist_from_rcvd [EMAIL PROTECTED] 1.2.3.4 2.3.4.5 Perhaps it could even work with hostnames as long as they stay inside trusted_networks. And perhaps

Re: enchanced whitelist_from_rcvd ?

2008-11-07 Thread mouss
of asking for a lacking addition to a poor whitelisting method (in this case), we should enhance whitelist_from_rcvd to process received paths: whitelist_from_rcvd [EMAIL PROTECTED] 1.2.3.4 2.3.4.5 why? I wouldn't put 30 IPs there... if user trusts his MTA, then rdns can be trusted

Re: enchanced whitelist_from_rcvd ?

2008-11-07 Thread Per Jessen
Henrik K wrote: Then instead of asking for a lacking addition to a poor whitelisting method (in this case), we should enhance whitelist_from_rcvd to process received paths: whitelist_from_rcvd [EMAIL PROTECTED] 1.2.3.4 2.3.4.5 Should this be read to mean whitelist from foobar if it came

  1   2   3   >