Re: SPF and spammers

SPF wouldn't add you to a blacklist since it operates realtime (at the SMTP level). But just because you log in to your home ISP doesn't mean you can't send mail through your work ISP if you have SMTP authentication of course. In that instance you'll know immediately that your SMTP fails and th

Re: SPF and spammers

But the fact that they do create the SPF records then makes all the other rules like SURBL more effective. The strength they have had till SPF has been the fact that the could forge domains. If you already use a blacklisting host(s) and also use SPF then the combination would be more effective

Re: New Rules

At 06:43 PM 9/13/2004, Thompson´s Mail wrote: Do You know where I can download a new rules for SpamAssassin ? I would like a simple URL, where I can use a wget command, or some like this. For the primary ruleset, the only practical means up update is full-version upgrade. It's not possible or

Re: SORBS Fine - Views

At 05:06 PM 9/13/2004, Daniel Quinlan wrote: "Darren Casey" <[EMAIL PROTECTED]> writes: > However, SORBs are demanding $50 to remove the IP from the list. Their > comparison of speeding is something I find totally crazy. It's definitely not blackmail and I don't think it's extortion either, but the

New Rules

Hi All! Do You know where I can download a new rules for SpamAssassin ? I would like a simple URL, where I can use a wget command, or some like this. Someone can help me ? Tks! Thompson

procmail or milter?

Greetings, I have a stable SpamAssassin 2.64 spamd/spamc daemon running via sendmail/procmail on a MacOS X 10.3 mail server. I've recently rebuilt sendmail from source and took the opportunity to build in -DMILTER support. Is it now worth swapping to a SpamAssassin milter? What are the perform

Re: Moron ratware

--On Monday, September 13, 2004 1:42 PM -0700 John Hardin <[EMAIL PROTECTED]> wrote: The way the SMTP protocol is constructed, the client opens a connection and waits for a welcome banner before sending data. If the connection is tarpitted immediately, then the client never receives the welcome b

Still running as root?

Hi. I've been running SA for awhile now and recently tried to install it on another machine. Everything installs fine (make tests=100%) and seem to run but in /var/log/maillog, I get these entries: info: setuid to root succeeded spamd[15901]: Still running as root: user not specified with -u,

Re: SPF and spammers

On Mon, 2004-09-13 at 11:51, Codger wrote: > But still, my recommendation is to use an SPF pass to decrease the spam > score and to not use SFP fails to blacklist. You're still misinterpreting my idea. 1) a message passes SPF (sender verified); 2) SA classifies the message as spam; 3) somethin

Re: SORBS Fine - Views

"Darren Casey" <[EMAIL PROTECTED]> writes: > However, SORBs are demanding $50 to remove the IP from the list. Their > comparison of speeding is something I find totally crazy. It's definitely not blackmail and I don't think it's extortion either, but the developers viewed it as unreasonable and w

Re: SPF and spammers

Kelson said: > Someone made a suggestion to blacklist based on SPF results. Problems > were pointed out. The suggestion was withdrawn. The thread continues > anyway. Ah, that's what's going on - OK, we're on the same page now - it seems I should have caught up on my entire inbox before offer

Re: spamassassin-users on MARC

At 03:49 PM 9/13/2004, Al Sparks wrote: I noticed that the Mailing list ARChives (MARC) doesn't have any posts for September, for spamassassin-users. The apache web page does advertise that MARC is one of the archives that carries the list. Just wondering. === Al From the looks of it, MARC migh

Re: Moron ratware

On Sat, 2004-09-11 at 12:21, Kenneth Porter wrote: > --On Saturday, September 11, 2004 12:10 PM -0700 John Hardin > <[EMAIL PROTECTED]> wrote: > > > Unfortunately, unless the tarpit responds to the first packet with a > > SMTP welcome banner, the connection won't be tarpitted for longer than > >

Re: SPF and spammers

kaiser suse wrote: Bret Miller said: Yes, you should. But what happens if my almost-informed user decides to do it the old way? Do you blacklist my domain because a user decided to do things wrong? I'm not sure how things could come to such a state - using SPF does not "blacklist domains" Someone

RE: SPF and spammers

Bret Miller said: > Yes, you should. But what happens if my almost-informed user decides to > do it the old way? Do you blacklist my domain because a user decided to > do things wrong? I'm not sure how things could come to such a state - using SPF does not "blacklist domains", but rather penaliz

Re: sa-learn with Cyrus mail

> I'd like to run (B> sa-learn --ham * (B> on a bunch of folders. But each of these folders has 3 files in them that I (B> believe Cyrus uses for indexing - cyrus.header, cyrus.index, cyrus.cache. (B> How do I exclude those files from being learned? Or don't I have to worry (B> about them? 

RE: SPF and spammers

>> Steve Bertrand said: >> >> > I work for an ISP. My laptop, seldomly moved from the office is >> > configured to send out my [EMAIL PROTECTED] email through this >> ISP >> > SMTP server. I take my laptop home, which is connected to a >> different >> > SMTP server. Unwittingly, I change the SMTP s

sa-learn with Cyrus mail

I'd like to run sa-learn --ham * on a bunch of folders. But each of these folders has 3 files in them that I believe Cyrus uses for indexing - cyrus.header, cyrus.index, cyrus.cache. How do I exclude those files from being learned? Or don't I have to worry about them?

spamassassin-users on MARC

I noticed that the Mailing list ARChives (MARC) doesn't have any posts for September, for spamassassin-users. The apache web page does advertise that MARC is one of the archives that carries the list. Just wondering. === Al

Re: SPF and spammers

Steve Bertrand wrote: I work for an ISP. My laptop, seldomly moved from the office is configured to send out my [EMAIL PROTECTED] email through this ISP SMTP server. I take my laptop home, which is connected to a different SMTP server. Unwittingly, I change the SMTP server to the home ISP's server

RE: SPF and spammers

> Steve Bertrand said: > > > I work for an ISP. My laptop, seldomly moved from the office is > > configured to send out my [EMAIL PROTECTED] email through this ISP > > SMTP server. I take my laptop home, which is connected to a > different > > SMTP server. Unwittingly, I change the SMTP server to t

Re: SPF and spammers

Steve Bertrand said: > I work for an ISP. My laptop, seldomly moved from the office is > configured to send out my [EMAIL PROTECTED] email through this ISP > SMTP server. I take my laptop home, which is connected to a different > SMTP server. Unwittingly, I change the SMTP server to the home ISP'

Re: SPF and spammers

> But still, my recommendation is to use an SPF pass to decrease the > spam > score and to not use SFP fails to blacklist. This is really the first post I've looked at on this thread, but I see your point...correct me if I am wrong with this situation: I work for an ISP. My laptop, seldomly moved

Re: SPF in SA 3.0

On Mon, Sep 13, 2004 at 03:06:39PM -0400, Kevin Peuhkurinen wrote: > Quick question about the SPF implementation in SA 3.0... since > presumably SA does not have access to the envelope headers or to the IP > address of the sending host Most MTAs put both pieces of information into the message h

RE: Spammer using my domain name in FROM field

> -Original Message- > From: p dont think [mailto:[EMAIL PROTECTED] > Sent: Monday, September 13, 2004 2:09 PM > To: Toll, Eric > Cc: Robert Menschel; Predrag Lezaic; users@spamassassin.apache.org > Subject: Re: Spammer using my domain name in FROM field > > >>Hello Predrag, > >> > >>Sat

RE: Bayesian Filtering/Resending from Outlook

Thanks for the response. My apologies if my message was confusing. We're not using Exchangethe backend is open source running on Linux. We're using Outlook for clients but there is no Exchange integration. I won't be able to copy the messages so I'll have to redirect/bounce them according

SPF in SA 3.0

Quick question about the SPF implementation in SA 3.0... since presumably SA does not have access to the envelope headers or to the IP address of the sending host, how does it determine the address to use for the sending host? Thanks.

Re: SPF and spammers

- Original Message - From: "Codger" <[EMAIL PROTECTED]> To: "SpamAssassin list" Sent: Monday, September 13, 2004 11:51 AM Subject: Re: SPF and spammers > But still, my recommendation is to use an SPF pass to decrease the spam > score and to not use SFP fails to blacklist. That would be

RE: Bayesian Filtering/Resending from Outlook

> -Original Message- > From: Jim Ficarra [mailto:[EMAIL PROTECTED] > Sent: Monday, September 13, 2004 1:37 PM > To: users@spamassassin.apache.org > Subject: Bayesian Filtering/Resending from Outlook > > > I would like to setup a site wide spam filter using > SpamAssassin. In addition t

Re: SPF and spammers

But still, my recommendation is to use an SPF pass to decrease the spam score and to not use SFP fails to blacklist. On Sep 13, 2004, at 1:39 PM, Kelson wrote: You're misunderstanding. The suggestion was to take spam that passed SPF, look for the other servers listed in that SPF record, and add

Re: amavisd-new and SA 3.0

* Dan Karney <[EMAIL PROTECTED]>: > I have the RH EL3 factory installed version of SA on my system (2.55) > and use procmail to pass the mail from postfix to SA. I want to add > virus scanning, so my plan is to switch to using amavisd-new + ClamAV > + SA. amavisd-new must be new enough to be abl

Bayesian Filtering/Resending from Outlook

I would like to setup a site wide spam filter using SpamAssassin. In addition to using the network rules, I would like to setup something where my users can submit their messages for ham/spam to the system so the Bayesian system can learn. I read in the Wiki that you can redirect/bounce a message

amavisd-new and SA 3.0

I have the RH EL3 factory installed version of SA on my system (2.55) and use procmail to pass the mail from postfix to SA. I want to add virus scanning, so my plan is to switch to using amavisd-new + ClamAV + SA. Will there be any problems upgrading to SA 3.0 with this setup? Is there a better w

Re: Spammer using my domain name in FROM field

Hello Predrag, Saturday, September 11, 2004, 9:47:42 AM, you wrote: PL> Spammer apparently is using [EMAIL PROTECTED] in the FROm PL> field of the emails he is sending out. Domain is one of my customers PL> virtual domain, spammer made up the username in the email address. PL> Now I am getting

Re: Multilingual Spam

On Mon, 13 Sep 2004 10:11:53 -0700, Kelson <[EMAIL PROTECTED]> wrote: > Having just received my first Nigerian spam in French, I'm thinking > about language settings again. In 2.6x, language-specific rules only > apply when SA is run under that locale -- but if it's tied in at the > server level (

Re: SPF and spammers

Codger wrote: I don't think it would make any difference if the spammer listed any other servers in HIS DNS SPF records. Your server won't look at his DNS for yahoo's SPF records. That's what SPF is all about. It gives the owner of the domain name exclusive ability to say who is and is not a va

Re: rules_du_jour

That was fixed last week and posted here I thought - thanks. I don't know how I lost the mail package, but installing mailx solved my problem. - John - Original Message - From: ".rp" <[EMAIL PROTECTED]> To: Sent: Monday, September 13, 2004 11:47 AM Subject: Re: rules_du_jour > On 8 S

loads of expire files filling up /var/spool/spamassassin/nobody

Is it just me that gets loads of files bayes_toks.expire* filling up /var/spool/spamassassin/nobody ? I seem to get a 10MB file of this form in there for every single email - for every user - SA handles :( I've obviously messed something up badly in my config, but have no idea what... I'm run

Multilingual Spam

Having just received my first Nigerian spam in French, I'm thinking about language settings again. In 2.6x, language-specific rules only apply when SA is run under that locale -- but if it's tied in at the server level (in our case, through MIMEDefang), it's always going to be run under the same l

Re: rules_du_jour

On 8 Sep 2004 at 20:55, John Fleming wrote: > > > P.S. If you know how to get my mail command back, I obviously would > like to > > > know that too! It used to be there, and I have no idea why it > disappeared! > > > > > What do you get when you run locate mail ?

Re: Milter or Spamd error?

Andy Jezierski <[EMAIL PROTECTED]> wrote on 09/13/2004 10:13:01 AM: > > > > > I've got a question as to whether you think this is a milter error or a > spamd error. I'm thinking milter. > > I'm running milter-spamc 0.24 along with sendmail 8.13 on one box, which is > calling spamd 3.0rc3 (hav

Milter or Spamd error?

I've got a question as to whether you think this is a milter error or a spamd error. I'm thinking milter. I'm running milter-spamc 0.24 along with sendmail 8.13 on one box, which is calling spamd 3.0rc3 (haven't had a chance to go to rc4 yet) running on another box. Everything works just fin

RE: what about non-marked spam?

>-Original Message- >From: Loren Wilton [mailto:[EMAIL PROTECTED] >Sent: Saturday, September 11, 2004 11:10 PM >To: [EMAIL PROTECTED] >Subject: Re: what about non-marked spam? > > >> What are you doing about spam that goes through being scored >too low for >> spamassassin to get it? Do y

Re: sa-learn & Maildir

At 10:30 PM 9/12/2004 -0400, you wrote: I am new to SpamAssassin and have collected quite a bit of mail to send to sa-learn. The problem is that all my mail is in Maildirs not in mboxes. How might I go about teaching SpamAssassin? sa-learn supports maildirs just fine. By default sa-learn assumes

RE: Spammer using my domain name in FROM field

> -Original Message- > From: Robert Menschel [mailto:[EMAIL PROTECTED] > Sent: Sunday, September 12, 2004 1:08 AM > To: Predrag Lezaic > Cc: users@spamassassin.apache.org > Subject: Re: Spammer using my domain name in FROM field > > Hello Predrag, > > Saturday, September 11, 2004, 9:4

Re: Big companies using SpamAssassin?

I'm afraid that I don't know who you would contact, but my ISP Primus Canada uses SA. According to their PR, they have 80,000 users. Daniel Quinlan wrote: Daniel Quinlan <[EMAIL PROTECTED]> writes: The Apache SpamAssassin project is looking to get in touch with large companies (Fortune 1000)

Re: Big companies using SpamAssassin?

Daniel Quinlan wrote: Daniel Quinlan <[EMAIL PROTECTED]> writes: The Apache SpamAssassin project is looking to get in touch with large companies (Fortune 1000) or large user installations (roughly 100,000 users or higher) that are happy using SpamAssassin and might not mind telling the world that

Re: erring exit code on spamc

Tom Caudron <[EMAIL PROTECTED]> writes: > Daniel said, "'more' is definitively the wrong way to run this as it > adds paging lines, etc. It's also not needed. Just run: "spamc < > message" > > I get the same results. Well, I'd have guessed that you would have the same results as it just adds ga

Re: Big companies using SpamAssassin?

I have knowledge of a large automotive manufacturer who has been using spamassassin on a test group of 700 users or so, and is now planning to extend the program to 12,000 users - nowhere near 100,000 users though, so I wasn't sure whether I should waste your time with this... e Daniel Quinlan

Re: Big companies using SpamAssassin?

Daniel Quinlan <[EMAIL PROTECTED]> writes: > The Apache SpamAssassin project is looking to get in touch with large > companies (Fortune 1000) or large user installations (roughly 100,000 > users or higher) that are happy using SpamAssassin and might not mind > telling the world that they are. We'

Re: SORBS Fine - Views

At 07:00 PM 9/12/2004 +0100, you wrote: We run a large number of servers and do our best to keep ontop of spam reports etc.. One user recently enabled webmail fron Nuke and got a spammer using it to send out a ton of junk mail. The first reports we got we tracked it down and removed the site in que

Re: sa-learn & Maildir

Hi Sam.. I had the same problem, but Now I use to use the sa-learn command on each directory (cur, new and tmp) to learn Spam and Ham. On Sun, 12 Sep 2004 22:30:32 -0400, Sam Carleton <[EMAIL PROTECTED]> wrote: > I am new to SpamAssassin and have collected quite a bit of mail to > send to sa-lear

sa-learn & Maildir

I am new to SpamAssassin and have collected quite a bit of mail to send to sa-learn. The problem is that all my mail is in Maildirs not in mboxes. How might I go about teaching SpamAssassin? While I am asking, the mail sits on one computer and the SpamAssassin gateway is sitting on another. I w

Re: erring exit code on spamc

Daniel said, "spamd is not running, you've installed it wrong, or something else" I installed it with apt-get (using synaptic in Fedora Core 2), though it's possible that the install is bad. I get the same results on a separate FC1 box as well, though. Daniel said, "'more' is definitively the wro

RE: Spamd running on a different server

Matt Kettler wrote: > At 03:50 AM 9/12/2004 -0500, you wrote: >> 1. On the return trip back to spamc...spamc dies with a failed >> sanity check error. > > >> I suspect this is an error related to the user running spamc being >> different then the user running spamd.

Re: delivery to multiple mailboxes from single account

From: "Roger Taranto" <[EMAIL PROTECTED]> > On Sun, 2004-09-12 at 12:20, Robert Menschel wrote: > > > > Copy William Sterns' blacklist file > > from http://www.stearns.org/sa-blacklist/sa-blacklist.current.cf into > > your user_prefs. > > > I was doing this, but this list is so large that it c

Re: delivery to multiple mailboxes from single account

From: "Stewart Nelson" <[EMAIL PROTECTED]> > Hi Bob, > > Many thanks for taking the time to send such a detailed reply. > > > Your situation is similar to mine, but I'm still at SA 2.63. Last week's > > performance stunk at 0 false positives and 20 false negatives (a rotten > > 99.5% accuracy reco

Re[2]: delivery to multiple mailboxes from single account

Hello Stewart, Sunday, September 12, 2004, 4:42:13 PM, you wrote: >> Adding custom rules is among the last things you want to do. I do them, >> and I can help you with the process (provided you can run bash scripts >> under cron), but there are things you want to do first. SN> I had considered r