Re: Adding TO in custom header

2006-12-20 Thread Sebastian Ries
Hi Does noone know if it is possible to add the recipient to a custom header? Regards Sebastian Ries -- DT Netsolution GmbH - Talaeckerstr. 30 - D-70437 Stuttgart Tel: +49-711-849910-36 Fax: +49-711-849910-936 WEB: htt

Re: What to do about False Positives on messages I am sending?

2006-12-20 Thread Jo
Jon Ribbens wrote: Loren Wilton <[EMAIL PROTECTED]> wrote: Taking a look at that and offering my opinions: Thanks for taking the time to have a look at it. Apart from inline images though, the other points either don't apply to our emails, or don't appear to be contributing to the Spam

RE: Help! rewrite_header subject not working for me

2006-12-20 Thread Tony Guadagno
I guess i don't understand, you say that "Rewriting the subject is ultimately the responsibility of the MTA.", but SA has this option, so that means that it is SA's responsibility...right? *** Tony Guadagno Guadagno Consulting [EMAIL PROTECTED] 585.703

Re: URIBL_*_SURBL

2006-12-20 Thread Matt Kettler
Kelson wrote: > Dhaval Patel wrote: >> 1.2 BAYES_50 BODY: Bayesian spam probability is 40 to 60% >> [score: 0.4999] > > Possibly silly and slightly off-topic question, but why are you giving > BAYES_50 a positive score? BAYES_50 means Bayes gives it a 50/

RE: Salesforce web bug

2006-12-20 Thread Michael Scheidell
> -Original Message- > From: Loren Wilton [mailto:[EMAIL PROTECTED] > Sent: Wednesday, December 20, 2006 7:46 PM > To: users@spamassassin.apache.org > Subject: Re: Salesforce web bug > > > > Why do you want to consider this a spam sign? I'm just curious. > > Bugs in mail messages are

Re: Salesforce web bug

2006-12-20 Thread Bart Schaefer
On 12/20/06, Loren Wilton <[EMAIL PROTECTED]> wrote: > Why do you want to consider this a spam sign? I'm just curious. Bugs in mail messages are generally a suspicious circumstance, and probably good for a fractional point all by themselves. In general any tracking that will auto-identify with

Re: What to do about False Positives on messages I am sending?

2006-12-20 Thread Jon Ribbens
Loren Wilton <[EMAIL PROTECTED]> wrote: > Taking a look at that and offering my opinions: Thanks for taking the time to have a look at it. Apart from inline images though, the other points either don't apply to our emails, or don't appear to be contributing to the SpamAssassin score. > In all hon

Re: Salesforce web bug

2006-12-20 Thread Loren Wilton
Why do you want to consider this a spam sign? I'm just curious. Bugs in mail messages are generally a suspicious circumstance, and probably good for a fractional point all by themselves. In general any tracking that will auto-identify without the user at least clicking on something is suspi

Re: Salesforce web bug

2006-12-20 Thread Bart Schaefer
On 12/19/06, Michael Scheidell <[EMAIL PROTECTED]> wrote: I noticed an email from salesforce has a 'user tracking' web bug in it but it isn't currently detected by SA or SARES Why do you want to consider this a spam sign? I'm just curious.

RE: sa-update is broken

2006-12-20 Thread R Lists06
> > No. > > But it does work better if you install all needed dependencies and > follow the instructions. Without dependencies it doesn't run (who > would have guessed?), and without following the instructions the > result may not be what you expected. > > -thh Thanks, the context of my questi

Re: sa-update is broken

2006-12-20 Thread Thomas Hochstein
"R Lists06" schrieb: > Is sa-update broken No. But it does work better if you install all needed dependencies and follow the instructions. Without dependencies it doesn't run (who would have guessed?), and without following the instructions the result may not be what you expected. -thh

Re: What to do about False Positives on messages I am sending?

2006-12-20 Thread Loren Wilton
From: "Rob Anderson" <[EMAIL PROTECTED]> Jon Ribbens <[EMAIL PROTECTED]> 12/20/06 03:16PM >>> Adam Lanier <[EMAIL PROTECTED]> wrote: That's why I asked to see a sample message. We could probably give some pointers on what is triggering SA. Set your TRUSTED_NETWORKS and that'll help. That's

Re: What to do about False Positives on messages I am sending?

2006-12-20 Thread Loren Wilton
I have attached a sample message to this email. Note, it's just an example. This message does not trigger at the 5.0 level, but I know messages like this are being blocked by some of our customers. It does get a higher score than I would like it to (i.e. 0.0 ;-) ), and certainly the rules its trig

RE: autolearn and getting better SMTP header output

2006-12-20 Thread Bowie Bailey
Noah wrote: > SA 3.1.7 > FreeBSD 4.11 > > Hi there, > > I am trying to get better understanding as to why spamassassin is > behaving the way it is. > > So I see that autolearn=no. I thought by default autolearn is turned > on. I dont have this turned off in the system-wide configuration nor >

Re: non existant directory errors

2006-12-20 Thread Theo Van Dinter
On Wed, Dec 20, 2006 at 04:32:41PM -0500, Jean-Paul Natola wrote: > I'm noticing a lot of entries in my maillog regarding a non-existent > directory It means that some user calling spamd has a homedir set to /nonexistant. > I do not have per-user config- and spamd runs as root- So you're running

non existant directory errors

2006-12-20 Thread Jean-Paul Natola
Hi everyone , I'm noticing a lot of entries in my maillog regarding a non-existent directory - Google came up with this- http://comments.gmane.org/gmane.mail.spam.spamassassin.general/72541 I'm not entirely sure I'm grasping what to do here- I do not have per-user config- and spamd runs as root-

Re: How to change tmpdir of spamassassin?

2006-12-20 Thread Theo Van Dinter
On Wed, Dec 20, 2006 at 11:21:59PM +0200, Halid Faith wrote: > I use spamassassin3.1.7. It uses tmp directory of root. Fuzzyocr uses it too. > I want them to use different a place from /tmp dir. > How can I do that ? Short version: Like most other UNIX programs, set TMPDIR before running SA. Lon

How to change tmpdir of spamassassin?

2006-12-20 Thread Halid Faith
I use spamassassin3.1.7. It uses tmp directory of root. Fuzzyocr uses it too. I want them to use different a place from /tmp dir. How can I do that ?

Re: What to do about False Positives on messages I am sending?

2006-12-20 Thread Rob Anderson
>>> Jon Ribbens <[EMAIL PROTECTED]> 12/20/06 03:16PM >>> Adam Lanier <[EMAIL PROTECTED]> wrote: > That's why I asked to see a sample message. We could probably give some > pointers on what is triggering SA. I have attached a sample message to this email. Note, it's just an example. This message d

Re: sa-update & spamd: updatedir

2006-12-20 Thread Theo Van Dinter
On Wed, Dec 20, 2006 at 08:42:01PM +0100, Matthias Leisi wrote: > I know that I can trick spamd & spamassassin into using whatever > directory I like for whatever rule files, but wouldn't it make sense to > make this configurable through the command line (or some system-wide > setting) in spamd + s

autolearn and getting better SMTP header output

2006-12-20 Thread Noah
SA 3.1.7 FreeBSD 4.11 Hi there, I am trying to get better understanding as to why spamassassin is behaving the way it is. So I see that autolearn=no. I thought by default autolearn is turned on. I dont have this turned off in the system-wide configuration nor the user specific configurati

sa-update & spamd: updatedir

2006-12-20 Thread Matthias Leisi
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I can specify "sa-update --updatedir path" to use something other than the default (eg /var/lib/spamassassin/). However, I can not do the same for spamd(8) and spamassassin(1) -- they have LOCAL_STATE_DIR substituted at make time. I know that I can tr

Re: URIBL_*_SURBL

2006-12-20 Thread Kelson
Dhaval Patel wrote: 1.2 BAYES_50 BODY: Bayesian spam probability is 40 to 60% [score: 0.4999] Possibly silly and slightly off-topic question, but why are you giving BAYES_50 a positive score? BAYES_50 means Bayes gives it a 50/50 chance of being eit

Re: What to do about False Positives on messages I am sending?

2006-12-20 Thread Theo Van Dinter
On Wed, Dec 20, 2006 at 06:44:48PM +, Jon Ribbens wrote: > I did that. The problem that needs fixing is SpamAssassin. It is > triggering on things that are nothing to do with spam (for example, > RFC-compliant use of multipart/related). Your main issue is that spammers are making their mails

Re: What to do about False Positives on messages I am sending?

2006-12-20 Thread Jon Ribbens
Noel Jones <[EMAIL PROTECTED]> wrote: > So why not find which rules are triggered by your message I already did - see my original post at the start of this thread. > Can't be too hard, spammers do it all the time. That's my point - why should I have to behave like a spammer in order to avoid get

Re: 4.64 compile problem on Linux 2.6.19.1

2006-12-20 Thread George R . Kasica
>wrong list.. perhaps you meant to post it to the exim list? OOPS, sorry about thathit the wrong address book entry. Thanks for pointing it out. George

Re: What to do about False Positives on messages I am sending?

2006-12-20 Thread Adam Lanier
On Wed, 2006-12-20 at 11:38 -0600, Noel Jones wrote: > On 12/20/06, Jon Ribbens <[EMAIL PROTECTED]> wrote: > > "John D. Hardin" <[EMAIL PROTECTED]> wrote: > > > ...sign up with a service like Habeas or Bonded Sender and put their > > > headers in your messages? > > > > I suppose we could do. Does a

Re: What to do about False Positives on messages I am sending?

2006-12-20 Thread Noel Jones
On 12/20/06, Jon Ribbens <[EMAIL PROTECTED]> wrote: "John D. Hardin" <[EMAIL PROTECTED]> wrote: > ...sign up with a service like Habeas or Bonded Sender and put their > headers in your messages? I suppose we could do. Does anyone know how much that costs? It still seems wrong to me though that

Re: 4.64 compile problem on Linux 2.6.19.1

2006-12-20 Thread Dhawal Doshy
George R. Kasica wrote: Trying to compile 4.64 here using the same settings as 4.63 (which compiles just fine) and am seeing the following error during make: gcc transport.c In file included from transport.c:17: /usr/local/include/sys/sendfile.h:26:3: error: #error " cannot be used with _FILE_OF

4.64 compile problem on Linux 2.6.19.1

2006-12-20 Thread George R . Kasica
Trying to compile 4.64 here using the same settings as 4.63 (which compiles just fine) and am seeing the following error during make: gcc transport.c In file included from transport.c:17: /usr/local/include/sys/sendfile.h:26:3: error: #error " cannot be used with _FILE_OFFSET_BITS=64" make[1]: ***

Re: What to do about False Positives on messages I am sending?

2006-12-20 Thread Jon Ribbens
"John D. Hardin" <[EMAIL PROTECTED]> wrote: > ...sign up with a service like Habeas or Bonded Sender and put their > headers in your messages? I suppose we could do. Does anyone know how much that costs? It still seems wrong to me though that SpamAssassin is penalising mail that doesn't look like

Re:whitelist and Excessive Spam

2006-12-20 Thread Kyle Quillen
On Wed, 2006-12-20 at 11:02 -0500, Theo Van Dinter wrote: > On Wed, Dec 20, 2006 at 11:00:17AM -0500, Kyle Quillen wrote: > > Ok when I type spamassassin -D it stops at > > > > [2] dbg: dns: is Net::DNS::Resolver available? yes > > [2] dbg: dns: Net::DNS version: 0.48 > > > > and then jus

Re: yet another stupid spammer trick

2006-12-20 Thread John D. Hardin
On Wed, 20 Dec 2006, John Rudd wrote: > 6) a small score (0.5?) if the sender address contains "web" or "www". I'd add the same check against the Received: headers. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ [EMAIL PROTECTED]FALaholic #11174 pgpk -a [EMAIL

Re: DNSBL's activated, but where in config?

2006-12-20 Thread Theo Van Dinter
On Wed, Dec 20, 2006 at 01:35:08PM +0100, Martin wrote: > Matt, thanks, but i don't want to disable all of them. Is it possible to > disable just some of them. Since Spamhaus has changed from SBL+XBL to > ZEN, i want to change that too. You can override this stuff in local.cf, but for things lik

Re: Whitelist and Excessive Spam Please Help

2006-12-20 Thread Theo Van Dinter
On Wed, Dec 20, 2006 at 11:00:17AM -0500, Kyle Quillen wrote: > Ok when I type spamassassin -D it stops at > > [2] dbg: dns: is Net::DNS::Resolver available? yes > [2] dbg: dns: Net::DNS version: 0.48 > > and then just sits there waiting for something. I read somewhere that > it wanted t

Re: Whitelist and Excessive Spam Please Help

2006-12-20 Thread Kyle Quillen
On Wed, 2006-12-20 at 16:49 +0100, Matthias Leisi wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > > > Kyle Quillen wrote: > > > I have a few issues with our filtering and am not sure how to make > > things better. The main issue that I have is that I have created a > > whitelis

Re: Whitelist and Excessive Spam Please Help

2006-12-20 Thread Matthias Leisi
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Kyle Quillen wrote: > I have a few issues with our filtering and am not sure how to make > things better. The main issue that I have is that I have created a > whitelist.cf file in /etc/mail/spamassassin but with the following > [..] > > I am not

RE: Whitelist and Excessive Spam Please Help

2006-12-20 Thread Coffey, Neal
Kyle Quillen wrote: > they are still getting tagged as spam. > > ... > X-Spam-Status: Yes, score=2.8 required=2.0 Of course they're still getting tagged as spam. A score of 2.0 is way, Way, WAY too low a score to be reasonable. At my site it's set to 3.5, and it's still very aggressive, requiri

Whitelist and Excessive Spam Please Help

2006-12-20 Thread Kyle Quillen
Hello All, I have a few issues with our filtering and am not sure how to make things better. The main issue that I have is that I have created a whitelist.cf file in /etc/mail/spamassassin but with the following whitelist_from_rcvd [EMAIL PROTECTED] adelphia.net whitelist_from_rcvd [EMAIL PROTE

Re: yet another stupid spammer trick

2006-12-20 Thread John Rudd
John D. Hardin wrote: On Tue, 19 Dec 2006, John Rudd wrote: John D. Hardin wrote: http://www.impsec.org/~jhardin/stupid_spammer_tricks_01.txt I'm seeing a few of these today too. In fact, at home, I've had maybe 5 spam messages slip through my defenses today. That's a HUGE increase for me .

Re: yet another stupid spammer trick

2006-12-20 Thread John D. Hardin
On Tue, 19 Dec 2006, John Rudd wrote: > John D. Hardin wrote: > > http://www.impsec.org/~jhardin/stupid_spammer_tricks_01.txt > > I'm seeing a few of these today too. In fact, at home, I've had > maybe 5 spam messages slip through my defenses today. That's a > HUGE increase for me ... I usually

Re: URIBL_*_SURBL

2006-12-20 Thread Nigel Frankcom
On Wed, 20 Dec 2006 13:44:09 -, "Dhaval Patel" <[EMAIL PROTECTED]> wrote: >Hello all, I have been using spamassassin for quite some time and just >recently I have >seen some false positives. Looking at the content analysis I see that it is the >URIBL*SURBL rules that is throwing it over the e

URIBL_*_SURBL

2006-12-20 Thread Dhaval Patel
Hello all, I have been using spamassassin for quite some time and just recently I have seen some false positives. Looking at the content analysis I see that it is the URIBL*SURBL rules that is throwing it over the edge. What is surprising is that in some of the emails, the URI is not even in the

Re: ORDB.org is shutting down

2006-12-20 Thread Ian Eiloart
--On 19 December 2006 18:01:31 +0100 Emmanuel Lesouef <[EMAIL PROTECTED]> wrote: I was using it but with postfix checking sender restrictions. I think it is not used in SA but by mail servers. Anyone got a replacement ? We've been using this list of RBLs: sbl-xbl.spamhaus.org list

Re: DNSBL's activated, but where in config?

2006-12-20 Thread Martin
Matt Kettler wrote: If you want to turn them off, you need to add this to your local.cf: skip_rbl_checks 1 Matt, thanks, but i don't want to disable all of them. Is it possible to disable just some of them. Since Spamhaus has changed from SBL+XBL to ZEN, i want to change that too. Thank y

Re: yet another stupid spammer trick

2006-12-20 Thread John Rudd
Duncan Hill wrote: On Wednesday 20 December 2006 06:50, John Rudd wrote: John D. Hardin wrote: http://www.impsec.org/~jhardin/stupid_spammer_tricks_01.txt I'm seeing a few of these today too. In fact, at home, I've had maybe 5 spam messages slip through my defenses today. That's a HUGE incre

Re: DNSBL's activated, but where in config?

2006-12-20 Thread Matt Kettler
Martin wrote: > > > Where do i deactivate some of these rbls? I can't remember that i've > enabled any of them. RBLs are on by default, provided that the Net::DNS perl package is present. If you want to turn them off, you need to add this to your local.cf: skip_rbl_checks 1

Re: How to check message size?

2006-12-20 Thread Matt Kettler
Kosmaj wrote: > Forgive me for spamming the list, but I just realized > that if I just score -10 to long messages, SP will keep on > applying other rules, and it will take long time again. > Therefore, what I need is a rule which will score -10 points > and tell SP to stop processing of all other r

Re: DNSBL's activated, but where in config?

2006-12-20 Thread Matthias Leisi
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Martin wrote: > Hi, > > I ran spamassassin in debug-mode and noticed the following output: > > [23887] dbg: plugin: > Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x9a4a910) implements > 'parsed_metadata' > [23887] dbg: uridnsbl: domains to query: > [

Re: How to check message size?

2006-12-20 Thread Duncan Hill
On Wednesday 20 December 2006 06:11, Kosmaj wrote: > Forgive me for spamming the list, but I just realized > that if I just score -10 to long messages, SP will keep on > applying other rules, and it will take long time again. > Therefore, what I need is a rule which will score -10 points > and tell

Re: yet another stupid spammer trick

2006-12-20 Thread Duncan Hill
On Wednesday 20 December 2006 06:50, John Rudd wrote: > John D. Hardin wrote: > > http://www.impsec.org/~jhardin/stupid_spammer_tricks_01.txt > > I'm seeing a few of these today too. In fact, at home, I've had maybe 5 > spam messages slip through my defenses today. That's a HUGE increase > for me

DNSBL's activated, but where in config?

2006-12-20 Thread Martin
Hi, I ran spamassassin in debug-mode and noticed the following output: [23887] dbg: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x9a4a910) implements 'parsed_metadata' [23887] dbg: uridnsbl: domains to query: [23887] dbg: dns: checking RBL sbl-xbl.spamhaus.org., set sblxbl [23887] dbg: