doesn't drop email above required hits

2008-10-22 Thread Nelson Serafica
Anyone uses qmail here. I just recently setup qmail with qmail-scanner and clamav and spamassin as scanner array. I just noticed in my spamassassin log that even though the required hits in spamassassin is 5, it still allow those email which has greater value of 5. Below is the logs of my spamassa

Re: OT: unusual traffic from mail servers

2008-10-22 Thread mouss
Burton Windle a écrit : > Sorry for the off-topic post, but I can't think of a better list with > more sharp email server admins. > > I've just taken a new job with a company that does some (legit, opt-in, > with-working-remove-link, only sending to our paying customers) email > marketing. I'm see

Re: bogusmx [Was: DNS restrictions for a mail server]

2008-10-22 Thread mouss
Michael Scheidell a écrit : >> 3banatomy.co.kr > > Minor point, rfc's don't require an mx record an a record will satisfy the > rfc's just fine. (and one of the major saas email anti-spam providers used > to use cname records for all their clients.. Yes, they took them off, one at > a time, as c

Re: OT: DNS restrictions for a mail server

2008-10-22 Thread Len Conrad
>># host mail.example.com >>mail.example.com is an alias for hostname.example.com. >>hostname.example.com has address 1.2.3.4 > > >Wrong. The MX record has to point to an A name, not a CNAME. what? MX record's data field is a domain name That domain name owns one or more A records. With mai

Re: OT: DNS restrictions for a mail server

2008-10-22 Thread Joseph Brennan
--On Tuesday, October 21, 2008 2:37 PM +0200 Sebastian Ries < [EMAIL PROTECTED]> wrote: # host -t MX example.com example.com mail is handled by 100 mail.example.com. # host mail.example.com mail.example.com is an alias for hostname.example.com. hostname.example.com has address 1.2.3.4 W

Re: bogusmx [Was: DNS restrictions for a mail server]

2008-10-22 Thread SM
At 15:01 22-10-2008, Michael Scheidell wrote: Maybe rfc's need to change.. There is no modern software that can't send to a cnamed mx or mx'ed cname, whatever. I doubt that it will be changed to accommodate that. It's not only a matter of software. Such a change would have an impact on DNS.

Re: OT: unusual traffic from mail servers

2008-10-22 Thread SM
At 13:42 22-10-2008, Burton Windle wrote: Basically, we are seeing denied traffic on our firewall. The source of the traffic is the mail servers we are sending to; it is coming FROM their TCP/25, and going to some random high-level TCP port on our sending host. If I didn't know better, I'd thin

Re: Rule writing - spamassassin-3.2.5-1

2008-10-22 Thread John Hardin
On Wed, 22 Oct 2008, Tom Brown wrote: I am getting loads of spam about various topics but a common theme is the URL within the message and that is http://X7zfqxF7.spaces.live.com/ That was discussed within the past week, check the mailing list archives. -- John Hardin KA7OHZ

Re: unusual traffic from mail servers

2008-10-22 Thread Jari Fredriksson
> Sorry for the off-topic post, but I can't think of a > better list with more sharp email server admins. > > I've just taken a new job with a company that does some > (legit, opt-in, with-working-remove-link, only sending to > our paying customers) email marketing. I'm seeing some > very weird tr

Re: bogusmx [Was: DNS restrictions for a mail server]

2008-10-22 Thread Michael Scheidell
> 3banatomy.co.kr Minor point, rfc's don't require an mx record an a record will satisfy the rfc's just fine. (and one of the major saas email anti-spam providers used to use cname records for all their clients.. Yes, they took them off, one at a time, as clients complianted that they were black

Re: OT: DNS restrictions for a mail server

2008-10-22 Thread Kai Schaetzl
Dan McDonald wrote on Wed, 22 Oct 2008 11:11:13 -0500: > I'm not certain what you are talking about. SPF is very commonly > deployed. > > http://www.openspf.org/Statistics I don't see that you can deduce "is very commonly deployed" from that page. > See especially http://utility.nokia.net/~lar

Re: Validating XML email

2008-10-22 Thread Kenneth Porter
On Wednesday, October 22, 2008 11:31 AM +0200 Kai Schaetzl <[EMAIL PROTECTED]> wrote: This is far away from reality. What makes you think that XHTML mail would be any better formed than HTML? I bet some makers of those many crap HTML web mailers will just rename the Doctype if a client asks t

Rule writing - spamassassin-3.2.5-1

2008-10-22 Thread Tom Brown
Hi I am getting loads of spam about various topics but a common theme is the URL within the message and that is http://X7zfqxF7.spaces.live.com/ Does anyone know how i can write a rule to eliminate these? spamassassin-3.2.5-1.el4.rf thanks

OT: unusual traffic from mail servers

2008-10-22 Thread Burton Windle
Sorry for the off-topic post, but I can't think of a better list with more sharp email server admins. I've just taken a new job with a company that does some (legit, opt-in, with-working-remove-link, only sending to our paying customers) email marketing. I'm seeing some very weird traffic from

Re: OT: DNS restrictions for a mail server

2008-10-22 Thread mouss
McDonald, Dan a écrit : >>> On 22.10.08 15:49, mouss wrote: In my understanding, these are different concepts. In particular, RMX doesn't hijack the TXT record, which is one of the major sins of SPF. >>> Yes, but they both were designed to do the same work. SPF however can do >>> more. TX

Re: koi8-r ok_locales and ok_languages

2008-10-22 Thread Clayton Cottingham
i linted ever time and never got any errors, with or without the TextCat plugin thanks for the tips on the inactive languages ill post the emails asap Karsten � wrote: >> # Set ok_locals to just en >> ok_locales en >> > > Please note that the comment above is wrong. It actually means > #

Re: Really force a Bayes expire

2008-10-22 Thread Kai Schaetzl
Graham Murray wrote on Fri, 29 Aug 2008 19:42:34 +0100: > As does the 'normal' Bayes expiry mechanism of triggering (or > attempting) an expire when the number of tokens reaches the threshold. coming back to this old thread. Unfortunately, the expiry uses the same algorithm for all Bayes storage

Re: OT: DNS restrictions for a mail server

2008-10-22 Thread McDonald, Dan
On Wed, 2008-10-22 at 17:04 +0200, mouss wrote: > Matus UHLAR - fantomas a écrit : > >>> On 21.10.08 19:31, mouss wrote: > Search for RMX (Reverse Mail eXchanger). > > On 22.10.08 15:49, mouss wrote: > >> In my understanding, these are different concepts. In particular, RMX > >> doesn't hijac

Re: Tuning the bayes-system?

2008-10-22 Thread Heinrich Christian Peters
Jeff Mincy schrieb: >From: Heinrich Christian Peters <[EMAIL PROTECTED]> >Date: Wed, 22 Oct 2008 14:43:55 +0200 > >It learns all detected spam mails with a score of 8 (or higher) and not >hitted by BAYES_70 (or higher). > > I would learn all spam messages including the one

Re: OT: DNS restrictions for a mail server

2008-10-22 Thread mouss
Matus UHLAR - fantomas a écrit : >>> On 21.10.08 19:31, mouss wrote: Search for RMX (Reverse Mail eXchanger). didn't go far for now. > >>> Yes, was kinda superseded by SPF, > > On 22.10.08 15:49, mouss wrote: >> In my understanding, these are different concepts. In particular, RMX

Re: Tuning the bayes-system?

2008-10-22 Thread Heinrich Christian Peters
Kai Schaetzl schrieb: > Heinrich Christian Peters wrote on Wed, 22 Oct 2008 14:43:55 +0200: > >> It learns all detected spam mails with a score of 8 (or higher) and not >> hitted by BAYES_70 (or higher). > > Which means you miss all the spam that got hit by Bayes and scored that > high and was

Re: Tuning the bayes-system?

2008-10-22 Thread Kai Schaetzl
Heinrich Christian Peters wrote on Wed, 22 Oct 2008 14:43:55 +0200: > It learns all detected spam mails with a score of 8 (or higher) and not > hitted by BAYES_70 (or higher). Which means you miss all the spam that got hit by Bayes and scored that high and was not autolearned. I think with a go

Re: OT: DNS restrictions for a mail server

2008-10-22 Thread Matus UHLAR - fantomas
> > On 21.10.08 19:31, mouss wrote: > >> Search for RMX (Reverse Mail eXchanger). > >> > >> didn't go far for now. > > Yes, was kinda superseded by SPF, On 22.10.08 15:49, mouss wrote: > In my understanding, these are different concepts. In particular, RMX > doesn't hijack the TXT record, which

Re: OT: DNS restrictions for a mail server

2008-10-22 Thread Bernd Petrovitsch
On Wed, 2008-10-22 at 15:49 +0200, mouss wrote: [...] > In my understanding, these are different concepts. In particular, RMX > doesn't hijack the TXT record, which is one of the major sins of SPF. SPF has it's own record type. Use "TYPE99" if your named doesn't understand "SPF" yet. The TXT reco

Re: OT: DNS restrictions for a mail server

2008-10-22 Thread mouss
Matus UHLAR - fantomas a écrit : >> Jorge Valdes a écrit : >>> Matus UHLAR - fantomas wrote: >>> > The point of MX is to point to hosts that receive mail, if you send mail > to > someone. > > The point of PTR is to provide host name when you receive mail from > someone. >>

Re: Tuning the bayes-system?

2008-10-22 Thread Kai Schaetzl
Heinrich Christian Peters wrote on Wed, 22 Oct 2008 14:30:13 +0200: > Why? Won't Bayes get better, if I tell spamassassin more clearly, which > mails are spam *and* which are not? In general, yes. But we were talking about a specific context (MailScanner quarantine and automated Bayes learning

Re: Tuning the bayes-system?

2008-10-22 Thread Jeff Mincy
From: Heinrich Christian Peters <[EMAIL PROTECTED]> Date: Wed, 22 Oct 2008 14:43:55 +0200 Kai Schaetzl schrieb: > Just checked what I actually do, here it is: > > yesterday=`date -d "-1 day" +"%Y%m%d"` > sa-learn --spam --progress /var/spool/MailScanner/quarantine/ >

Re: Tuning the bayes-system?

2008-10-22 Thread Heinrich Christian Peters
Kai Schaetzl schrieb: > Just checked what I actually do, here it is: > > yesterday=`date -d "-1 day" +"%Y%m%d"` > sa-learn --spam --progress /var/spool/MailScanner/quarantine/ > ${yesterday}/spam/ I implemented a solution with sieve and sa-learn-cyrus: > if allof ( > header :contains "X-hei

Re: Tuning the bayes-system?

2008-10-22 Thread Heinrich Christian Peters
Kai Schaetzl schrieb: > Benny Pedersen wrote on Wed, 22 Oct 2008 01:04:42 +0200 (CEST): > >> will olso be good to learn ham in that script > > no, it won't Why? Won't Bayes get better, if I tell spamassassin more clearly, which mails are spam *and* which are not? Heiner

Re: OT: DNS restrictions for a mail server

2008-10-22 Thread Matus UHLAR - fantomas
> Jorge Valdes a écrit : > > Matus UHLAR - fantomas wrote: > > > >>> The point of MX is to point to hosts that receive mail, if you send mail > >>> to > >>> someone. > >>> > >>> The point of PTR is to provide host name when you receive mail from > >>> someone. > >>> > >>> The PTR has NOTHING to

Re: Validating XML email

2008-10-22 Thread Martin Gregorie
On Wed, 2008-10-22 at 11:31 +0200, Kai Schaetzl wrote: > This is far away from reality. What makes you think that XHTML mail would be > any better formed than HTML? I bet some makers of those many crap HTML web > mailers will just rename the Doctype if a client asks them about XHTML > compatibil

Re: Tuning the bayes-system?

2008-10-22 Thread Kai Schaetzl
Benny Pedersen wrote on Wed, 22 Oct 2008 01:04:42 +0200 (CEST): > will olso be good to learn ham in that script no, it won't Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com

Re: Validating XML email

2008-10-22 Thread Kai Schaetzl
Kenneth Porter wrote on Tue, 21 Oct 2008 09:49:47 -0700: > For legacy "un-XML", it's probably reasonable to let them get away with it. > But once something declares itself XML, I think it's fair to ask for a bit > more compliance, at the very least well-formedness. This is far away from reality

Re: Public whitelists

2008-10-22 Thread Kai Schaetzl
Benny Pedersen wrote on Wed, 22 Oct 2008 04:19:23 +0200 (CEST): > 1: html mails is spam It's not spam. If you don't like HTML mail (like me), contact the sender off-list and ask him politely to stop that. > 2: cc is spam olso What problem do you have? That cc did not go to you. If you get a cc

RE: exim spamassassin AFTER SMTP

2008-10-22 Thread Martin.Hepworth
Hi Put in an ACL for local machines so that you don't run SA for these people. Either that or if users are remote (ie you're an ISP) do authententication then use that for the ACL check. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 > -Original Mess

Re: exim spamassassin AFTER SMTP

2008-10-22 Thread TN
>On śro, 2008-10-22 at 00:01 -0700, TN wrote: >> It seems that almost everyone wants spamassasin before SMTP, > >Nh. > >> so we can afford to accept spam and filter it after SMTP. > >What are you using for local delivery? The most common solution, I think >is to use procmail and just include a

Re: I get a lot of these spams, obviously by one software program

2008-10-22 Thread mouss
Igor Chudov a écrit : > example is here > > http://igor.chudov.com/tmp/spam004.txt > Content analysis details: (8.2 points, 5.0 required) pts rule name description -- -- 2.1 RCVD_IN_NJABL_SPAM RBL: NJ

Re: exim spamassassin AFTER SMTP

2008-10-22 Thread Mariusz Kruk
On śro, 2008-10-22 at 00:01 -0700, TN wrote: > It seems that almost everyone wants spamassasin before SMTP, Nh. > so we can afford to accept spam and filter it after SMTP. What are you using for local delivery? The most common solution, I think is to use procmail and just include a rule that

bogusmx [Was: DNS restrictions for a mail server]

2008-10-22 Thread mouss
Matt Kettler a écrit : > Stefan Jakobs wrote: >> On Tuesday 21 October 2008 14:57, Matt Kettler wrote: >> >> >>> In general it is recommended to not point a MX record to a CNAME, but >>> that's just to reduce repetative querries. It is extraordinarily >>> commonplace in the real world, and AFAI

exim spamassassin AFTER SMTP

2008-10-22 Thread TN
Hi all, It seems that almost everyone wants spamassasin before SMTP, but I need help in setting it up after delivery. At the moment, I am using Exim4.6x, with SA 3.1.7, and it's default setup is to do the filtering at the ACL stage in Exim. We find this a bit tedious since users sending email