Re: HABEAS_ACCREDITED_COI

2009-03-16 Thread Aaron Wolfe
On Tue, Mar 17, 2009 at 1:42 AM, LuKreme wrote: > On 16-Mar-2009, at 16:40, Chris wrote: >> >> -8.0 HABEAS_ACCREDITED_COI  RBL: Habeas Accredited Confirmed Opt-In or >>                           Better >>                           [208.82.16.109 listed in > > > I changed my HABEAS scores ages ago:

Re: HABEAS_ACCREDITED_COI

2009-03-16 Thread LuKreme
On 16-Mar-2009, at 16:40, Chris wrote: -8.0 HABEAS_ACCREDITED_COI RBL: Habeas Accredited Confirmed Opt-In or Better [208.82.16.109 listed in I changed my HABEAS scores ages ago: score HABEAS_ACCREDITED_COI -1.0 score HABEAS_ACCREDITED_SOI

JoeJobbed - Vbounce plugin - SPF?.

2009-03-16 Thread Michael Hutchinson
Hello everyone, I'm running Spamassassin 3.1.7, with netqmail 1.05, ClamAv etc.. We've been subject to being joe-jobbed on one of our domains here at work. We were lucky as we were able to switch off delivery to the affected domain and effectively blocked the blowback by refusing E-Mail from all

Re: spamassasin: sa-learn --dump magic interpretation good/bad/other?

2009-03-16 Thread Dennis German
0) Michael, thanks 1) what are the various zero columns?? for example in 0.000 0 3 0 non-token data: bayes db version 2) Is this good? not too good? bad? trouble? On Mar 16, 2009, at 14:03, Michael Scheidell wrote: Is there a document regarding the interpretation o

Re: HABEAS_ACCREDITED_COI

2009-03-16 Thread Chris
On Mon, 2009-03-16 at 19:46 -0400, Greg Troxel wrote: > The wiki now has an email address to report Habeas-accredited spam: > > http://wiki.apache.org/spamassassin/Rules/HABEAS_ACCREDITED_COI Thanks Greg, I've reported it to them -- KeyID 0xE372A7DA98E6705C signature.asc Description: This

Re: HABEAS_ACCREDITED_COI

2009-03-16 Thread Greg Troxel
The wiki now has an email address to report Habeas-accredited spam: http://wiki.apache.org/spamassassin/Rules/HABEAS_ACCREDITED_COI pgp8bfg8GvsBB.pgp Description: PGP signature

HABEAS_ACCREDITED_COI

2009-03-16 Thread Chris
Received a mail in my inbox today that was definitely spam but scored as below. After running it through spamassassin -r and -t and removing the senders address from the autowhitelist I got it to score X-spam-status: No, score=-0.1 required=5.0 tests=ADVANCE_FEE_2=1.234, BAYES_50=1,DCC_CHECK_NEGA

Re: does whitelist_from_spf match SPF_HELO_PASS?

2009-03-16 Thread Daryl C. W. O'Shea
SPF_HELO_PASS is NOT considered by whitelist_from_spf. Daryl

Preview with "guessed" encoding

2009-03-16 Thread Andrzej Adam Filip
What is the recommended way to get utf8 content of spam message in cases when: 1) spam message misses charset declaration (common for TW spam) 2) TextCat Plugin detects language *and charset* In case of one specific spam: * TextCat detects zh.big5 * $status->get_content_preview() return "bus

Re: spamassasin: sa-learn --dump magic intrepretation

2009-03-16 Thread Matt Kettler
Michael Scheidell wrote: > > Is there a document regarding the interpretation of > > > > sa-learn --dump magic > config: could not find site rules directory > > 0.000 03 0 non-token data: bayes db > version > 0.000 0 261451

Re: spamassasin: sa-learn --dump magic intrepretation

2009-03-16 Thread Matus UHLAR - fantomas
On 16.03.09 13:23, Dennis German wrote: > Is there a document regarding the interpretation of > > > > sa-learn --dump magic > config: could not find site rules directory > 0.000 03 0 non-token data: bayes db > version > 0.000 0 261451 0 n

Re: does whitelist_from_spf match SPF_HELO_PASS?

2009-03-16 Thread Matus UHLAR - fantomas
> > On Mon, 16 Mar 2009 11:54:26 -0500 > > "McDonald, Dan" wrote: > > > Rather than fiddle with TVD_PH_REC, I'd like to whitelist this sender > > > using SPF. However, it appears that the envelope from address does > > > not have an SPF policy; however, the helo record does match: > > > > > > If

Re: spamassasin: sa-learn --dump magic intrepretation

2009-03-16 Thread RW
On Mon, 16 Mar 2009 14:03:47 -0400 Michael Scheidell wrote: > You have 261,451 tokens that appeared in Œspam¹. > You have 18,530 tokens that appeard in Œham¹ > > You have 143,599 tokens (remember, some tokens could appear in both > spam and ham) The first two are actually the total number of sp

Re: does whitelist_from_spf match SPF_HELO_PASS?

2009-03-16 Thread McDonald, Dan
On Mon, 2009-03-16 at 17:38 +, RW wrote: > On Mon, 16 Mar 2009 11:54:26 -0500 > "McDonald, Dan" wrote: > > > > > Rather than fiddle with TVD_PH_REC, I'd like to whitelist this sender > > using SPF. However, it appears that the envelope from address does > > not have an SPF policy; however,

Re: spamassasin: sa-learn --dump magic intrepretation

2009-03-16 Thread RW
On Mon, 16 Mar 2009 13:23:22 -0400 Dennis German wrote: > Is there a document regarding the interpretation of > > > > sa-learn --dump magic The are pretty self-explanatory, if you know roughly how Bayes works. The first three are the number of hams and spams learned and the total number of

Re: spamassasin: sa-learn --dump magic intrepretation

2009-03-16 Thread Michael Scheidell
> Is there a document regarding the interpretation of > > >> > sa-learn --dump magic > config: could not find site rules directory > > 0.000 03 0 non-token data: bayes db version > 0.000 0 261451 0 non-token data: nspam > 0.000 0

Re: does whitelist_from_spf match SPF_HELO_PASS?

2009-03-16 Thread RW
On Mon, 16 Mar 2009 11:54:26 -0500 "McDonald, Dan" wrote: > I've got a false-positive against TVD_PH_REC. The text in part says: > THIS REPORT MAY NOT REFLECT > THE INFORMATION REGARDING YOUR ACCOUNT FOUND ON THE OFFICIAL RECORDS > OF > > Rather than fiddle with TVD_PH_REC, I'd like to whitel

spamassasin: sa-learn --dump magic intrepretation

2009-03-16 Thread Dennis German
Is there a document regarding the interpretation of > sa-learn --dump magic config: could not find site rules directory 0.000 03 0 non-token data: bayes db version 0.000 0 261451 0 non-token data: nspam 0.000 018530

Re: SPF_NEUTRAL scoring?

2009-03-16 Thread Kelson
LuKreme wrote: I don't remember what ?all means though, or how it differs from -all or ~all. ? means the record makes no claims about that source. ?all basically says, "Mail might come from other places, or it might not, we aren't sure." (In RFC terms, mail from us MAY be sent from other pl

does whitelist_from_spf match SPF_HELO_PASS?

2009-03-16 Thread McDonald, Dan
I've got a false-positive against TVD_PH_REC. The text in part says: THIS REPORT MAY NOT REFLECT THE INFORMATION REGARDING YOUR ACCOUNT FOUND ON THE OFFICIAL RECORDS OF Rather than fiddle with TVD_PH_REC, I'd like to whitelist this sender using SPF. However, it appears that the envelope from a

Re: Spam with AWL and Bayes00

2009-03-16 Thread Chris Barnes
Karsten Bräckelmann wrote: > > On Tue, 2009-03-10 at 10:05 -0500, Chris Barnes wrote: >> >> Karsten Bräckelmann wrote: >>> >>> The AWL score for this message is minimal (one can tell by calculating >>> >>> the stock rules' scores without it). Your problem here is BAYES_00 and >>> >>> RCVD_IN_D