Re: skipping dynamic tests for ISP's own dynamic networks?

2010-04-08 Thread Royce Williams
On Thu, Apr 8, 2010 at 8:25 PM, Henrik K wrote: > On Thu, Apr 08, 2010 at 06:31:37PM -0800, Royce Williams wrote: >> On Thu, Apr 8, 2010 at 5:13 PM, Henrik K wrote: >> > On Thu, Apr 08, 2010 at 04:52:00PM -0800, Royce Williams wrote: >> >> >> >> Answering myself, I have reworked our *_networks to

Blocking lengthy disguised spam subjects

2010-04-08 Thread Zaeem Arshad
Hi List, Lately, I have been getting a lot of these escaping through our outbound mail system. The complaint was submitted by AOL's FBL and hence there are not many headers intact. The only thing I think I can write a rule for is the lengthy spam subjects which are often incorrectly spelt. Any ide

Re: Blacklists Compared 17 October 2009

2010-04-08 Thread Alex
Hi, > Independent testing like the VB tests tell me much more. > > http://www.virusbtn.com/virusbulletin/archive/2010/03/vb201003-vbspam-comparative > > And yes that more or less the commercial products, but it shows also how > lits like SURBL perform. But also ratings of the large vendors. And th

Re: skipping dynamic tests for ISP's own dynamic networks?

2010-04-08 Thread Henrik K
On Thu, Apr 08, 2010 at 06:31:37PM -0800, Royce Williams wrote: > On Thu, Apr 8, 2010 at 5:13 PM, Henrik K wrote: > > On Thu, Apr 08, 2010 at 04:52:00PM -0800, Royce Williams wrote: > >> > >> Answering myself, I have reworked our *_networks to reflect our > >> architecture based on my re-re-re-rea

Re: the dkim sigature is valid, but still triggered T_DKIM_INVALID in mail server

2010-04-08 Thread leeyc0
leeyc0 wrote: > > > After some struggle and tracing every bit of code (including tracing > installing cpan packages!), apparently it is a bug in the latest > Net::DNS::Packet::Resolver::Base send_tcp function call... > Yes, it is caused by a bug in Net::DNS::Resolver::Base (sorry, there was

Re: skipping dynamic tests for ISP's own dynamic networks?

2010-04-08 Thread Royce Williams
On Thu, Apr 8, 2010 at 5:13 PM, Henrik K wrote: > On Thu, Apr 08, 2010 at 04:52:00PM -0800, Royce Williams wrote: >> >> Answering myself, I have reworked our *_networks to reflect our >> architecture based on my re-re-re-reading.  Nobody has said that my >> example was broken (or was any good, for

Re: the dkim sigature is valid, but still triggered T_DKIM_INVALID in mail server

2010-04-08 Thread leeyc0
leeyc0 wrote: > >> I changed to use 1024 bit RSA key, and seems the email passed DKIM >> validation. Seems that my perl installation at iwtek.net somehow cannot >> validate 2048 bit RSA DKIM signatures. Does anyone have some clue? > > That is possible too, the DNS packet is probably larger tha

Re: skipping dynamic tests for ISP's own dynamic networks?

2010-04-08 Thread Henrik K
On Thu, Apr 08, 2010 at 04:52:00PM -0800, Royce Williams wrote: > > Answering myself, I have reworked our *_networks to reflect our > architecture based on my re-re-re-reading. Nobody has said that my > example was broken (or was any good, for that matter), so I'm > operating from that. > > With

Re: skipping dynamic tests for ISP's own dynamic networks?

2010-04-08 Thread Royce Williams
On Wed, Apr 7, 2010 at 8:29 AM, Royce Williams wrote: > On Tue, Apr 6, 2010 at 2:13 PM, Kris Deugau wrote: >> Royce Williams wrote: >>> >>> Some new information.  In this 2008 thread: >>> >>> http://old.nabble.com/ALL_TRUSTED-and-DOS_OE_TO_MX-td15659736.html >>> >>> ... Daryl says: >>> >>> "So if

Re: the dkim sigature is valid, but still triggered T_DKIM_INVALID in mail server

2010-04-08 Thread leeyc0
> I changed to use 1024 bit RSA key, and seems the email passed DKIM > validation. Seems that my perl installation at iwtek.net somehow cannot > validate 2048 bit RSA DKIM signatures. Does anyone have some clue? That is possible too, the DNS packet is probably larger than 512 bytes, and perhaps y

Re: Question URIBL

2010-04-08 Thread Frederic De Mees
Thank you Rick Your diagnostic was correct. - - - - (extract from /etc/defaults/spampd) - - - # Wether or not to do only local checks # if this is turned on, no network based checks # (like DNS-Blacklists) are done. (0/1) LOCALONLY=1 Please note that I use spampd (not spamd). This setup allows r

Re: access to Bayes in PostgreSQL DB broken

2010-04-08 Thread Mikael Syska
Hi, Have you looked in the sql for postgres ? Have the structure changed? That would be my first step to make sure. ( I'm using InnoDB MySQL ) and between 3.2.5 and 3.1.1 only some Indexes changed ... but I can see you come from a very very old version I think. mvh On Thu, Apr 8, 2010 at 8:43 P

access to Bayes in PostgreSQL DB broken

2010-04-08 Thread ml
Hi, I am running spamassassin with a PostgreSQL DB as bayes storage. After an upgrade from debian etch to debian lenny, this bayes storage doesn't work anymore. The following error appears in the logfile when debugging of bayes related actions is switched on: Thu Apr 8 19:57:19 2010 [15631] dbg:

Re: Question URIBL

2010-04-08 Thread Rick Macdougall
On 08/04/2010 2:00 PM, Frederic De Mees wrote: Hello All, It seems that the rule URIBL_BLACK is never matched in my installation, even when it should. My server is a debian Lenny, postfix, spampd (policy daemon), spamassassin 3.2.5-2+lenny2 When I run 'spamassassin -D < some_spam_mail', the rul

Question URIBL

2010-04-08 Thread Frederic De Mees
Hello All, It seems that the rule URIBL_BLACK is never matched in my installation, even when it should. My server is a debian Lenny, postfix, spampd (policy daemon), spamassassin 3.2.5-2+lenny2 When I run 'spamassassin -D < some_spam_mail', the rule fires correctly (even when I run this comm

Re: Blacklists Compared 17 October 2009

2010-04-08 Thread J.D. Falk
On Apr 7, 2010, at 4:15 AM, Justin Mason wrote: > he doesn't take FPs into account. this is a very serious problem with > the methodology. +1 -- J.D. Falk Return Path Inc

Re: the dkim sigature is valid, but still triggered T_DKIM_INVALID in mail server

2010-04-08 Thread Mark Martinec
> I tried, but still have no clue, but discovered another horrible thing. > I tried to send another email from gmail to iwtek.net, the DKIM signature > validates at iwtek.net (see attachment). I am running mad now... > http://old.nabble.com/file/p28178961/gmail.eml gmail.eml One thing I noticed: t

Re: the dkim sigature is valid, but still triggered T_DKIM_INVALID in mail server

2010-04-08 Thread leeyc0
Mark Martinec wrote: > > > The dkim-failed.eml message looks fine, the DKIM signature validates. > > If both domains are under your control/access, the simplest is to > collect the message from both mailboxes and compare them. > > Mark > > I changed to use 1024 bit RSA key, and seems the

Re: the dkim sigature is valid, but still triggered T_DKIM_INVALID in mail server

2010-04-08 Thread leeyc0
Mark Martinec wrote: > > The dkim-failed.eml message looks fine, the DKIM signature validates. > > If both domains are under your control/access, the simplest is to > collect the message from both mailboxes and compare them. > > Mark > > I tried, but still have no clue, but discovered ano

Re: the dkim sigature is valid, but still triggered T_DKIM_INVALID in mail server

2010-04-08 Thread Mark Martinec
On Thursday 08 April 2010 15:01:40 leeyc0 wrote: > http://old.nabble.com/file/p28178215/dkim-failed.eml dkim-failed.eml > > I manage multiple mail servers, and recently decided to implement DKIM, but > I met a very strange problem. > > I tried to send a DKIM-signed email to both @iwtek.net and @i

Re: newbie for spam optimisation

2010-04-08 Thread John Hardin
On Thu, 8 Apr 2010, ram wrote: On Thu, Apr 8, 2010 at 12:27 AM, John Hardin wrote: On Wed, 7 Apr 2010, ram wrote: i need to created seperate user for this like s...@domain.com, is this correct. No, you don't _need_ a special user in your domain to catch spam for training. There are ways t

the dkim sigature is valid, but still triggered T_DKIM_INVALID in mail server

2010-04-08 Thread leeyc0
http://old.nabble.com/file/p28178215/dkim-failed.eml dkim-failed.eml I manage multiple mail servers, and recently decided to implement DKIM, but I met a very strange problem. I tried to send a DKIM-signed email to both @iwtek.net and @ieaa.org, as in the attachment (both mail servers are manage

Re: newbie for spam optimisation

2010-04-08 Thread Kai Schaetzl
Ram wrote on Thu, 8 Apr 2010 08:42:31 +0530: > But as per the document domain wide, there is no "domain wide", only sitewide. user need to create > and as the users to forward the spam mail to that user and learn. > > correct me if my understand wrong correction: s...@domain.com (please use ex