Re: rule for To: undisclosed-recipients:;

2010-10-24 Thread Cedric Knight
On 25/10/10 04:21, Dennis German wrote: > Is there? should there be a rule for a header like: > To: undisclosed-recipients:; There was a rule UNDISC_RECIPS in version 3.1, and it scored about 0.8 points. I don't know why it was removed; presumably it hit too much ham. It used to go: header UNDI

rule for To: undisclosed-recipients:;

2010-10-24 Thread Dennis German
Is there? should there be a rule for a header like: To: undisclosed-recipients:;

Re: compare 2 headers

2010-10-24 Thread Lawrence @ Rogers
On 24/10/2010 9:27 PM, Martin Gregorie wrote: On Sun, 2010-10-24 at 18:03 -0230, Lawrence @ Rogers wrote: On 24/10/2010 5:44 PM, Karsten Bräckelmann wrote: There are perfectly valid reasons to not have the actual recipient in the To header. Ever sent a message with Bcc recipients? Ever received

Re: compare 2 headers

2010-10-24 Thread Martin Gregorie
On Sun, 2010-10-24 at 18:03 -0230, Lawrence @ Rogers wrote: > On 24/10/2010 5:44 PM, Karsten Bräckelmann wrote: > > There are perfectly valid reasons to not have the actual recipient in > > the To header. Ever sent a message with Bcc recipients? Ever received a > > post via a mailing list? > > > >

Re: rule to catch subject spamming

2010-10-24 Thread Karsten Bräckelmann
On Sun, 2010-10-24 at 22:08 +0200, Karsten Bräckelmann wrote: > On Sun, 2010-10-24 at 16:05 -0230, Lawrence @ Rogers wrote: > > I have settled on the following as it's more specific and less prone to > > FPs (I can't think of any possibilities right now) > > > header __LOCAL_SUBJECT_SPAMMY Subje

Re: compare 2 headers

2010-10-24 Thread Lawrence @ Rogers
On 24/10/2010 5:44 PM, Karsten Bräckelmann wrote: On Sun, 2010-10-24 at 16:26 -0230, Lawrence @ Rogers wrote: Is there a quick way to compare 2 headers? I am seeing spam lately that has an invalid e-mail address (one not hosted by us) set in the To: header, but has the intended one in the Envelo

Re: compare 2 headers

2010-10-24 Thread Karsten Bräckelmann
On Sun, 2010-10-24 at 16:26 -0230, Lawrence @ Rogers wrote: > Is there a quick way to compare 2 headers? I am seeing spam lately that > has an invalid e-mail address (one not hosted by us) set in the To: > header, but has the intended one in the Envelope-To: header > > What I would like to do is

Re: rule to catch subject spamming

2010-10-24 Thread Karsten Bräckelmann
On Sun, 2010-10-24 at 16:05 -0230, Lawrence @ Rogers wrote: > I have settled on the following as it's more specific and less prone to > FPs (I can't think of any possibilities right now) > header __LOCAL_SUBJECT_SPAMMY Subject =~ /^[0-9a-zA-Z,.+]{42,}$/ > meta LOCAL_SUBJECT_SPAMMY1 ((__LOCAL_SU

compare 2 headers

2010-10-24 Thread Lawrence @ Rogers
Hi, Is there a quick way to compare 2 headers? I am seeing spam lately that has an invalid e-mail address (one not hosted by us) set in the To: header, but has the intended one in the Envelope-To: header What I would like to do is take the Envelope-To and run a regex to check if the To: head

Re: rule to catch subject spamming

2010-10-24 Thread Lawrence @ Rogers
On 23/10/2010 5:47 PM, RW wrote: On Sat, 23 Oct 2010 14:28:38 -0230 "Lawrence @ Rogers" wrote: Hello all, I noticed recently that our users are getting spam with the subject similar to the following: SehxpyNaturalRedheaddFayeReaganHasHerFirstLesbianExperienceWithBrunet I got some of these

Profiling rules with DProf problems

2010-10-24 Thread Cedric Knight
Hello I'm trying to get some performance data on a customised ruleset using the instructions at http://wiki.apache.org/spamassassin/ProfilingRulesWithDprof and have two problems. Firstly, I'm not actually getting any *_body_test or *_head_test data in tmon.out. Instead, after running dprofpp, al

Spammassassin is slow on poll_dns_idle and tests_pri_500 tests

2010-10-24 Thread escalera
Hello: Fol all messages, spamassassin takes 14++ seconds. Version: 3.3.1 (2010-03-16) Debuging it, the times are: Oct 24 14:03:20 email spamd[22477]: timing: total 14237 ms - read_scoreonly_config: 4 (0.0%), signal_user_changed: 6 (0.0%), parse: 6 (0.0%), extract_message_metadata: 80 (0.6%),