Re: DNSWL rules downscoring spam

2011-02-20 Thread Matthias Leisi
On Sun, Feb 20, 2011 at 7:51 PM, Warren Togami Jr. wrote: > Matthias, we really need a method to auto-report violations of DNSWL. My > spam traps receive dozens or more every week. At what score? Any noteworthy patterns? > But I don't have time to file > a web form every time it happens. The H

Re: DNSWL rules downscoring spam

2011-02-20 Thread Matthias Leisi
On Sun, Feb 20, 2011 at 8:11 PM, Michelle Konzack wrote: >> Looking at my spam folder, I have received roughly 550 spam emails >> to my email account since last tuesday (15th). Out of those 550, >> *345* have been downscored by RCVD_IN_DNSWL_MED. Annoyingly, a This issue has been resolved (missi

Re: DNSWL rules downscoring spam

2011-02-20 Thread Warren Togami Jr.
On 2/20/2011 9:11 AM, Michelle Konzack wrote: Hello Pasi Hirvonen, Am 2011-02-20 17:22:23, hacktest Du folgendes herunter: Hello, I just recently moved our mail setup to new hardware and I've been paying close attention to what gets marked as spam and what doesn't. Looking at my spam folder,

Re: DNSWL rules downscoring spam [DNSWL reporting automation]

2011-02-20 Thread Andrzej Adam Filip
"Warren Togami Jr." wrote: > On 2/20/2011 6:21 AM, Matthias Leisi wrote: >> On Sun, Feb 20, 2011 at 4:22 PM, Pasi Hirvonen wrote: >>> Hello, >>> >>> I just recently moved our mail setup to new hardware and I've been >>> paying close attention to what gets marked as spam and what >>> doesn't. >>>

Re: DNSWL rules downscoring spam

2011-02-20 Thread Warren Togami Jr.
On 2/20/2011 6:31 AM, dar...@chaosreigns.com wrote: I know of no reason it would be a temporary hiccup, but it is certainly unusual. According to spamassassin's mass checks, 0.89% of spam hits RCVD_IN_DNSWL_MED: http://www.chaosreigns.com/dnswl/ The masscheck results are a bit misleading, ov

Re: DNSWL rules downscoring spam

2011-02-20 Thread Michelle Konzack
Hello Pasi Hirvonen, Am 2011-02-20 17:22:23, hacktest Du folgendes herunter: > Hello, > > I just recently moved our mail setup to new hardware and I've been > paying close attention to what gets marked as spam and what > doesn't. > > Looking at my spam folder, I have received roughly 550 spam em

Re: SHURT_URL_RULES fails

2011-02-20 Thread Jari Fredriksson
On 20.2.2011 19:50, Karsten Br�ckelmann wrote: >> Oh. The problem is the folder. Should be /etc/mail/spamassassin, which >> contains totally different file set. Fixed, and now linting the numerous >> issues... > > I suggest making one a symlink of the other, since you seem to be used > to the Debi

Re: DNSWL rules downscoring spam

2011-02-20 Thread Warren Togami Jr.
On 2/20/2011 6:21 AM, Matthias Leisi wrote: On Sun, Feb 20, 2011 at 4:22 PM, Pasi Hirvonen wrote: Hello, I just recently moved our mail setup to new hardware and I've been paying close attention to what gets marked as spam and what doesn't. Looking at my spam folder, I have received roughly 5

Re: SHURT_URL_RULES fails

2011-02-20 Thread Karsten Bräckelmann
On Sun, 2011-02-20 at 19:38 +0200, Jari Fredriksson wrote: > On 20.2.2011 19:16, Karsten Bräckelmann wrote: > > > Hello. I reinstalled my machine, and reinstalled SA 3.3.1 from CPAN > > > (this is still a Debian Lenny machine, and 3.3.1 not available via > > > package repo. > > The DecodeShortURL

Re: SHURT_URL_RULES fails

2011-02-20 Thread Jari Fredriksson
On 20.2.2011 19:16, Karsten Bräckelmann wrote: > On Sun, 2011-02-20 at 17:29 +0200, Jari Fredriksson wrote: >> Hello. I reinstalled my machine, and reinstalled SA 3.3.1 from CPAN >> (this is still a Debian Lenny machine, and 3.3.1 not available via >> package repo. >> >> Errors in logs now: >> >> c

Re: Tonns of russian DOT info spam

2011-02-20 Thread Karsten Bräckelmann
On Sun, 2011-02-20 at 17:22 +0100, Michelle Konzack wrote: > > uri__TD_DOT_INFO m'^http://[^/]*\.info[/:?#]'i > > The "uri" line give an error Yes. Read the full thread. > > Check the SA rules it hits and add them as dependencies to that meta if > > you want to increase the score; if it pre

Re: SHURT_URL_RULES fails

2011-02-20 Thread Karsten Bräckelmann
On Sun, 2011-02-20 at 17:29 +0200, Jari Fredriksson wrote: > Hello. I reinstalled my machine, and reinstalled SA 3.3.1 from CPAN > (this is still a Debian Lenny machine, and 3.3.1 not available via > package repo. > > Errors in logs now: > > check[11271]: rules: failed to run HAS_SHORT_URL test,

Re: Comma at end of To:

2011-02-20 Thread Benny Pedersen
On Sun, 20 Feb 2011 16:24:58 +, Ned Slider wrote: > http://pastebin.com/sXbLXFW5 > I don't see any references to roundcube. received http

Re: DNSWL rules downscoring spam

2011-02-20 Thread Pasi Hirvonen
On 20/02/11 11:31 -0500, dar...@chaosreigns.com wrote: > I'm a DNSWL admin. I would like to see full examples (well, headers). I sent you and Matthias some headers to look at. > What IP addresses are being looked up in DNSWL? > > It's possible you don't have trusted_networks and internal_networ

Re: Comma at end of To:

2011-02-20 Thread John Hardin
On Sun, 20 Feb 2011, Ned Slider wrote: Here's a quick and dirty rule: header NSL_TO_ENDS_COMMA To =~ /,$/ describeNSL_TO_ENDS_COMMA To: ends with a comma score NSL_TO_ENDS_COMMA 0.001 Added to sandbox. -- John Hard

Re: DNSWL rules downscoring spam

2011-02-20 Thread Darxus
I'm a DNSWL admin. I would like to see full examples (well, headers). What IP addresses are being looked up in DNSWL? It's possible you don't have trusted_networks and internal_networks configured correctly, resulting in looking up an IP address belonging to your ISP or another mail server which

Re: Tonns of russian DOT info spam

2011-02-20 Thread Michelle Konzack
Hello Adam Katz, Am 2011-02-18 14:04:59, hacktest Du folgendes herunter: > And thank goodness for that, your rule is WAY too broad to be useful > as it blocks the ENTIRE .info top-level domain (a very bad idea). If you get per day arround 2000 of them it IS useful. > If you really want to do

Re: Comma at end of To:

2011-02-20 Thread Ned Slider
On 20/02/11 15:49, Benny Pedersen wrote: On Sun, 20 Feb 2011 15:42:23 +, Ned Slider wrote: Does anyone else see this? one or more versions of roundcube make this, is it roundcube in your samples ? Not sure, here's a sample: http://pastebin.com/sXbLXFW5 I don't see any references t

Re: DNSWL rules downscoring spam

2011-02-20 Thread Matthias Leisi
On Sun, Feb 20, 2011 at 4:22 PM, Pasi Hirvonen wrote: > Hello, > > I just recently moved our mail setup to new hardware and I've been > paying close attention to what gets marked as spam and what > doesn't. > > Looking at my spam folder, I have received roughly 550 spam emails > to my email accoun

Re: Comma at end of To:

2011-02-20 Thread Benny Pedersen
On Sun, 20 Feb 2011 15:42:23 +, Ned Slider wrote: > Does anyone else see this? one or more versions of roundcube make this, is it roundcube in your samples ?

Comma at end of To:

2011-02-20 Thread Ned Slider
Hi List, I noticed in a spam mail today the To: line ended in a comma: To: u...@example.com, and always being on the lookout for potential new rules decided to investigate. Grepping my spam archive I see a small number of matches, but I can't find any examples in ham. Here's a quick and d

Re: DNSWL rules downscoring spam

2011-02-20 Thread Benny Pedersen
On Sun, 20 Feb 2011 17:22:23 +0200, Pasi Hirvonen wrote: > I'm thinking of not bothering with DNSWL tests anymore unless > someone convinces me this is a temporary hiccup. What are your > experiences? report them on dnswl, http://www.dnswl.org/search.pl what dnswl id ?

SHURT_URL_RULES fails

2011-02-20 Thread Jari Fredriksson
Hello. I reinstalled my machine, and reinstalled SA 3.3.1 from CPAN (this is still a Debian Lenny machine, and 3.3.1 not available via package repo. Errors in logs now: check[11271]: rules: failed to run HAS_SHORT_URL test, skipping: check[11271]: (Can't locate object method "short_url_tests" v

DNSWL rules downscoring spam

2011-02-20 Thread Pasi Hirvonen
Hello, I just recently moved our mail setup to new hardware and I've been paying close attention to what gets marked as spam and what doesn't. Looking at my spam folder, I have received roughly 550 spam emails to my email account since last tuesday (15th). Out of those 550, *345* have been downsc