Re: Bad Helo Host impersonating

2011-03-22 Thread John Hardin
On Tue, 22 Mar 2011, jon1234 wrote: From where do they get that bounce message? From a host internal to your network or from hosts out on the Internet? The bounce message is only when they send certain domains that are external to our network. Shall I assume you meant to say "send _to_ certa

Re: BUG : all messages rule RP_8BIT

2011-03-22 Thread jdow
On 2011/03/22 14:48, Lawrence @ Rogers wrote: On 22/03/2011 7:02 PM, Bagnoud Thierry [ezwww.ch] wrote: until 21 mars 2011 after the normal cron.daily/update_spamassassin, Spamassassin report all messages with the rule RP_8BIT header RP_8BIT Return-Path:raw =~ /[^\000-\177]/ describe RP_8BIT Re

Re: Bad Helo Host impersonating

2011-03-22 Thread jon1234
>From where do they get that bounce message? From a host internal to your >network or from hosts out on the Internet? The bounce message is only when they send certain domains that are external to our network. > >If that's coming from an internal MTA, I'd suggest that MTA doesn't >believe you

Re: username in from address

2011-03-22 Thread Ted Mittelstaedt
On 3/22/2011 2:31 PM, Adam Katz wrote: On 3/22/2011 1:16 PM, Mark Chaney wrote: Ever notice that a lot of spam seems to have your username in their from address? Such as an email sent TO b...@domain.com is FROM blah...@anotherdomain.com (notice 'blah' included in the from address). This appears

Re: BUG : all messages rule RP_8BIT

2011-03-22 Thread René Berber
On 3/22/2011 6:43 PM, Steve Freegard wrote: > I've been hit by this issue; it's nothing to do with the rule misfiring > - it's more of a conceptual issue of how MailScanner works e.g. by > taking the queue file and moving it from an inbound to and outbound > spool and then forcing a delivery. > >

Re: Bad Helo Host impersonating

2011-03-22 Thread John Hardin
On Tue, 22 Mar 2011, jon1234 wrote: Hey Guys, I'm fairly new to this spamassassin lark as I've just taken a new job so please bear with me if my question is unrelated. In a nutshell when my exchange users try to send to certain domains they get the following bounce message. From where do t

Re: BUG : all messages rule RP_8BIT

2011-03-22 Thread Steve Freegard
On 22/03/11 23:28, Lawrence @ Rogers wrote: Something is definitely off. We use SA with MailScanner, and that rule never hits anything (less than 1 or 2 messages in several thousand). My guess would be that you aren't using MailScanner with Sendmail whereas the original poster is. I've been

Re: BUG : all messages rule RP_8BIT

2011-03-22 Thread Lawrence @ Rogers
On 22/03/2011 7:21 PM, Bagnoud Thierry [ezwww.ch] wrote: oups, since 21 mars and not until 21 mars, excuse me bad english :-) the modification from the rule on 2011-03-21 -header RP_8BITReturn-Path =~ /[^\000-\177]/ +header RP_8BITReturn-Path:raw =~ /[^\000-\177]/ http://svn.apache

Bad Helo Host impersonating

2011-03-22 Thread jon1234
Hey Guys, I'm fairly new to this spamassassin lark as I've just taken a new job so please bear with me if my question is unrelated. In a nutshell when my exchange users try to send to certain domains they get the following bounce message. I do have spam assassin installed but it was setup by

Re: BUG : all messages rule RP_8BIT

2011-03-22 Thread Bagnoud Thierry [ezwww.ch]
oups, since 21 mars and not until 21 mars, excuse me bad english :-) the modification from the rule on 2011-03-21 -header RP_8BIT Return-Path =~ /[^\000-\177]/ +header RP_8BIT Return-Path:raw =~ /[^\000-\177]/ http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/mmart

Re: BUG : all messages rule RP_8BIT

2011-03-22 Thread Lawrence @ Rogers
On 22/03/2011 7:02 PM, Bagnoud Thierry [ezwww.ch] wrote: until 21 mars 2011 after the normal cron.daily/update_spamassassin, Spamassassin report all messages with the rule RP_8BIT header RP_8BIT Return-Path:raw =~ /[^\000-\177]/ describe RP_8BIT Return-Path contains 8-bit characters with high

Re: BUG : all messages rule RP_8BIT

2011-03-22 Thread Michael Scheidell
On 3/22/11 5:32 PM, Bagnoud Thierry [ezwww.ch] wrote: hi, until 21 mars 2011 after the normal cron.daily/update_spamassassin, Spamassassin report all messages with the rule RP_8BIT I don't see this on any inbound email. what are you saying? you want the rule to be changed to the below? I do

BUG : all messages rule RP_8BIT

2011-03-22 Thread Bagnoud Thierry [ezwww.ch]
hi, until 21 mars 2011 after the normal cron.daily/update_spamassassin, Spamassassin report all messages with the rule RP_8BIT header RP_8BIT Return-Path:raw =~ /[^\000-\177]/ describe RP_8BIT Return-Path contains 8-bit characters with high bit on score RP_8BIT 2.8 Thanks to correct this rule

Re: username in from address

2011-03-22 Thread Adam Katz
> On 3/22/2011 1:16 PM, Mark Chaney wrote: >> Ever notice that a lot of spam seems to have your username in their >> from address? Such as an email sent TO b...@domain.com is FROM >> blah...@anotherdomain.com (notice 'blah' included in the from >> address). This appears to be the case with a large

Re: username in from address

2011-03-22 Thread Ted Mittelstaedt
If this sort of thing bothers you then simply use a unique or close to unique username and then put a filter in your e-mail client. send mail from: markymarkythefunkyd...@northpole.com and your guaranteed that anyone mailing you with "markymarkthefunkydude" in any part of their sending e-mail a

[Q] Best practice : spamass-milter headers for SA post-processing

2011-03-22 Thread JKL
Hi, I have spamass-milter as an SMTP milter on the front end of postfix. Spamc for post-processing. For quite a while, I had the spamass-milter on the front-end, and then postfix passes it to spamc for processing, and then the result is passed to Dovecot for delivery. I see that the milter

Re: TAB_IN_FROM from g...@vger.kernel.org

2011-03-22 Thread Greg Troxel
Adam Katz writes: > On 03/22/2011 12:58 PM, Greg Troxel wrote: >> I've been noticing that mail from g...@vger.kernel.org is getting lots >> of points, and this seems like a recent change. Specifically, these >> rules are hitting on almost all messages: >> >> * 0.1 KB_DATE_CONTAINS_TAB

username in from address

2011-03-22 Thread Mark Chaney
Ever notice that a lot of spam seems to have your username in their from address? Such as an email sent TO b...@domain.com is FROM blah...@anotherdomain.com (notice 'blah' included in the from address). This appears to be the case with a large a majority of the spam that gets through my filters

Re: TAB_IN_FROM from g...@vger.kernel.org

2011-03-22 Thread Adam Katz
On 03/22/2011 12:58 PM, Greg Troxel wrote: > I've been noticing that mail from g...@vger.kernel.org is getting lots > of points, and this seems like a recent change. Specifically, these > rules are hitting on almost all messages: > > * 0.1 KB_DATE_CONTAINS_TAB KB_DATE_CONTAINS_TAB >

TAB_IN_FROM from g...@vger.kernel.org

2011-03-22 Thread Greg Troxel
I've been noticing that mail from g...@vger.kernel.org is getting lots of points, and this seems like a recent change. Specifically, these rules are hitting on almost all messages: * 0.1 KB_DATE_CONTAINS_TAB KB_DATE_CONTAINS_TAB * 3.8 TAB_IN_FROM From starts with a tab Looking

Rule Updates – Emergency Fix is OUT

2011-03-22 Thread Karsten Bräckelmann
Just a quick note to spread the word... A new rule updates tarball (1083703) for all 3.3.x versions has been pushed manually by Daryl, about 16 hours ago. The new rules tarball includes the fix of meta-ing out, zeroing the affected sub-rules (see bug 6558 comment 3 [1]) causing an issue with re2