Re: Spam email many have RCVD_IN_DNSWL_MED

2011-10-11 Thread Jim Popovitch
On Wed, Oct 12, 2011 at 02:15, Alessio Cecchi wrote: > > Why Google name server returns an incorrect value? Because sometimes the Google name servers overload the upstream system and get blocked. The same thing happens if you use the Level 3 servers (4.2.2.x). You would be better served by ins

Re: Spam email many have RCVD_IN_DNSWL_MED

2011-10-11 Thread Alessio Cecchi
Il 11/10/2011 20:58, dar...@chaosreigns.com ha scritto: Thanks to John Hardin for noticing one of these was off. I should've checked them before replying. *None* of these should be hitting RCVD_IN_DNSWL_HI or RCVD_IN_DNSWL_MED, or even RCVD_IN_DNSWL_LOW. Alessio, you have a problem *other* tha

RE: Mail Rejects high Score

2011-10-11 Thread Varghese, Daniel
Hi Bowie, Thank you so much for the details. Forgot mention one important point in my previous mail, the rejection happens only when I use Yahoo mail. If I send the same mail using any other clients (Hotmail, Google, OL etc) the mail accepts as normal and everything work fine. So Can I assume

Re: Spam email many have RCVD_IN_DNSWL_MED

2011-10-11 Thread jdow
On 2011/10/11 12:30, Benny Pedersen wrote: On Tue, 11 Oct 2011 13:27:04 -0400, dar...@chaosreigns.com wrote: And I have my own IP reputation project that could use your data: http://www.chaosreigns.com/iprep/ shame on microsoft not letting me have ie9, shame on you not let me see your page as

Re: Increasing score based on membership to commercial whitelist

2011-10-11 Thread Kris Deugau
Michael Scheidell wrote: I have sent linkedin spam to returnpath, to their APPROVED reporting email address, which is certificat...@returnpath.net for almost two years. This spam had no remove links, no unsubscription information, and the only way to stop spam from the specific spammer who used l

Re: Spam email many have RCVD_IN_DNSWL_MED

2011-10-11 Thread darxus
On 10/11, Benny Pedersen wrote: > thanks for link, but it was more info from the above sender for why > bayes 99 is not good Oh, probably just because for some reason he isn't comfortable with increasing the score of the BAYES_99 rule. Although he'd be much better off figuring out why he's getti

Re: Spam email many have RCVD_IN_DNSWL_MED

2011-10-11 Thread Benny Pedersen
On Tue, 11 Oct 2011 15:24:54 -0400, dar...@chaosreigns.com wrote: On 10/11, Benny Pedersen wrote: >BAYES_99 can to nothing against this :-( eloborate on bayes please http://wiki.apache.org/spamassassin/BayesInSpamAssassin http://en.wikipedia.org/wiki/Bayesian_spam_filtering thanks for link

Re: Spam email many have RCVD_IN_DNSWL_MED

2011-10-11 Thread Benny Pedersen
On Tue, 11 Oct 2011 13:27:04 -0400, dar...@chaosreigns.com wrote: And I have my own IP reputation project that could use your data: http://www.chaosreigns.com/iprep/ shame on microsoft not letting me have ie9, shame on you not let me see your page as html 3.2

Re: Spam email many have RCVD_IN_DNSWL_MED

2011-10-11 Thread darxus
On 10/11, Benny Pedersen wrote: > >BAYES_99 can to nothing against this :-( > > eloborate on bayes please http://wiki.apache.org/spamassassin/BayesInSpamAssassin http://en.wikipedia.org/wiki/Bayesian_spam_filtering > http://www.dnswl.org/ see link abuse reporting > > when setup, do spamassassi

Re: Spam email many have RCVD_IN_DNSWL_MED

2011-10-11 Thread Benny Pedersen
On Tue, 11 Oct 2011 18:18:59 +0200, Alessio Cecchi wrote: I'm an italian user of spamassassin. During the last 3 weeks many spam email have rating cut down by the rules "RCVD_IN_DNSWL_MED". Also BAYES_99 can to nothing against this :-( eloborate on bayes please For now I solved the problem

Re: Blacklisting based on SPF

2011-10-11 Thread Benny Pedersen
On Tue, 11 Oct 2011 17:14:06 +0200, Matus UHLAR - fantomas wrote: (and possibly list of forwarders who do not rewrite mail from) breaks dkim, and instalations that use from: as envelope sender header ask for troubles

Re: Spam email many have RCVD_IN_DNSWL_MED

2011-10-11 Thread darxus
Thanks to John Hardin for noticing one of these was off. I should've checked them before replying. *None* of these should be hitting RCVD_IN_DNSWL_HI or RCVD_IN_DNSWL_MED, or even RCVD_IN_DNSWL_LOW. Alessio, you have a problem *other* than the data listed by dnswl.org. Start with the X-Spam-Rela

RE: How to create spam score list for sample email messages

2011-10-11 Thread Martin Gregorie
On Tue, 2011-10-11 at 15:37 +, Sharma, Ashish wrote: > Martin, > > Your testing strategy of spamassassin is interesting to emulate and I > have following queries: > > Following are the plugins that get loaded in my spamassassin: > > SpamAssassin loaded plugins: AutoLearnThreshold, Bayes, Bod

Re: Blacklisting based on SPF

2011-10-11 Thread Benny Pedersen
On Tue, 11 Oct 2011 15:49:36 +0200, Matus UHLAR - fantomas wrote: such forwarding will break SPF iff the forwarder does not change the mail from: address, and in such case it FAKES the return path, since it's not the original sender who sent the mail, it's the recipient. it breaks dkim if anyth

Re: Spam email many have RCVD_IN_DNSWL_MED

2011-10-11 Thread darxus
On 10/11, John Hardin wrote: > On Tue, 11 Oct 2011, Alessio Cecchi wrote: > >Received: from nm14.bullet.mail.sp2.yahoo.com > >(nm14.bullet.mail.sp2.yahoo.com [98.139.91.84]) > > by www-mydomain.myserver.net (Postfix) with SMTP id 8889762AB1 > > for ; Tue, 11 Oct 2011 15:44:22 +0200 (CEST)

Re: Spam email many have RCVD_IN_DNSWL_MED

2011-10-11 Thread Andrzej Adam Filip
Alessio Cecchi wrote: > I'm an italian user of spamassassin. During the last 3 weeks many spam > email have rating cut down by the rules "RCVD_IN_DNSWL_MED". Also > BAYES_99 can to nothing against this :-( > > For now I solved the problem by disable this check, but is a common > problems for many

Re: Spam email many have RCVD_IN_DNSWL_MED

2011-10-11 Thread Michael Scheidell
On 10/11/11 1:47 PM, John Hardin wrote: Yahoo is in RCVD_IN_DNSWL_HI ?!?! YGBFKM! there goes the neighborhood. I am removing RCVD_IN_DNSWL_HI checks on our servers right now. -- Michael Scheidell, CTO o: 561-999-5000 d: 561-948-2259 >*| *SECNAP Network Security Corporation * Best Mobile S

Re: Spam email many have RCVD_IN_DNSWL_MED

2011-10-11 Thread Michael Scheidell
On 10/11/11 1:27 PM, dar...@chaosreigns.com wrote: On 10/11, Alessio Cecchi wrote: 403 Forbidden Forbidden You don't have permission to access /dnswl/dl/DNSWLh.pm on this server. Apache/2.2.14 (Ubuntu) Server at www.chaosreigns.com Port 80 http://www.chaosreigns.com/dnswl/sa_plugin/ And I

Re: Spam email many have RCVD_IN_DNSWL_MED

2011-10-11 Thread John Hardin
On Tue, 11 Oct 2011, Alessio Cecchi wrote: Return-Path: X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on www-mydomain.myserver.net X-Spam-Level: * X-Spam-Status: No, score=1.8 required=5.0 tests=ADVANCE_FEE_3_NEW,BAYES_99, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,FREEMAIL

Re: Spam email many have RCVD_IN_DNSWL_MED

2011-10-11 Thread RW
On Tue, 11 Oct 2011 12:28:53 -0400 Michael Scheidell wrote: > On 10/11/11 12:18 PM, Alessio Cecchi wrote: > > I'm an italian user of spamassassin. During the last 3 weeks many > > spam email have rating cut down by the rules "RCVD_IN_DNSWL_MED". > > Also BAYES_99 can to nothing against this :-( >

Re: Spam email many have RCVD_IN_DNSWL_MED

2011-10-11 Thread darxus
On 10/11, Alessio Cecchi wrote: > I'm an italian user of spamassassin. During the last 3 weeks many > spam email have rating cut down by the rules "RCVD_IN_DNSWL_MED". > Also BAYES_99 can to nothing against this :-( > > For now I solved the problem by disable this check, but is a common > problems

Re: Spam email many have RCVD_IN_DNSWL_HI (was MED)

2011-10-11 Thread Alessio Cecchi
Il 11/10/2011 18:28, Michael Scheidell ha scritto: On 10/11/11 12:18 PM, Alessio Cecchi wrote: I'm an italian user of spamassassin. During the last 3 weeks many spam email have rating cut down by the rules "RCVD_IN_DNSWL_MED". Also BAYES_99 can to nothing against this :-( college.. new year, ne

Re: Spam email many have RCVD_IN_DNSWL_MED

2011-10-11 Thread Michael Scheidell
On 10/11/11 12:18 PM, Alessio Cecchi wrote: I'm an italian user of spamassassin. During the last 3 weeks many spam email have rating cut down by the rules "RCVD_IN_DNSWL_MED". Also BAYES_99 can to nothing against this :-( college.. new year, new students, new computers, new worms. as the old s

Spam email many have RCVD_IN_DNSWL_MED

2011-10-11 Thread Alessio Cecchi
Hi, I'm an italian user of spamassassin. During the last 3 weeks many spam email have rating cut down by the rules "RCVD_IN_DNSWL_MED". Also BAYES_99 can to nothing against this :-( For now I solved the problem by disable this check, but is a common problems for many italian users. How we

RE: How to create spam score list for sample email messages

2011-10-11 Thread Sharma, Ashish
Martin, Your testing strategy of spamassassin is interesting to emulate and I have following queries: Following are the plugins that get loaded in my spamassassin: SpamAssassin loaded plugins: AutoLearnThreshold, Bayes, BodyEval, Check, DKIM, DNSEval, FreeMail, FuzzyOcr, HTMLEval, HTTPSMismatc

Re: Blacklisting based on SPF

2011-10-11 Thread Matus UHLAR - fantomas
On 05.10.11 11:01, Julian Yap wrote: I've noticed some trojans with addresses from usps.com slip through. Does anyone blacklist based on SPF? According to SPF definition, all mail that fails SPF check, is forged and therefore it should be rejected (in case of FAIL result), or very carefully

Re: Increasing score based on membership to commercial whitelist

2011-10-11 Thread Michael Scheidell
On 10/11/11 8:55 AM, Greg Troxel wrote: To returnpath's credit, it appears that the addresses linkedin uses to send invitation spam to mailinglists have been delisted - but this should have happened within a few business days of the first complaint. I have sent linkedin spam to returnpath, t

Re: Mail Rejects high Score

2011-10-11 Thread Bowie Bailey
On 10/11/2011 7:38 AM, Varghese, Daniel wrote: > Hi Guys, > > One of the email gets rejected due to high spam score, Following are > the spam score details, Can someone in the group help me to understand > the results? > > [BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, > DKIM_VALID_

Re: Blacklisting based on SPF

2011-10-11 Thread Matus UHLAR - fantomas
On 7 Oct 2011 00:28:49 -, John Levine wrote: Nobody with any interest in delivering the mail that their users want. The error rate is much, much too high. On 10/7/2011 12:50 AM, Benny Pedersen wrote: how ? On 10.10.11 07:00, Marc Perkel wrote: All forwarded email would fail SPF testing.

Re: Increasing score based on membership to commercial whitelist

2011-10-11 Thread Greg Troxel
Most of my experience receiving "certified spam" has been with returnpath. It's still too hard to find how to report abuse (it's not a prominent link on the returnpath.net), and reporting spam that they've certified has been only somewhat satisfactory - a few places have been delisted, but not pr

Mail Rejects high Score

2011-10-11 Thread Varghese, Daniel
Hi Guys, One of the email gets rejected due to high spam score, Following are the spam score details, Can someone in the group help me to understand the results? [BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FUZZY_CREDIT=1.678, HK_RAN

Re: DOS_OE_TO_MX rule and trusted_networks

2011-10-11 Thread Benny Pedersen
On Tue, 11 Oct 2011 07:37:53 +0200 (CEST), Tomas Macek wrote: [snip] No, there is not ALL_TRUSTED in the headers. I'm sorry, I did not write here the rules that matched the message, so here it is: X-Spam-Status: Yes, score=5.988 tagged_above=3 required=5 tests=[DOS_OE_TO_MX=3.086, FSL_H