Re: White text on white background

2012-02-16 Thread Benny Pedersen
Den 2012-02-17 06:53, JP Kelly skrev: No didn't work. with --lint I got: warn: config: invalid regexp for rule HTML_TEXT_WHITE_SHORT: /style=\"color: missing or invalid delimiters ^^ On Feb 16, 2012, at 7:53 PM, Benny Pedersen wrote: Den 2012-02-17 02:12, JP Kelly skrev: How

Re: White text on white background

2012-02-16 Thread David B Funk
The '#' is a comment character, need to escape it. Try: rawbody HTML_TEXT_WHITE_SHORT /style="color\#FFF;/ On Thu, 16 Feb 2012, JP Kelly wrote: No didn't work. with --lint I got: warn: config: invalid regexp for rule HTML_TEXT_WHITE_SHORT: /style=\"color: missing or invalid delimiters O

Re: White text on white background

2012-02-16 Thread JP Kelly
No didn't work. with --lint I got: warn: config: invalid regexp for rule HTML_TEXT_WHITE_SHORT: /style=\"color: missing or invalid delimiters On Feb 16, 2012, at 7:53 PM, Benny Pedersen wrote: > Den 2012-02-17 02:12, JP Kelly skrev: > >> How do I implement this? > >>> rawbody HTML_TEXT_WHITE

Re: White text on white background

2012-02-16 Thread Benny Pedersen
Den 2012-02-17 02:12, JP Kelly skrev: How do I implement this? rawbody HTML_TEXT_WHITE_SHORT /style="color#FFF;/ add it to local.cf or user_prefs, its not tested here so it might not work at all it will score default 1.0 if no score is set

Re: White text on white background

2012-02-16 Thread JP Kelly
ok I'm a dummy. How do I implement this? On Feb 16, 2012, at 5:03 PM, John Hardin wrote: > rawbody HTML_TEXT_WHITE_SHORT /style="color#FFF;/

Re: Some rules I created for suspicious Javascript practices

2012-02-16 Thread neon_overload
Adam Katz-10 wrote: > > Thomas Rutter: If you have any objections to what I did, complain now. > That's fine. I have been hard at work on tweaking these rules and have come up with new versions which appear more effective. Have not spent much time on performance though. New version follows

Re: White text on white background

2012-02-16 Thread John Hardin
On Thu, 16 Feb 2012, JP Kelly wrote: I am getting a bunch of spam with white text on a white background. Any ideas how to catch it? Here is an example: At the risk of playing whack-a-mole: rawbody HTML_TEXT_WHITE_SHORT /style="color#FFF;/ The short color code is probably unlikely to

Re: SPF and DKIM tests by default?

2012-02-16 Thread email builder
> >> On 2/16/2012 4:54 PM, email builder wrote: >   but it's misconfigured trusted_networks and   internal_networks what causes SPF to misfire... >>>   Thank you sincerely for your help. I can only imagine that SPF >>> wouldn't >>> fire if I accidentally specified Google in one of

Re: SPF and DKIM tests by default?

2012-02-16 Thread email builder
> On 2/16/2012 4:54 PM, email builder wrote: >>> but it's misconfigured trusted_networks and >>> internal_networks what causes SPF to misfire... >> Thank you sincerely for your help. I can only imagine that SPF wouldn't >> fire if I accidentally specified Google in one of those settings or ha

Re: SPF and DKIM tests by default?

2012-02-16 Thread email builder
> > On 2/15/2012 7:08 PM, email builder wrote: >> OK, but: Q: Are there any default rules as supplied by sa-update that would >> prevent SPF rules from firing? > Not that I can think of. >> >> Q: Any other ideas on how to learn what rules are actually being used? > What I would likely do is s

Re: SPF and DKIM tests by default?

2012-02-16 Thread Bowie Bailey
On 2/16/2012 4:54 PM, email builder wrote: >> but it's misconfigured trusted_networks and >> internal_networks what causes SPF to misfire... > Thank you sincerely for your help. I can only imagine that SPF wouldn't fire > if I accidentally specified Google in one of those settings or had an error

Re: SPF and DKIM tests by default?

2012-02-16 Thread email builder
> >>> Q: Will some rules not fire if some condition exists based on other >>> rules? >>> >>> A: Correct.  There are plenty of rules that build on other rules.  We >>> call these >>> meta rules. >> >> Q: Are there any default rules as supplied by sa-update that would >> prevent SPF rules fr

Re: email address showing in recipients not on server

2012-02-16 Thread Dave Warren
On 2/16/2012 6:14 AM, Kevin A. McGrail wrote: Couldn't begin to tell you. This sounds like some sort of panel for hosting and is far outside of the SA project. I wonder if perhaps it's logging the TO field as though that has something to do with where the message will be delivered? -- Dave

Re: overriding rules

2012-02-16 Thread Kris Deugau
tagg...@riseup.net wrote: Hi SA users, In the past (3.2.5 or so) I used to be able to use local.cf to override rule settings like this, header __RCVD_IN_ZENeval:check_rbl('zen', 'zen.dnsbl.') header RCVD_IN_XBL eval:check_rbl('zen-lastexternal', 'zen

overriding rules

2012-02-16 Thread taggart
Hi SA users, In the past (3.2.5 or so) I used to be able to use local.cf to override rule settings like this, header __RCVD_IN_ZENeval:check_rbl('zen', 'zen.dnsbl.') header RCVD_IN_XBL eval:check_rbl('zen-lastexternal', 'zen.dnsbl.', '127.0.0.[45678]')

Re: Some rules I created for suspicious Javascript practices

2012-02-16 Thread Adam Katz
On 02/15/2012 04:43 PM, Thomas Rutter wrote (as neon_overload): > I have created some rules which I have found to be very effective so > far at identifying a certain type of spam that spamassassin > otherwises cannot detect. > I hereby license them under the WTFPL which is GPL and Apache license

Re: email address showing in recipients not on server

2012-02-16 Thread Kevin A. McGrail
On 2/16/2012 9:12 AM, netcapacity wrote: Without an example, your statements are not clear to me. Can you cut and paste what you saw? Regards, KAM I understand. On the server statistics I can see what email addresses are being used and filtered. Since this is a new installation I only ha

Re: email address showing in recipients not on server

2012-02-16 Thread netcapacity
> Without an example, your statements are not clear to me. Can you cut > and paste what you saw? > > Regards, > KAM > I understand. On the server statistics I can see what email addresses are being used and filtered. Since this is a new installation I only have 2 email addresses set up.

Re: email address showing in recipients not on server

2012-02-16 Thread Kevin A. McGrail
On 2/16/2012 6:44 AM, netcapacity wrote: While checking the stats on a new installation I looked at the recipients list. On the list was an email address that did not reside on my server. Where did it come from? What exactly is it? Any ideas of where it came from and any actions I need to take

Re: SPF and DKIM tests by default?

2012-02-16 Thread Kevin A. McGrail
On 2/15/2012 7:08 PM, email builder wrote: OK, but: Q: Are there any default rules as supplied by sa-update that would prevent SPF rules from firing? Not that I can think of. Q: Any other ideas on how to learn what rules are actually being used? What I would likely do is save the gmail message

email address showing in recipients not on server

2012-02-16 Thread netcapacity
While checking the stats on a new installation I looked at the recipients list. On the list was an email address that did not reside on my server. Where did it come from? What exactly is it? Any ideas of where it came from and any actions I need to take are appreciated. -- View this message

Re: warn: config: SpamAssassin failed to parse line, no value provided for "body", skipping: body

2012-02-16 Thread Simon Loewenthal
Hi Kevin McGrail, Was there any response on the dev list about this? I am not subscribed to it. I notice that RCVD_IN_MSPIKE_WL is listed in the updates: # find -exec grep MSPIKE_WL \{\} \; -ls meta RCVD_IN_MSPIKE_WLRCVD_IN_MSPIKE_H5 || RCVD_IN_MSPIKE_H4 || RCVD_IN_MSPIKE_H3 describ

Re: SPF and DKIM tests by default?

2012-02-16 Thread Matus UHLAR - fantomas
Q: Will some rules not fire if some condition exists based on other rules? A: Correct.  There are plenty of rules that build on other rules.  We call these meta rules. On 15.02.12 16:08, email builder wrote: Q: Are there any default rules as supplied by sa-update that would prevent SPF rules f

Re: whitelist_from_rcvd when rDNS fails

2012-02-16 Thread Matus UHLAR - fantomas
I need to whitelist a sender, and I typically use whitelist_from_rcvd, but it's not working in this case, and I suspect because rDNS fails:    Received: from ideascollide1.ablehost.com (unknown [208.81.177.83]) Is the next best approach to create a rule that deducts points or is there another wa