Re: Potentially useful rule?

2013-08-13 Thread Dave Warren
On 2013-08-13 14:25, David F. Skoll wrote: I'm seeing a fair bit of spam from the null return path. That is, MAIL From:<> (or in the headers, Return-Path: <>). A lot of this spam lacks any MIME headers (MIME-Version:, Content-Type:) I've experimented with a rule that adds points in this situat

Re: Potentially useful rule?

2013-08-13 Thread Kevin A. McGrail
On 8/13/2013 5:25 PM, David F. Skoll wrote: Hi, I'm seeing a fair bit of spam from the null return path. That is, MAIL From:<> (or in the headers, Return-Path: <>). A lot of this spam lacks any MIME headers (MIME-Version:, Content-Type:) I've experimented with a rule that adds points in this

Potentially useful rule?

2013-08-13 Thread David F. Skoll
Hi, I'm seeing a fair bit of spam from the null return path. That is, MAIL From:<> (or in the headers, Return-Path: <>). A lot of this spam lacks any MIME headers (MIME-Version:, Content-Type:) I've experimented with a rule that adds points in this situation; most legitimate DSNs have a MIME-Ve

Re: SA Bugzilla – Bug 6558

2013-08-13 Thread Simon Loewenthal
Great. Thanks Anthony. -- as silly as fun simon@klunky / .co.uk / .net pgp 4BA78604 Antony Stone wrote: >On Tuesday 13 August 2013 at 17:17, Simon Loewenthal wrote: > >> Hi, >> >> Did this make it into 3.3.2? ( e.g mended ) >> >> https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6558 >

Re: SA Bugzilla – Bug 6558

2013-08-13 Thread Antony Stone
On Tuesday 13 August 2013 at 17:17, Simon Loewenthal wrote: > Hi, > > Did this make it into 3.3.2? ( e.g mended ) > > https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6558 Yes, according to http://svn.apache.org/repos/asf/spamassassin/branches/3.3/build/announcements/3.3.2.txt Regards

SA Bugzilla – Bug 6558

2013-08-13 Thread Simon Loewenthal
Hi, Did this make it into 3.3.2? ( e.g mended ) https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6558 Cheers, S

Re: Malformed envelope-from triggering RP_MATCHES_RCVD

2013-08-13 Thread Adrian Gruntkowski
W dniu 13.08.2013 15:00, RW pisze: On Tue, 13 Aug 2013 08:38:50 -0400 Alex wrote: Hi, Recently I got a pump-and-dump spam that got through because of a significant score amount being subtracted by matching the RP_MATCHES_RCVD rule. Many of us have reduced that rule to a very low score for th

Re: Malformed envelope-from triggering RP_MATCHES_RCVD

2013-08-13 Thread RW
On Tue, 13 Aug 2013 08:38:50 -0400 Alex wrote: > Hi, > > > Recently I got a pump-and-dump spam that got through because of a > > significant > > score amount being subtracted by matching the RP_MATCHES_RCVD rule. > > Many of us have reduced that rule to a very low score for this reason. > Too ma

Re: Malformed envelope-from triggering RP_MATCHES_RCVD

2013-08-13 Thread Alex
Hi, > Recently I got a pump-and-dump spam that got through because of a > significant > score amount being subtracted by matching the RP_MATCHES_RCVD rule. Many of us have reduced that rule to a very low score for this reason. Too many legitimate mail servers lack a proper rDNS. score RP_MATCHES

Malformed envelope-from triggering RP_MATCHES_RCVD

2013-08-13 Thread Adrian Gruntkowski
Hello, Recently I got a pump-and-dump spam that got through because of a significant score amount being subtracted by matching the RP_MATCHES_RCVD rule. When investigating the headers, I've observed the following: ... Received: from unknown (HELO localhost) (ed...@hiwaay.net@223.229.72.179)