Re: Exchange 2013 and rejection of invalid RCPTs (was Re: one word spam (continued))

2013-10-16 Thread Jason Haar
On 17/10/13 09:03, Kevin A. McGrail wrote: > We've done similar real time checks using Sendmail but seen this > actually bring down Exchange Servers (more like bringing it to its > knees from a resource perspective than actually crashing it) from the > LDAP queries associated with these type of is

Re: one word spam (continued)

2013-10-16 Thread John Hardin
On Wed, 16 Oct 2013, Martin Gregorie wrote: On Wed, 2013-10-16 at 11:47 -0400, Bowie Bailey wrote: I'm not quite sure what you were intending to match. On more mature reflection, neither am I! I should have said: /^\s{0,80}\S{0,20}\s{0,80}$/ ...which matches /^$/, or any message having a

Re: Exchange 2013 and rejection of invalid RCPTs (was Re: one word spam (continued))

2013-10-16 Thread Kevin A. McGrail
On 10/16/2013 3:46 PM, David F. Skoll wrote: On Wed, 16 Oct 2013 15:41:04 -0400 "Kevin A. McGrail" wrote: So in the beginning for our issue, our firm implemented something similar and it's documented at http://www.pccc.com/downloads/ldap/ thanks primarily to Brian Landers and his work. This

Re: one word spam (continued)

2013-10-16 Thread Martin Gregorie
On Wed, 2013-10-16 at 11:47 -0400, Bowie Bailey wrote: > I'm not quite sure what you were intending to match. > On more mature reflection, neither am I! I should have said: /^\s{0,80}\S{0,20}\s{0,80}$/ which should catch messages of 20 characters or less. I was in a hurry (quite a bit of C to w

Re: Exchange 2013 and rejection of invalid RCPTs (was Re: one word spam (continued))

2013-10-16 Thread David F. Skoll
On Wed, 16 Oct 2013 15:41:04 -0400 "Kevin A. McGrail" wrote: > So in the beginning for our issue, our firm implemented something > similar and it's documented at http://www.pccc.com/downloads/ldap/ > thanks primarily to Brian Landers and his > work. This is a nice solution that uses LDAP an

Re: Exchange 2013 and rejection of invalid RCPTs (was Re: one word spam (continued))

2013-10-16 Thread Kevin A. McGrail
On 10/16/2013 2:27 PM, David F. Skoll wrote: I think this is a deliberate strategy on the part of Microsoft. I think they're making Exchange so complicated and such a PITA that people give up and go to the cloud, ideally to Office 365. For many small companies, going to the cloud probably makes

Re: Exchange 2013 and rejection of invalid RCPTs (was Re: one word spam (continued))

2013-10-16 Thread Joe Acquisto-j4
"David F. Skoll" 10/16/13 2:32 PM >>> >. . . .as long as they don't mind >paying extra and don't mind the NSA having access to their email. :) > >Regards, > >David. Of course you mean "easier access" . . . ? joe a.

Re: Exchange 2013 and rejection of invalid RCPTs (was Re: one word spam (continued))

2013-10-16 Thread David F. Skoll
On Wed, 16 Oct 2013 10:52:08 -0700 Ted Mittelstaedt wrote: > Just be aware that Microsoft's "standard" is to use LDAP queries to > the AD. True, and we support that. But not everyone wants to open up their LDAP to the outside world, even to a few outside IPs. Furthermore, if you use Office 365

Re: Exchange 2013 and rejection of invalid RCPTs (was Re: one word spam (continued))

2013-10-16 Thread Ted Mittelstaedt
Just be aware that Microsoft's "standard" is to use LDAP queries to the AD. Every major commercial antispam product does this and you will save yourself a lot of work later when MS changes the next version of Exchange to not support the 2525 hack. (which they could easily do) if you do it that

Re: Email in Russian not triggering UNWANTED_LANGUAGE_BODY

2013-10-16 Thread John Hardin
On Wed, 16 Oct 2013, Mauricio Tavares wrote: ) Email in question is at http://pastie.org/8403863; I put it there so it would not harm anyone with its HTTP-Posting-URI header. In my local.cf I have ok_languages en ok_locales en add_header all Languages _LANGUAGES_ And have textcat enabled

Re: one word spam (continued)

2013-10-16 Thread Ted Mittelstaedt
On 10/16/2013 9:42 AM, David F. Skoll wrote: On 16 Oct 2013 09:15:07 -0700 "Neil Schwartzman" wrote: List verification. Many receiving sites will block after X bounces, clean up your you mean "their" list list from 550s, and spam the real thing from another botted IP. And you know who

Exchange 2013 and rejection of invalid RCPTs (was Re: one word spam (continued))

2013-10-16 Thread David F. Skoll
On Wed, 16 Oct 2013 09:21:46 -0800 Kevin Miller wrote: > So if I'm reading this right, milters such as smf-sav or milter-ahead > will no longer be of any use? You are reading it correctly. On our anti-spam service, we require some sort of recipient validation so we don't go insane scanning mess

Re: one word spam (continued)

2013-10-16 Thread Axb
On 10/16/2013 07:21 PM, Kevin Miller wrote: So if I'm reading this right, milters such as smf-sav or milter-ahead will no longer be of any use? yep... One will have to be creative, start mantaining local rcpt list copies, LDAP exports, etc - lottsa fun for all parties. This also applies to

RE: one word spam (continued)

2013-10-16 Thread Kevin Miller
So if I'm reading this right, milters such as smf-sav or milter-ahead will no longer be of any use? ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux User No: 307357

Re: one word spam (continued)

2013-10-16 Thread Axb
On 10/16/2013 06:42 PM, David F. Skoll wrote: On 16 Oct 2013 09:15:07 -0700 "Neil Schwartzman" wrote: List verification. Many receiving sites will block after X bounces, clean up your list from 550s, and spam the real thing from another botted IP. And you know who we can thank [sic] for thi

Email in Russian not triggering UNWANTED_LANGUAGE_BODY

2013-10-16 Thread Mauricio Tavares
) Email in question is at http://pastie.org/8403863; I put it there so it would not harm anyone with its HTTP-Posting-URI header. In my local.cf I have ok_languages en ok_locales en add_header all Languages _LANGUAGES_ And have textcat enabled. Many emails, most recently in Chinese and Span

Re: one word spam (continued)

2013-10-16 Thread David F. Skoll
On 16 Oct 2013 09:15:07 -0700 "Neil Schwartzman" wrote: > List verification. Many receiving sites will block after X bounces, > clean up your list from 550s, and spam the real thing from another > botted IP. And you know who we can thank [sic] for this mechanism of list verification? Microsoft

Re: one word spam (continued)

2013-10-16 Thread Neil Schwartzman
List verification. Many receiving sites will block after X bounces, clean up your list from 550s, and spam the real thing from another botted IP. Neil Schwartzman Executive Director Coalition Against unsolicited Commercial Email Tel :(303) 800-6345 Mob: (415) 361-0069 @cauce On Oct 16, 2013

Re: one word spam (continued)

2013-10-16 Thread Axb
On 10/16/2013 04:58 PM, Marcio Humpris wrote: In reply to axb... about one word spam http://mail-archives.apache.org/mod_mbox/spamassassin-users/201308.mbox/browser here is the sample http://pastebin.com/download.php?i=0D7tfsjf Can you help with some regex pls? This has two words :) and no S

Re: one word spam (continued)

2013-10-16 Thread Bowie Bailey
On 10/16/2013 11:33 AM, Martin Gregorie wrote: On Wed, 2013-10-16 at 11:58 -0300, Marcio Humpris wrote: Hi everyone If I use digest mode how do I reply to a specific mail? In reply to axb... about one word spam http://mail-archives.apache.org/mod_mbox/spamassassin-users/201308.mbox/browser h

Re: one word spam (continued)

2013-10-16 Thread Martin Gregorie
On Wed, 2013-10-16 at 11:58 -0300, Marcio Humpris wrote: > Hi everyone > > If I use digest mode how do I reply to a specific mail? > > In reply to axb... > > about one word spam > http://mail-archives.apache.org/mod_mbox/spamassassin-users/201308.mbox/browser > > here is the sample http://paste

Re: one word spam (continued)

2013-10-16 Thread Ted Mittelstaedt
Dumb question here perhaps - how exactly would sending a single word to a victim help a spammer? Why would they do it? Ted On 10/16/2013 8:33 AM, Martin Gregorie wrote: On Wed, 2013-10-16 at 11:58 -0300, Marcio Humpris wrote: Hi everyone If I use digest mode how do I reply to a specific mai

one word spam (continued)

2013-10-16 Thread Marcio Humpris
Hi everyone If I use digest mode how do I reply to a specific mail? In reply to axb... about one word spam http://mail-archives.apache.org/mod_mbox/spamassassin-users/201308.mbox/browser here is the sample http://pastebin.com/download.php?i=0D7tfsjf Can you help with some regex pls? Tks

Re: FSL_HELO_BARE_IP_2 & RCVD_NUMERIC_HELO

2013-10-16 Thread Jonas Eckerman
>Operators of newsgroups which mirror/archive mailing >lists, and allow posting from a web interface, are adding forged >Received: headers before sending an email to the respective list >server. In what way are they forged? Do they contain addresses that doesn't match the system adding the receiv

Re: When/How to train bayes from user mail?

2013-10-16 Thread Tom Hendrikx
On 10/15/2013 09:03 PM, Florian Lindner wrote: > Am Dienstag, 15. Oktober 2013, 07:19:01 schrieb Andreas Schulze: >> Zitat von Florian Lindner : >>> Since we move our server (and upgrade from oldstabe to stable) I want to >>> reconsider how I organize mails serverside. >>> >>> Debian, MTA is postfi