It is a bit difficult to post to this list

2014-05-15 Thread James B. Byrne
I included the results of a find on URIBL_RHS_DOB together with the dig report on a newly registered spam domain and an extract from the whois report. All of which was to show that the domain was registered today and that the DOB service did not appear to have it listed as new. This is what I get

Re: Score Problem

2014-05-15 Thread John Hardin
On Wed, 14 May 2014, Bowie Bailey wrote: On 5/13/2014 6:55 PM, John Hardin wrote: On Tue, 13 May 2014, M. Rodrigo Monteiro wrote: > Below is my SA. > The problem is that the score is 0.0, but in the debug log has "got > hit". > What am I missing? Rules whose names begin with two unders

RE: SPAM from a registrar

2014-05-15 Thread Philippe Ratté
This is probably what you are looking for: http://wiki.apache.org/spamassassin/Rules/URIBL_RHS_DOB > -Message d'origine- > De : James B. Byrne [mailto:byrn...@harte-lyne.ca] > Envoyé : Wednesday, May 14, 2014 12:52 PM > À : users@spamassassin.apache.org > Objet : SPAM from a registrar >

Re: It is a bit difficult to post to this list

2014-05-15 Thread Kevin A. McGrail
On 5/14/2014 5:04 PM, James B. Byrne wrote: : host mx1.us.apache.org[140.211.11.136] said: 552 spam score (10.9) exceeded threshold (SPF_HELO_PASS,SPF_PASS,SPOOF_COM2OTH,URIBL_BLACK,URIBL_DBL_SPAM,URIBL_JP_SURBL (in reply to end of DATA command) Unfortunately discussing spam on em

Bayes refinement

2014-05-15 Thread James B. Byrne
Is there any way to limit Bayes content checking to only the first X characters of the message body? I ask this because it is clear that the spam messages getting through contain text meant to poison the tests but this gibberish always trails the main message and is separated by a large white spac

SPAM from a registrar

2014-05-15 Thread James B. Byrne
This AM we received (and are continuing to receive) numerous spam messages from multiple domains that were all registered today (2014-05-14) with a company called enom, inc. This firm is also the registrar for the the mail server domain BOSJAW.com that is ending some if not all of the UCEM. That