Re: sa-learn strip last Received: header for own MDA

2014-09-19 Thread LuKreme
On 19 Sep 2014, at 09:06 , Marcus Schopen wrote: > still playing with sa-learn. If I feed sa-learn do I have to strip the > last Received: header which is the Received header for my own MDA > (imap-backend) before piping the message into sa-learn? All you need to do is make sure that you feed bot

Re: New TLDs, time to update RegistrarBoundaries

2014-09-19 Thread Axb
On 09/19/2014 10:23 PM, David B Funk wrote: Seeing spam with URLs in new TLDs, (EG "blah.link") time to update RegistrarBoundaries. If this silly chase continues at this rate, is it worth trying to come up with some other method of doing that job? http://svn.apache.org/repos/asf/spamassassin

Re: New TLDs, time to update RegistrarBoundaries

2014-09-19 Thread Kevin A. McGrail
On 9/19/2014 4:23 PM, David B Funk wrote: Seeing spam with URLs in new TLDs, (EG "blah.link") time to update RegistrarBoundaries. If this silly chase continues at this rate, is it worth trying to come up with some other method of doing that job? We are working on solutions expected for the 3.4

New TLDs, time to update RegistrarBoundaries

2014-09-19 Thread David B Funk
Seeing spam with URLs in new TLDs, (EG "blah.link") time to update RegistrarBoundaries. If this silly chase continues at this rate, is it worth trying to come up with some other method of doing that job? -- Dave Funk University of Iowa College of Engine

Re: spamassassin rule to combat phishing

2014-09-19 Thread francis picabia
On Tue, Sep 16, 2014 at 5:27 PM, John Hardin wrote: > On Tue, 16 Sep 2014, francis picabia wrote: > > Hello, >> >> We just received the most authentic looking phishing I've seen. It was >> professionally written, included a nice signature in the style used by >> people at my workplace, and the t

Spamhaus timeouts -- are they being DDoSed again?

2014-09-19 Thread Justin Edmands
I caught wind from a post on ddos-protection.org that Spamhaus is getting DDoS attacked again. We are getting timeouts to spamhaus servers intermittently. One test scan will work properly with no timeouts, the next will say "deadline shrunk", then "the calling callback/abort on key" and spam will f

Re: sa-learn strip last Received: header for own MDA

2014-09-19 Thread John Hardin
On Fri, 19 Sep 2014, Marcus Schopen wrote: still playing with sa-learn. If I feed sa-learn do I have to strip the last Received: header which is the Received header for my own MDA (imap-backend) before piping the message into sa-learn? No, that shouldn't matter. The common bits will be learned

sa-learn strip last Received: header for own MDA

2014-09-19 Thread Marcus Schopen
Hi, still playing with sa-learn. If I feed sa-learn do I have to strip the last Received: header which is the Received header for my own MDA (imap-backend) before piping the message into sa-learn? Return-Path: --- strip this header? --> Received: from mxrelay.mysendmail.com (mxr

Re: "more_spam_from" like "more_spam_to"

2014-09-19 Thread Reindl Harald
Am 19.09.2014 um 14:42 schrieb Martin Gregorie: > On Fri, 2014-09-19 at 13:47 +0200, Reindl Harald wrote: >>> Most DNSBL tests are done on the last relay into the internal network. >>> >>> I'm not say this should be done, I'm saying that it's one reason why >>> scanning mailing list can be more t

Re: "more_spam_from" like "more_spam_to"

2014-09-19 Thread Matus UHLAR - fantomas
RW> A lot of people don't put mailing lists through Spamassassin, most RW> of them have already been spam filtered, and to get the best results RW> you have to extend your internal network and maintain it. Matus> no... they do not filter mail from mailing lists through SA. it Matus> is setting

Re: "more_spam_from" like "more_spam_to"

2014-09-19 Thread Martin Gregorie
On Fri, 2014-09-19 at 13:47 +0200, Reindl Harald wrote: > Am 19.09.2014 um 13:44 schrieb RW: > > On Thu, 18 Sep 2014 22:09:23 -0700 > > Ian Zimmerman wrote: > > > >> On Wed, 17 Sep 2014 13:43:49 +0100, > >> RW wrote: > >> > >> RW> A lot of people don't put mailing lists through Spamassassin, most

Re: "more_spam_from" like "more_spam_to"

2014-09-19 Thread Reindl Harald
Am 19.09.2014 um 13:44 schrieb RW: > On Thu, 18 Sep 2014 22:09:23 -0700 > Ian Zimmerman wrote: > >> On Wed, 17 Sep 2014 13:43:49 +0100, >> RW wrote: >> >> RW> A lot of people don't put mailing lists through Spamassassin, most >> RW> of them have already been spam filtered, and to get the best >>

Re: "more_spam_from" like "more_spam_to"

2014-09-19 Thread RW
On Thu, 18 Sep 2014 22:09:23 -0700 Ian Zimmerman wrote: > On Wed, 17 Sep 2014 13:43:49 +0100, > RW wrote: > > RW> A lot of people don't put mailing lists through Spamassassin, most > RW> of them have already been spam filtered, and to get the best > RW> results you have to extend your internal n

Re: "more_spam_from" like "more_spam_to"

2014-09-19 Thread Ian Zimmerman
On Fri, 19 Sep 2014 08:37:45 +0200, Matus UHLAR - fantomas wrote: RW> A lot of people don't put mailing lists through Spamassassin, most RW> of them have already been spam filtered, and to get the best results RW> you have to extend your internal network and maintain it. Ian> Do you mean the "tr

Re: Simple question: load balancing spamd

2014-09-19 Thread Jari Fredriksson
18.09.2014, 22:58, Bob Proulx kirjoitti: > Jari Fredriksson wrote: >> haproxy is just a small app capable of working as a proxy for http >> or plain tcp connections. HA. > What are you using for the Bayes database on the distributed compute > farm? (Just curious...) > > Bob > MySQL /MariaDB 5.5