Re: Many X- headers - possible spam sign?

2014-10-04 Thread jdebert
On Fri, 3 Oct 2014 15:55:48 -0400 "David F. Skoll" wrote: > X-DKIM: Sendmail DKIM Filter v2.8.2 mailsea.docusign.net JQ9N42F3MTC8 ^^ Never seen this before from sendmail. Bogus DKIM header? Iis it also possible to test for conflicting X- headers?

Re: half-OT: please remove spam-markers from subjects

2014-10-04 Thread jdebert
My apologies. You are 100,000% correct about changing annoying behaviours. I did not find the message you referred to, perhaps because of a forgotten convenience filter that strips nuisance tags from subjects.

Full OT: Re "trolls" (was Re: half-OT: please remove spam-markers from subjects)

2014-10-04 Thread jdebert
On Fri, 03 Oct 2014 19:47:00 +0200 Kai Schaetzl wrote: > FYI, this person is banned from some lists for trolling. > Might be worthwhile for list-admin to consider that. > > https://www.google.de/search?hl=de&as_q=Harald+Reindl+troll > Whether or not Herr Reindl is a troll doesn't matter. There

Re: bad local parts (thisisjusttestletter)

2014-10-04 Thread Karsten Bräckelmann
On Sun, 2014-10-05 at 02:43 +0200, Reindl Harald wrote: > Am 05.10.2014 um 02:27 schrieb Karsten Bräckelmann: > > On Sun, 2014-10-05 at 01:53 +0200, Reindl Harald wrote: > >> Am 05.10.2014 um 01:41 schrieb Karsten Bräckelmann: > >>> On Sat, 2014-10-04 at 22:15 +0200, Reindl Harald wrote: > i

Re: bad local parts (thisisjusttestletter)

2014-10-04 Thread Reindl Harald
Am 05.10.2014 um 02:27 schrieb Karsten Bräckelmann: On Sun, 2014-10-05 at 01:53 +0200, Reindl Harald wrote: Am 05.10.2014 um 01:41 schrieb Karsten Bräckelmann: On Sat, 2014-10-04 at 22:15 +0200, Reindl Harald wrote: i recently found "thisisjusttestletter@random-domain" as sender as well as "t

Re: bad local parts (thisisjusttestletter)

2014-10-04 Thread Karsten Bräckelmann
On Sun, 2014-10-05 at 01:53 +0200, Reindl Harald wrote: > Am 05.10.2014 um 01:41 schrieb Karsten Bräckelmann: > > On Sat, 2014-10-04 at 22:15 +0200, Reindl Harald wrote: > > > i recently found "thisisjusttestletter@random-domain" as sender as well > > > as "thisisjusttestletter@random-of-our-domai

Re: bad local parts (thisisjusttestletter)

2014-10-04 Thread Reindl Harald
Am 05.10.2014 um 01:41 schrieb Karsten Bräckelmann: On Sat, 2014-10-04 at 22:15 +0200, Reindl Harald wrote: i recently found "thisisjusttestletter@random-domain" as sender as well as "thisisjusttestletter@random-of-our-domains" as RCPT in my logs and remember that crap for many years now Sure

Re: bad local parts (thisisjusttestletter)

2014-10-04 Thread Karsten Bräckelmann
On Sat, 2014-10-04 at 22:15 +0200, Reindl Harald wrote: > i recently found "thisisjusttestletter@random-domain" as sender as well > as "thisisjusttestletter@random-of-our-domains" as RCPT in my logs and > remember that crap for many years now Surely, SA would never see that message, since that's

Re: Help needed with possible DNS problems

2014-10-04 Thread Reindl Harald
Am 04.10.2014 um 22:38 schrieb Yasir Assam: Thanks Reindl. I haven't investigated ipv6 properly, but looking at my Hosting provider's wiki and a few of my config files, it seems ipv6 is available (I have been assigned an ipv6 subnet). I have something like this: http://wiki.hetzner.de/index.php

Re: Help needed with possible DNS problems

2014-10-04 Thread Yasir Assam
Thanks Reindl. I haven't investigated ipv6 properly, but looking at my Hosting provider's wiki and a few of my config files, it seems ipv6 is available (I have been assigned an ipv6 subnet). I have something like this: http://wiki.hetzner.de/index.php/Netzkonfiguration_Debian/en#Dedicated_Servers_

bad local parts (thisisjusttestletter)

2014-10-04 Thread Reindl Harald
i recently found "thisisjusttestletter@random-domain" as sender as well as "thisisjusttestletter@random-of-our-domains" as RCPT in my logs and remember that crap for many years now well, postfix access maps after switch away from commercial appliances - are there other well nown local-parts to

Re: Many X- headers - possible spam sign?

2014-10-04 Thread Reindl Harald
Am 04.10.2014 um 18:41 schrieb John Hardin: On Sat, 4 Oct 2014, Robert Schetterer wrote: Am 04.10.2014 um 13:48 schrieb Reindl Harald: blacklist_from *.mail this tld will be valid soon https://www.united-domains.de/neue-top-level-domain/ ...and will likely only be used for spam sadly t

Re: spamassassin working very poorly

2014-10-04 Thread Reindl Harald
Am 04.10.2014 um 18:36 schrieb andybalholm: On Oct 4, 2014, at 4:39 AM, Benny Pedersen-2 wrote: > So anti spammer would now stop reading here ? :) No, but I sometimes wonder if it’s wise to post my anti-spam ideas here, since that makes it easier for spammers to work around them a valid poi

Re: Many X- headers - possible spam sign?

2014-10-04 Thread John Hardin
On Sat, 4 Oct 2014, Robert Schetterer wrote: Am 04.10.2014 um 13:48 schrieb Reindl Harald: blacklist_from *.mail this tld will be valid soon https://www.united-domains.de/neue-top-level-domain/ ...and will likely only be used for spam. -- John Hardin KA7OHZhttp://www.

Re: spamassassin working very poorly

2014-10-04 Thread andybalholm
On Oct 4, 2014, at 4:39 AM, Benny Pedersen-2 wrote: > So anti spammer would now stop reading here ? :) No, but I sometimes wonder if it’s wise to post my anti-spam ideas here, since that makes it easier for spammers to work around them… -- View this message in context: http://spamassassin.

Re: random low contrast text with bayes [Solved]

2014-10-04 Thread Eric Shubert
On 09/03/2014 01:26 AM, Matus UHLAR - fantomas wrote: On Sun, 31 Aug 2014, Eric Shubert wrote: I've seen an uptick of spam lately with random low contrast (hidden) text. This appears to be lowering bayes probabilities. On 08/31/2014 10:26 PM, John Hardin wrote: Learn them as spam. That will

Re: bayes_ignore_header

2014-10-04 Thread Kevin A. McGrail
On 10/4/2014 5:32 AM, Axb wrote: Unless somebody thinks this a terribly bad idea, I'll be adding a 20_bayes_ignore_header.cf to the SA default rules to replace the few (unmantained) bayes_ignore_header entries in local.cf comments? Far as I'm concerned, you are the reining Bayes expert on the

Re: Many X- headers - possible spam sign?

2014-10-04 Thread David F. Skoll
On Sat, 04 Oct 2014 13:59:54 +0200 Benny Pedersen wrote: > On October 4, 2014 4:08:00 AM "David F. Skoll" > wrote: > > So it occurs to me that if > > a mail comes in with a Return-Path: header that does not match > > the envelope sender, that's another very suspicious sign. > As this mail list

Re: Many X- headers - possible spam sign?

2014-10-04 Thread Reindl Harald
Am 04.10.2014 um 15:27 schrieb Axb: On 10/04/2014 03:19 PM, Reindl Harald wrote: the merged list is in SVN trunk... 23_bayes_ignore_header.cf thank you! Not included are : bayes_ignore_header X-Authenticated-As bayes_ignore_header X-Authenticated-Sender bayes_ignore_header X-Authenticated-U

Re: Many X- headers - possible spam sign?

2014-10-04 Thread Axb
On 10/04/2014 03:19 PM, Reindl Harald wrote: Am 04.10.2014 um 15:16 schrieb Axb: On 10/04/2014 01:35 PM, Reindl Harald wrote: Am 04.10.2014 um 12:48 schrieb Axb: On 10/04/2014 12:21 PM, Bernd Petrovitsch wrote: Hmm,h.rei...@thelounge.net's list of "bayes_ignore_header"s could (should?!) actu

Re: Many X- headers - possible spam sign?

2014-10-04 Thread Reindl Harald
Am 04.10.2014 um 15:16 schrieb Axb: On 10/04/2014 01:35 PM, Reindl Harald wrote: Am 04.10.2014 um 12:48 schrieb Axb: On 10/04/2014 12:21 PM, Bernd Petrovitsch wrote: Hmm,h.rei...@thelounge.net's list of "bayes_ignore_header"s could (should?!) actually be part of SAa default setup. For quite

Re: Many X- headers - possible spam sign?

2014-10-04 Thread Axb
On 10/04/2014 01:35 PM, Reindl Harald wrote: Am 04.10.2014 um 12:48 schrieb Axb: On 10/04/2014 12:21 PM, Bernd Petrovitsch wrote: Hmm,h.rei...@thelounge.net's list of "bayes_ignore_header"s could (should?!) actually be part of SAa default setup. For quite a while, I've been compiling a list

Re: Many X- headers - possible spam sign?

2014-10-04 Thread Matus UHLAR - fantomas
On October 4, 2014 4:08:00 AM "David F. Skoll" wrote: So it occurs to me that if a mail comes in with a Return-Path: header that does not match the envelope sender, that's another very suspicious sign. On 04.10.14 13:59, Benny Pedersen wrote: As this mail list here :) a mistake probably (on

Re: Many X- headers - possible spam sign?

2014-10-04 Thread Reindl Harald
Am 04.10.2014 um 14:13 schrieb Robert Schetterer: Am 04.10.2014 um 13:48 schrieb Reindl Harald: blacklist_from *.mail this tld will be valid soon https://www.united-domains.de/neue-top-level-domain/ thanks for the hint - removed! the list was filtered out of postscreen-HELO-logs and anyth

Re: Many X- headers - possible spam sign?

2014-10-04 Thread Robert Schetterer
Am 04.10.2014 um 13:48 schrieb Reindl Harald: > blacklist_from *.mail this tld will be valid soon https://www.united-domains.de/neue-top-level-domain/ Best Regards MfG Robert Schetterer -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesell

Re: Many X- headers - possible spam sign?

2014-10-04 Thread Benny Pedersen
On October 4, 2014 4:08:00 AM "David F. Skoll" wrote: So it occurs to me that if a mail comes in with a Return-Path: header that does not match the envelope sender, that's another very suspicious sign. As this mail list here :)

Re: Many X- headers - possible spam sign?

2014-10-04 Thread Reindl Harald
Am 04.10.2014 um 13:16 schrieb Axb: On 10/04/2014 12:48 PM, Axb wrote: On 10/04/2014 12:21 PM, Bernd Petrovitsch wrote: Hmm,h.rei...@thelounge.net's list of "bayes_ignore_header"s could (should?!) actually be part of SAa default setup. For quite a while, I've been compiling a list for local

Re: spamassassin working very poorly

2014-10-04 Thread Benny Pedersen
On October 4, 2014 12:42:15 AM andybalholm wrote: > Spammers also learn. I'm pretty sure some of them read this list. (I sure would if I were a spammer.) So anti spammer would now stop reading here ? :)

Re: Many X- headers - possible spam sign?

2014-10-04 Thread Reindl Harald
Am 04.10.2014 um 12:48 schrieb Axb: On 10/04/2014 12:21 PM, Bernd Petrovitsch wrote: Hmm,h.rei...@thelounge.net's list of "bayes_ignore_header"s could (should?!) actually be part of SAa default setup. For quite a while, I've been compiling a list for local use. Merging Reindl's list I've come

Re: Many X- headers - possible spam sign?

2014-10-04 Thread Axb
On 10/04/2014 12:48 PM, Axb wrote: On 10/04/2014 12:21 PM, Bernd Petrovitsch wrote: Hmm,h.rei...@thelounge.net's list of "bayes_ignore_header"s could (should?!) actually be part of SAa default setup. For quite a while, I've been compiling a list for local use. Merging Reindl's list I've come t

Re: Many X- headers - possible spam sign?

2014-10-04 Thread Axb
On 10/04/2014 12:21 PM, Bernd Petrovitsch wrote: Hmm,h.rei...@thelounge.net's list of "bayes_ignore_header"s could (should?!) actually be part of SAa default setup. For quite a while, I've been compiling a list for local use. Merging Reindl's list I've come to 137 entries... and growing

Re: Many X- headers - possible spam sign?

2014-10-04 Thread Bernd Petrovitsch
On Fre, 2014-10-03 at 16:07 -0400, David F. Skoll wrote: [...] > That's true, but I think if we see headers from multiple vendors, it's > pretty suspicious. Not many sites filter their mail via Barracuda > *and* IronPort *and* KLMS *and* PerlMx *and* ... etc. In general, X- headers are non-Rfc/lo

bayes_ignore_header

2014-10-04 Thread Axb
Unless somebody thinks this a terribly bad idea, I'll be adding a 20_bayes_ignore_header.cf to the SA default rules to replace the few (unmantained) bayes_ignore_header entries in local.cf comments?

Re: Many X- headers - possible spam sign?

2014-10-04 Thread Axb
On 10/04/2014 04:08 AM, David F. Skoll wrote: Also, in this particular case, the Return-Path: header was fake... it was put there by the sender. The actual envelope sender was completely different: It was<41324...@mail.com>. So it occurs to me that if a mail comes in with a Return-Path: head

Re: Help needed with possible DNS problems

2014-10-04 Thread Reindl Harald
Am 04.10.2014 um 08:12 schrieb Yasir Assam: > I took the advice on > https://wiki.apache.org/spamassassin/CachingNameserver and set up a > caching name server. > > spamd isn't reporting errors now, but named is: if you don't have ipv6 i would disable it on the OS level i have the following setti