Re: Hitting an address in the From:name

2015-08-20 Thread Henrik K
On Thu, Aug 20, 2015 at 02:49:33PM -0400, Joe Quinn wrote: > Good catch! If you are using a new enough perl you might try the > following which should have zero backtracking (the + modifier on > quantifiers works like a cut in prolog): > > From =~ /\@[^@]*+\@/ Talking about an overengineered solu

Re: Hitting an address in the From:name

2015-08-20 Thread Bill Cole
On 20 Aug 2015, at 14:49, Joe Quinn wrote: That said, header fields are likely never going to be long enough for what you currently have to be a performance concern. (I was about to say it was impossible, but then I saw there is no length limit on headers: http://stackoverflow.com/questions/

Re: DNS deferrals on *HEADER* addresses

2015-08-20 Thread Bill Cole
On 20 Aug 2015, at 10:10, hospice admin wrote: Guys, I've been beating my head against a problem for a couple of days now ... maybe someone can point me in the right direction ...? I'm running SA 3.4.1 on Fedora 22. I think this problem started happening when I upgraded from 3.4.0 on Fedora 2

Re: Hitting an address in the From:name

2015-08-20 Thread John Hardin
On Thu, 20 Aug 2015, Olivier Coutu wrote: Le 2015-08-20 15:04, Joe Quinn a écrit : On 8/20/2015 2:56 PM, John Hardin wrote: > On Thu, 20 Aug 2015, Olivier Coutu wrote: > > I believe that SA may be removing the part > > from the From:name, am I correct? Already opened a bug. The fact th

Re: Hitting an address in the From:name

2015-08-20 Thread Olivier Coutu
Le 2015-08-20 15:04, Joe Quinn a écrit : On 8/20/2015 2:56 PM, John Hardin wrote: On Thu, 20 Aug 2015, Olivier Coutu wrote: I believe that SA may be removing the part from the From:name, am I correct? Define this rule: header __ALL_FROMNAME From:name =~ /.*/ ...and run spamassassin

Re: Hitting an address in the From:name

2015-08-20 Thread Joe Quinn
On 8/20/2015 2:56 PM, John Hardin wrote: On Thu, 20 Aug 2015, Olivier Coutu wrote: I believe that SA may be removing the part from the From:name, am I correct? Define this rule: header __ALL_FROMNAME From:name =~ /.*/ ...and run spamassassin on a test message using: --debug area=a

Re: Hitting an address in the From:name

2015-08-20 Thread John Hardin
On Thu, 20 Aug 2015, Olivier Coutu wrote: I got a spearphishing e-mail the other day that had a From with the following form: From: "Mister President " I attempted to craft a SA rule to catch the "@" in the From:name but I was unable to catch anything after the "<" ex: From: name =

Re: Hitting an address in the From:name

2015-08-20 Thread Joe Quinn
On 8/20/2015 2:42 PM, Olivier Coutu wrote: I got a spearphishing e-mail the other day that had a From with the following form: From: "Mister President " I attempted to craft a SA rule to catch the "@" in the From:name but I was unable to catch anything after the "<" ex: From:name =~

Hitting an address in the From:name

2015-08-20 Thread Olivier Coutu
I got a spearphishing e-mail the other day that had a From with the following form: From: "Mister President " I attempted to craft a SA rule to catch the "@" in the From:name but I was unable to catch anything after the "<" ex: From:name =~ /Mister President/hits From:name =~

Re: DNS deferrals on *HEADER* addresses

2015-08-20 Thread Martin Gregorie
On Thu, 2015-08-20 at 15:10 +0100, hospice admin wrote: > Basically ... Mail is being deferred if any of the To or Cc addresses > in the mail *header* fail DNS resolution. So, if I receive a mail: > To: me@mydomain.comCc: some...@bogusdomain.com > Mail sits in teh queue on my server until the NS f

Re: DNS deferrals on *HEADER* addresses

2015-08-20 Thread Benny Pedersen
On August 20, 2015 4:10:36 PM hospice admin wrote: Does anyone have a better suggestion? senders block dns to there spammin domain, so setup sendmail to defer spammail that have dns blocked on sender domains, then bastards will let you get dns results very fast :) note i do not use mimede

Bayes input needed

2015-08-20 Thread Alex
Hi, I've been going through the quarantine, looking for spam with low bayes numbers, and have found a few. I'm not sure enough to make me think the database is screwed up, but I hoped someone could take a look at the below header. It appears to be just a basic marketing email, but happens to have

DNS deferrals on *HEADER* addresses

2015-08-20 Thread hospice admin
Guys, I've been beating my head against a problem for a couple of days now ... maybe someone can point me in the right direction ...? I'm running SA 3.4.1 on Fedora 22. I think this problem started happening when I upgraded from 3.4.0 on Fedora 21. In both cases, SA is running from within MimeD