Re: The word on messages w/ no Message-Id

2015-09-29 Thread Reindl Harald
Am 29.09.2015 um 23:45 schrieb coolhandluke: based on just what i've found in the last 10 minutes, i would be very careful about scoring anything related to {invalid|missing|extra} headers too high. definitely test your rules extensively (with very low scores) before rolling them out to produc

Re: The word on messages w/ no Message-Id

2015-09-29 Thread coolhandluke
On 2015-09-28 14:32, Joe Quinn wrote: If you don't want to be getting those emails, they are spam and you should score it something reasonable that doesn't prevent you getting other desired messages. While I don't have any specific examples of ham without Message-ID, it's not a stretch to imagine

Re: tflags multiple and header exists:

2015-09-29 Thread John Hardin
On Tue, 29 Sep 2015, Philip Prindeville wrote: On Sep 29, 2015, at 10:44 AM, John Hardin wrote: On Tue, 29 Sep 2015, Philip Prindeville wrote: Can you use something like: header __L_X_NO_RELAY exists:X-No-Relay Are you seeing empty X-No-Relay headers? How about: No, not empty.

Re: tflags multiple and header exists:

2015-09-29 Thread Philip Prindeville
On Sep 29, 2015, at 10:44 AM, John Hardin wrote: > On Tue, 29 Sep 2015, Philip Prindeville wrote: > >> Can you use something like: >> >> header __L_X_NO_RELAYexists:X-No-Relay > > Are you seeing empty X-No-Relay headers? How about: No, not empty. Typically they say: X-No-Re

Re: Add "may be forged" minor rule?

2015-09-29 Thread Amir Caspi
On Sep 28, 2015, at 10:17 PM, David B Funk wrote: > By itself not a strong spam sign, but good for metas. FWIW, I added this is a rule with 0.2 points. "Unfortunately," my user's snowshoe hits today have all been hitting RDNS_NONE instead of this rule, so I can't quite gauge its effectiveness

Re: tflags multiple and header exists:

2015-09-29 Thread John Hardin
On Tue, 29 Sep 2015, Philip Prindeville wrote: Can you use something like: header __L_X_NO_RELAY exists:X-No-Relay tflags __L_X_NO_RELAY multiple See also DUP_SUSP_HDR, which is in my sandbox but isn't performing well enough against the corpora to get published: http://

Re: tflags multiple and header exists:

2015-09-29 Thread John Hardin
On Tue, 29 Sep 2015, John Hardin wrote: On Tue, 29 Sep 2015, Philip Prindeville wrote: Can you use something like: header __L_X_NO_RELAY exists:X-No-Relay Are you seeing empty X-No-Relay headers? How about: header__HAS_NO_RELAYX-No-Relay =~ /./ Oops. If yo

Re: tflags multiple and header exists:

2015-09-29 Thread John Hardin
On Tue, 29 Sep 2015, Philip Prindeville wrote: Can you use something like: header __L_X_NO_RELAY exists:X-No-Relay Are you seeing empty X-No-Relay headers? How about: header__HAS_NO_RELAYX-No-Relay =~ /./ ...which is in my sandbox, but just for eval, it's not

Re: tflags multiple and header exists:

2015-09-29 Thread Philip Prindeville
On Sep 29, 2015, at 10:09 AM, Philip Prindeville wrote: > Can you use something like: > > header __L_X_NO_RELAY exists:X-No-Relay > tflags __L_X_NO_RELAY multiple Actually, that should probably be bounded to something like: tflags __L_X_NO_RELAY multiple maxhits=10

tflags multiple and header exists:

2015-09-29 Thread Philip Prindeville
Can you use something like: header __L_X_NO_RELAY exists:X-No-Relay tflags __L_X_NO_RELAY multiple meta MULTIPLE_X_NO_RELAY__L_X_NO_RELAY >= 8 describe MULTIPLE_X_NO_RELAYSaw an inordinate number of X-No-Relay: headers score MULTIPLE_X_NO_RELAY 10.0 I couldn

Re: Add "may be forged" minor rule?

2015-09-29 Thread RW
On Mon, 28 Sep 2015 17:29:15 -0700 Dave Warren wrote: > You might also want to see if you can avoid greylisting some big > senders. There is zero advantage in greylisting Google, Outlook.com, > Outlook 365, Yahoo, AOL, etc, as you know they're real mail servers > and you know they will retry. F

Re: Permissions for home dir .spamassassin

2015-09-29 Thread RW
On Tue, 29 Sep 2015 00:32:46 -0400 David Niklas wrote: > On Tue, 22 Sep 2015 22:41:10 +0200 Antony wrote: > > On Tuesday 22 September 2015 at 22:35:55, David wrote: > > > > > Hello, I decided to store users personal filter rules > > > in .spamassassin in their home dir, but I'm not sure how to se