Re: spamd running much slower than spamassassin?

On Mar 29, 2016, at 10:41 AM, Daniel J. Luke wrote: > On Mar 28, 2016, at 8:57 PM, Bill Cole > wrote: >> On 28 Mar 2016, at 14:42, Daniel J. Luke wrote: >>> On Mar 24, 2016, at 12:10 PM, Daniel J. Luke wrote: /usr/bin/time spamassassin < spam.msg 7.92 real 1.85 user

Re: Configuration Help Request: Spoofed Email Being Whitelisted

On 31 Mar 2016, at 10:50, Matus UHLAR - fantomas wrote: On 30 Mar 2016, at 9:48, Matus UHLAR - fantomas wrote: On 30.03.16 06:18, redtailjason wrote: [] The headers you have posted show mail that only goes through internal IPs and localhost, that mail doesn't seem to come from outside.

Re: HEADS-UP: MIME_NO_TEXT matches Sendmail MIME DSNs

On Thu, 31 Mar 2016, RW wrote: On Thu, 31 Mar 2016 17:56:21 -0400 Kevin A. McGrail wrote: On 3/31/2016 1:34 PM, RW wrote: They have something like: Content-Type: text; charset="utf-8" rather than Content-Type: text/plain; charset="utf-8" I think you found a bug in sendmail (or som

Re: HEADS-UP: MIME_NO_TEXT matches Sendmail MIME DSNs

On Thu, 31 Mar 2016 17:56:21 -0400 Kevin A. McGrail wrote: > On 3/31/2016 1:34 PM, RW wrote: > > > > They have something like: > > > >Content-Type: text; charset="utf-8" > > > > rather than > > > >Content-Type: text/plain; charset="utf-8" > > > > I think you found a bug in sendmail (or so

Re: HEADS-UP: MIME_NO_TEXT matches Sendmail MIME DSNs

On 3/31/2016 1:34 PM, RW wrote: They have something like: Content-Type: text; charset="utf-8" rather than Content-Type: text/plain; charset="utf-8" It's probably a rare mistake, but I was thinking of a rule like: header __MISSING_SUBTYPE_1 Content-Type =~ /^\w+[;\s]/ mimehead

Re: rspamd vs spamassassin

On 2016-03-31 19:40, Charles Sprickman wrote: I’d love to hear from anyone that has. i have since thay started spamming this maillist to hijack users from here, and at that time i did not make a gentoo ebuild for it, now i listen to what it does, but take it offline here since it have seqfau

Re: HEADS-UP: MIME_NO_TEXT matches Sendmail MIME DSNs

On Thu, 31 Mar 2016, RW wrote: On Thu, 31 Mar 2016 08:12:10 -0700 (PDT) John Hardin wrote: I don't follow what you're saying, can you provide an example? They have something like: Content-Type: text; charset="utf-8" rather than Content-Type: text/plain; charset="utf-8" It's probably a

Re: rspamd vs spamassassin

Am 31.03.2016 um 17:51 schrieb Benny Pedersen: https://rspamd.com/misc/2016/03/03/rspamd-performance.html is it time to move? move if you want, nobody is missing you and such troll-posts if a relevant part of spam-mails hits your content-filter you better hire somebody because in a sane se

Re: rspamd vs spamassassin

> On Mar 31, 2016, at 11:51 AM, Benny Pedersen wrote: > > https://rspamd.com/misc/2016/03/03/rspamd-performance.html > > is it time to move ? I’d love to hear from anyone that has. I’ve known of rspamd for a long time, but found the docs pretty much lacking and couldn’t find anyone that had

Re: HEADS-UP: MIME_NO_TEXT matches Sendmail MIME DSNs

On Thu, 31 Mar 2016 08:12:10 -0700 (PDT) John Hardin wrote: > On Thu, 31 Mar 2016, RW wrote: > > > On Wed, 30 Mar 2016 18:22:21 -0700 (PDT) > > John Hardin wrote: > > > >> MIME_NO_TEXT is a *very* simple rule: "has a content-type: > >> multipart/* header in the main message headers" and "has no

rspamd vs spamassassin

https://rspamd.com/misc/2016/03/03/rspamd-performance.html is it time to move ?

Re: HEADS-UP: MIME_NO_TEXT matches Sendmail MIME DSNs

On Thu, 31 Mar 2016, RW wrote: On Wed, 30 Mar 2016 18:22:21 -0700 (PDT) John Hardin wrote: MIME_NO_TEXT is a *very* simple rule: "has a content-type: multipart/* header in the main message headers" and "has no content-type: text/* MIME header anywhere." I've only 3 hits on this in the last 4

Re: HEADS-UP: MIME_NO_TEXT matches Sendmail MIME DSNs

On Thu, 31 Mar 2016, Bill Cole wrote: On 30 Mar 2016, at 21:22, John Hardin wrote: Not sure what you mean by "in the original message body" because it seems having a CT:t/* header in the original message suppresses that rule in my and David's testing. randomly added into the body, i.e. te

Re: Configuration Help Request: Spoofed Email Being Whitelisted

On 30 Mar 2016, at 9:48, Matus UHLAR - fantomas wrote: On 30.03.16 06:18, redtailjason wrote: [] The headers you have posted show mail that only goes through internal IPs and localhost, that mail doesn't seem to come from outside. On 31.03.16 09:23, Bill Cole wrote: I believe that this

Re: HEADS-UP: MIME_NO_TEXT matches Sendmail MIME DSNs

On Wed, 30 Mar 2016 18:22:21 -0700 (PDT) John Hardin wrote: > MIME_NO_TEXT is a *very* simple rule: "has a content-type: > multipart/* header in the main message headers" and "has no > content-type: text/* MIME header anywhere." I've only 3 hits on this in the last 4k spam, but FWIW all of them

Re: Configuration Help Request: Spoofed Email Being Whitelisted

On 30 Mar 2016, at 9:48, Matus UHLAR - fantomas wrote: On 30.03.16 06:18, redtailjason wrote: [] The headers you have posted show mail that only goes through internal IPs and localhost, that mail doesn't seem to come from outside. I believe that this is not correct. it also looks that

Re: Rule to score word documents

On Thu, Mar 31, 2016 at 7:24 AM Reindl Harald wrote: > > > Am 31.03.2016 um 13:16 schrieb Rodney Green: > > > > > > On Wed, Mar 30, 2016 at 3:34 PM Reindl Harald > > wrote: > > > > > > > > Am 30.03.2016 um 21:23 schrieb Rodney Green: > > > I'd like to assi

Re: Rule to score word documents

On Wed, Mar 30, 2016 at 3:34 PM Alex wrote: > > > I believe something like this would work in spamassassin: > > mimeheader DOC_ATTACHED Content-Type =~ /="[^"]+\.(?:docx?|rtf)"/i > scoreDOC_ATTACHED 12.5 > > > Thank you! I'll give this a try, but score it lower for testing. Rod

Re: Rule to score word documents

On Wed, Mar 30, 2016 at 4:11 PM @lbutlr wrote: > On Wed Mar 30 2016 13:34:23 Alex said: > > > > > /^(Content-(Type|Disposition)\:|[[:space:]]+).*(file)?name="?.*\.doc"?;?$/ > > REJECT > > /^\s*Content-(Disposition|Type).*name\s*=\s*"?(.*\.(ade|adp|bas|bat|chm|cmd|com|cpl|crt|dll|exe|hlp|h

Re: Rule to score word documents

Am 31.03.2016 um 13:16 schrieb Rodney Green: On Wed, Mar 30, 2016 at 3:34 PM Reindl Harald mailto:h.rei...@thelounge.net>> wrote: Am 30.03.2016 um 21:23 schrieb Rodney Green: > I'd like to assign a spamassassin score to received word documents > (doc,docx,xls,xlsx) so they ar

Re: Rule to score word documents

On Wed, Mar 30, 2016 at 3:34 PM Reindl Harald wrote: > > > Am 30.03.2016 um 21:23 schrieb Rodney Green: > > I'd like to assign a spamassassin score to received word documents > > (doc,docx,xls,xlsx) so they are quarantined on my UTM. I've tried the > > following which doesn't work. Can someone sh