Re: FSL_HELO_HOME: deep headers again

2016-05-13 Thread Reindl Harald
Am 14.05.2016 um 04:50 schrieb John Hardin: On Sat, 14 May 2016, Reindl Harald wrote: Am 14.05.2016 um 04:04 schrieb John Hardin: How would a webservice be better? That would still be sending customer emails to a third party for processing. uhm you missed "and only give the rules which hi

Re: /etc/cron.daily/spamassassin - Update failed, exiting with code 4

2016-05-13 Thread John Hardin
On Fri, 13 May 2016, Bill Keenan wrote: Googling this turns up some speculation…are the 4 curls failing because of a mirror problem? Shame on me for not watching…I do not know when this error started to occur. If there is a fix, where is it documented? Bill SpamAssassin version 3.4.1 runnin

Re: FSL_HELO_HOME: deep headers again

2016-05-13 Thread John Hardin
On Sat, 14 May 2016, Reindl Harald wrote: Am 14.05.2016 um 04:04 schrieb John Hardin: On Fri, 13 May 2016, Reindl Harald wrote: > i can't rsync customer mails to a 3rd party You don't have to. You run the masscheck locally and only upload the rule hit results. I upload my corpora because

Re: understanding HELO_DYNAMIC_IPADDR

2016-05-13 Thread Reindl Harald
Am 14.05.2016 um 04:14 schrieb Kim Roar Foldøy Hauge: On Sat, 14 May 2016, Reindl Harald wrote: Am 13.05.2016 um 20:26 schrieb Kim Roar Foldøy Hauge: On Fri, 13 May 2016, Joe Quinn wrote: > The solution is to give your mail servers better hostnames that clue > into the narrower scope of t

Re: understanding HELO_DYNAMIC_IPADDR

2016-05-13 Thread Kim Roar Foldøy Hauge
On Sat, 14 May 2016, Reindl Harald wrote: Am 13.05.2016 um 20:26 schrieb Kim Roar Foldøy Hauge: On Fri, 13 May 2016, Joe Quinn wrote: > The solution is to give your mail servers better hostnames that clue > into the narrower scope of their purpose. This is NOT a practical solution. You c

Re: FSL_HELO_HOME: deep headers again

2016-05-13 Thread Reindl Harald
Am 14.05.2016 um 04:04 schrieb John Hardin: On Fri, 13 May 2016, Reindl Harald wrote: i can't rsync customer mails to a 3rd party You don't have to. You run the masscheck locally and only upload the rule hit results. I upload my corpora because they are just my email and are thus tiny. If y

Re: FSL_HELO_HOME: deep headers again

2016-05-13 Thread John Hardin
On Fri, 13 May 2016, Reindl Harald wrote: Am 13.05.2016 um 18:11 schrieb John Hardin: On Fri, 13 May 2016, Reindl Harald wrote: > the problem is blowing out such rules with such scores at all with a > non working auto-QA (non-working in: no correction for days as well as > dangerous scori

Re: FSL_HELO_HOME: deep headers again

2016-05-13 Thread Reindl Harald
Am 13.05.2016 um 23:08 schrieb Tom Hendrikx: On 13-05-16 18:29, Reindl Harald wrote: especially you would not have much from the bayes-samples because they would trigger all sort of wrong rules after strip most headers and and a generic received header (which seems to be needed by the bayes-en

Re: understanding HELO_DYNAMIC_IPADDR

2016-05-13 Thread Reindl Harald
Am 13.05.2016 um 20:26 schrieb Kim Roar Foldøy Hauge: On Fri, 13 May 2016, Joe Quinn wrote: The solution is to give your mail servers better hostnames that clue into the narrower scope of their purpose. This is NOT a practical solution. You can't expect administrators to know about this prob

/etc/cron.daily/spamassassin - Update failed, exiting with code 4

2016-05-13 Thread Bill Keenan
Googling this turns up some speculation…are the 4 curls failing because of a mirror problem? Shame on me for not watching…I do not know when this error started to occur. If there is a fix, where is it documented? Bill SpamAssassin version 3.4.1 running on Perl version 5.20.2 # Update umask 0

Re: FSL_HELO_HOME: deep headers again

2016-05-13 Thread Tom Hendrikx
On 13-05-16 18:29, Reindl Harald wrote: > > Am 13.05.2016 um 18:11 schrieb John Hardin: >> On Fri, 13 May 2016, Reindl Harald wrote: >> >>> the problem is blowing out such rules with such scores at all with a >>> non working auto-QA (non-working in: no correction for days as well as >>> dangerous

Re: understanding HELO_DYNAMIC_IPADDR

2016-05-13 Thread David Jones
>From: Daniel J. Luke >Sent: Friday, May 13, 2016 3:42 PM >To: David Jones >Cc: Vincent Fox; users@spamassassin.apache.org >Subject: Re: understanding HELO_DYNAMIC_IPADDR >On May 13, 2016, at 4:24 PM, David Jones wrote: >> This is a very simple concept and yet most mail admins don't know it or

Re: understanding HELO_DYNAMIC_IPADDR

2016-05-13 Thread Daniel J. Luke
On May 13, 2016, at 4:24 PM, David Jones wrote: > This is a very simple concept and yet most mail admins don't know it or > follow it. indeed. I haven't measured in a while, but the equivalent of postfix's 'reject_unknown_client_hostname' was the single most-effective anti-spam measure I ever

Re: understanding HELO_DYNAMIC_IPADDR

2016-05-13 Thread Vincent Fox
On 05/13/2016 01:24 PM, David Jones wrote: This is a very simple concept and yet most mail admins don't know it or follow it. I know right? IMO network/firewall backgrounds are worse though. They are used to thinking in IP all day and DNS is just this optional convenience. Cheers.

Re: understanding HELO_DYNAMIC_IPADDR

2016-05-13 Thread David Jones
> >From: Vincent Fox >Sent: Friday, May 13, 2016 2:57 PM >To: users@spamassassin.apache.org >Subject: Re: understanding HELO_DYNAMIC_IPADDR >On 05/13/2016 12:29 PM, Daniel J. Luke wrote: >> >> While you are at it, make sure your forward and reverse dns matc

Re: understanding HELO_DYNAMIC_IPADDR

2016-05-13 Thread Vincent Fox
On 05/13/2016 12:29 PM, Daniel J. Luke wrote: While you are at it, make sure your forward and reverse dns match. At least weekly, I get someone bickering with me that reverse DNS is not any kind of requirement to be a legitimate server. Often it comes from well-paid network administrators.

Re: understanding HELO_DYNAMIC_IPADDR

2016-05-13 Thread Daniel J. Luke
On May 13, 2016, at 2:26 PM, Kim Roar Foldøy Hauge wrote: > This is NOT a practical solution. You can't expect administrators to know > about this problem, some styles of hostnames not playing well with SA. Note that this isn't just a 'spamassassin' issue. You will likely experience delivery pr

Re: understanding HELO_DYNAMIC_IPADDR

2016-05-13 Thread Kim Roar Foldøy Hauge
On Fri, 13 May 2016, Joe Quinn wrote: SA uses IP-in-name as a machine-decidable definition of a dynamic IP, since you can't really automate it otherwise. This heuristic holds in the vast majority of cases, and is effective against a huge class of spam that comes from public ISPs who don't bloc

Re: understanding HELO_DYNAMIC_IPADDR

2016-05-13 Thread Joe Quinn
SA uses IP-in-name as a machine-decidable definition of a dynamic IP, since you can't really automate it otherwise. This heuristic holds in the vast majority of cases, and is effective against a huge class of spam that comes from public ISPs who don't block port 25. An ISP's customers are gene

Re: Bayes duplicate message detection algorithm?

2016-05-13 Thread RW
On Fri, 13 May 2016 12:44:40 -0500 (CDT) David B Funk wrote: > What algorithm does Bayes use to detect that it has already 'seen' a > given message? > > When I receive a bolus (say 40~60) of 'phish' messages from a > compromised Hotmail/gmail/yahoo account which are mostly the same > (body, many

Bayes duplicate message detection algorithm?

2016-05-13 Thread David B Funk
What algorithm does Bayes use to detect that it has already 'seen' a given message? When I receive a bolus (say 40~60) of 'phish' messages from a compromised Hotmail/gmail/yahoo account which are mostly the same (body, many headers same, only recipients, Message-ID, Date, and a few Received he

Re: understanding HELO_DYNAMIC_IPADDR

2016-05-13 Thread Robert Boyl
Thanks a lot for your answer, sorry for confusion. But why add such a high score of 3,24 just before the host that sent my server mail is webmail-201.76.63.163.ig.com.br ? Its considered a dynamic IP? It isnt, its IGs server sending mail to our server. Can I ask Spamassassin folks to improve thi

Re: FSL_HELO_HOME: deep headers again

2016-05-13 Thread Reindl Harald
Am 13.05.2016 um 18:11 schrieb John Hardin: On Fri, 13 May 2016, Reindl Harald wrote: the problem is blowing out such rules with such scores at all with a non working auto-QA (non-working in: no correction for days as well as dangerous scoring of new rules from the start) 02-Mai-2016 00:12:34

Re: FSL_HELO_HOME: deep headers again

2016-05-13 Thread John Hardin
On Fri, 13 May 2016, RW wrote: On Fri, 13 May 2016 15:42:07 +0200 Reindl Harald wrote: WTF - Received: from daves-air.home ([1.125.7.92]) is another time a DEEP HEADER Inspection - This looks like a simple mistake rather than a deliberate attempt at a deep check. You should file a bug report

Re: FSL_HELO_HOME: deep headers again

2016-05-13 Thread John Hardin
On Fri, 13 May 2016, Reindl Harald wrote: the problem is blowing out such rules with such scores at all with a non working auto-QA (non-working in: no correction for days as well as dangerous scoring of new rules from the start) 02-Mai-2016 00:12:34: SpamAssassin: No update available 03-Mai-2

Re: FSL_HELO_HOME: deep headers again

2016-05-13 Thread Reindl Harald
Am 13.05.2016 um 16:25 schrieb RW: On Fri, 13 May 2016 15:42:07 +0200 Reindl Harald wrote: WTF - Received: from daves-air.home ([1.125.7.92]) is another time a DEEP HEADER Inspection - This looks like a simple mistake rather than a deliberate attempt at a deep check. You should file a bug r

Re: FSL_HELO_HOME: deep headers again

2016-05-13 Thread RW
On Fri, 13 May 2016 15:42:07 +0200 Reindl Harald wrote: > WTF - Received: from daves-air.home ([1.125.7.92]) is another time a > DEEP HEADER Inspection - This looks like a simple mistake rather than a deliberate attempt at a deep check. You should file a bug report.

Re: FSL_HELO_HOME: deep headers again

2016-05-13 Thread Reindl Harald
Am 13.05.2016 um 15:42 schrieb Reindl Harald: WTF - Received: from daves-air.home ([1.125.7.92]) is another time a DEEP HEADER Inspection - What about score not well thought rules which are even not worth a decription not higher than 0.5? 3.7 FSL_HELO_HOME No description available sco

FSL_HELO_HOME: deep headers again

2016-05-13 Thread Reindl Harald
WTF - Received: from daves-air.home ([1.125.7.92]) is another time a DEEP HEADER Inspection - What about score not well thought rules which are even not worth a decription not higher than 0.5? 3.7 FSL_HELO_HOME No description available score FSL_HELO_HOME2.641 3.722 2.641 3.722