Re: recent increase in spam getting through

2016-12-17 Thread frederik
Hi Martin, Thanks for the reply. > Please keep your messages on the SA Users list. Here's my Cc line on the message you replied to: Cc: RW , "users@spamassassin.apache.org" I don't know why it wouldn't go through to the list, perhaps I shouldn't include spammy terms in the message body (I n

Re: recent increase in spam getting through

2016-12-17 Thread Martin Gregorie
On Sat, 2016-12-17 at 15:37 -0800, frede...@ofb.net wrote: > Thank you John, that does help clarify things a bit. Also thanks to > Martin - I was typing this message when I received yours, but maybe > this will answer some of your questions. > Please keep your messages on the SA Users list. Apart

Re: recent increase in spam getting through

2016-12-17 Thread frederik
Thank you John, that does help clarify things a bit. Also thanks to Martin - I was typing this message when I received yours, but maybe this will answer some of your questions. I get the following results on the message whose tests I included below: - spamassassin -t : score 12.6 (BAYES_80) - spa

Re: recent increase in spam getting through

2016-12-17 Thread Martin Gregorie
On Sat, 2016-12-17 at 13:03 -0800, frede...@ofb.net wrote: > I'm still investigating the problem, but I just noticed that > "spamassassin" gives the message a score of 12.0, while > "spamc"/"spamd" (which my mail setup is configured to use) still give > it a 4.0. So it seems that something more mun

Re: recent increase in spam getting through

2016-12-17 Thread John Hardin
On Sat, 17 Dec 2016, frede...@ofb.net wrote: Also, it seems that I should have set up a "caching nameserver". I've attached the report from "spamassassin -t" (with a "URIBL_BLOCKED" rule). The important part is that your MTA/SA not use your ISP or hosting provider's DNS sever, and the local M

Re: recent increase in spam getting through

2016-12-17 Thread frederik
Thanks again for the replies. I'm still investigating the problem, but I just noticed that "spamassassin" gives the message a score of 12.0, while "spamc"/"spamd" (which my mail setup is configured to use) still give it a 4.0. So it seems that something more mundane is going on, although I'm not s

Re: trusted_networks and internal_networks confusion

2016-12-17 Thread RW
On Sat, 17 Dec 2016 20:51:01 +0100 Marcus Schopen wrote: > > SpamAssassin usually deals with this problem by looking for > > authentication in the header, but that's not recorded here. > > There is no auth hint in the header when using the submission server. > > Received: from [192.168.178.25

Re: trusted_networks and internal_networks confusion

2016-12-17 Thread Marcus Schopen
Hi, Am Samstag, den 17.12.2016, 13:17 + schrieb RW: > On Fri, 16 Dec 2016 22:41:49 +0100 > Marcus Schopen wrote: > > > > The problem is, that smtp-out.myoffice.de is also a submission server > > for dialup clients. Headers from to to down: > > > > Received: from smtp-out.myoffice.de by MY_S

Re: recent increase in spam getting through

2016-12-17 Thread David Jones
>From: RW >Sent: Saturday, December 17, 2016 8:02 AM >To: users@spamassassin.apache.org >Subject: Re: recent increase in spam getting through   >On Sat, 17 Dec 2016 13:35:16 + >David Jones wrote: >> That mail server IP above is on a very high number of RBLs: >> http://multirbl.valli.org/

Re: recent increase in spam getting through

2016-12-17 Thread RW
On Sat, 17 Dec 2016 13:35:16 + David Jones wrote: > That mail server IP above is on a very high number of RBLs: > http://multirbl.valli.org/lookup/173.230.94.183.html > > The edge MX server 104.197.242.163 must not be doing any > MTA checks of RBLs. As I already mentioned it's normal to g

Re: recent increase in spam getting through

2016-12-17 Thread David Jones
>From: frede...@ofb.net >Sent: Saturday, December 17, 2016 1:35 AM >To: users@spamassassin.apache.org >Cc: John Hardin >Subject: Re: recent increase in spam getting through   >Here's the sample spam: >    From tfioxmns...@mariupol.us  Fri Dec 16 20:30:08 2016 >    Return-Path: >    X-Spam-Che

Re: trusted_networks and internal_networks confusion

2016-12-17 Thread RW
On Fri, 16 Dec 2016 22:41:49 +0100 Marcus Schopen wrote: > The problem is, that smtp-out.myoffice.de is also a submission server > for dialup clients. Headers from to to down: > > Received: from smtp-out.myoffice.de by MY_SERVER_IP > Received: from dialup-client-IP by smtp-out.myoffice.de SpamA