Re: Scoring Philosophy?

2017-11-25 Thread David Jones
On 11/25/2017 04:40 PM, RW wrote: On Sat, 25 Nov 2017 14:37:12 -0600 David Jones wrote: The default SA rules handle Paypal spoofing pretty well with def_whitelist_from_spf in 60_whitelist_spf.cf. There are def_whitelist entries for amazon domains too. But these entries don't handle spoofing.

Re: Scoring Philosophy?

2017-11-25 Thread RW
On Sat, 25 Nov 2017 14:37:12 -0600 David Jones wrote: > The default SA rules handle Paypal spoofing pretty well with > def_whitelist_from_spf in 60_whitelist_spf.cf. There are def_whitelist entries for amazon domains too. But these entries don't handle spoofing. > Adding "Paypal" and > vari

Re: Scoring Philosophy?

2017-11-25 Thread Martin Gregorie
On Sat, 2017-11-25 at 14:37 -0600, David Jones wrote: > With that rule as it stands, an easily spoofed "Amazon > " would not hit FAKE_AMAZON_FROM. Even if the > rule specified "@amazon.com," then native DMARC support would be > needed to block spoofed From: headers for the next amazon.com > spoof

Re: Scoring Philosophy?

2017-11-25 Thread David Jones
On 11/25/2017 01:09 PM, Martin Gregorie wrote: On Sat, 2017-11-25 at 11:41 -0600, Jerry Malcolm wrote: Thanks so much for all the info. I have installed KAM rules, and I've started becoming a ninja writing my own (simple) rules. MUCH improved results (amazing when you finally learn what your d

Re: Scoring Philosophy?

2017-11-25 Thread Martin Gregorie
On Sat, 2017-11-25 at 11:41 -0600, Jerry Malcolm wrote: > Thanks so much for all the info. I have installed KAM rules, and > I've > started becoming a ninja writing my own (simple) rules. MUCH > improved > results (amazing when you finally learn what your doing) > > I figure before this is

Re: Scoring Philosophy?

2017-11-25 Thread David Jones
On 11/25/2017 12:20 PM, Jerry Malcolm wrote: Thanks, Dave.  Now I'm REALLY glad I didn't try to figure this one out on my own What you are recommending makes sense.  But doubt I'd have stumbled onto this solution on my own :-) Jerry Sure. I totally understand. It takes a bit of expe

Re: Scoring Philosophy?

2017-11-25 Thread Jerry Malcolm
On 11/25/2017 12:02 PM, David Jones wrote: On 11/25/2017 11:41 AM, Jerry Malcolm wrote: Thanks so much for all the info.  I have installed KAM rules, and I've started becoming a ninja writing my own (simple) rules.  MUCH improved results (amazing when you finally learn what your doing) I

Re: Scoring Philosophy?

2017-11-25 Thread David Jones
On 11/25/2017 11:41 AM, Jerry Malcolm wrote: Thanks so much for all the info.  I have installed KAM rules, and I've started becoming a ninja writing my own (simple) rules.  MUCH improved results (amazing when you finally learn what your doing) I figure before this is all over with, I'm goi

Re: Scoring Philosophy?

2017-11-25 Thread Jerry Malcolm
Thanks so much for all the info.  I have installed KAM rules, and I've started becoming a ninja writing my own (simple) rules.  MUCH improved results (amazing when you finally learn what your doing) I figure before this is all over with, I'm going to have to become very knowledgeable about

Re: NOTE: Warning to Abusers of Update Servers

2017-11-25 Thread David Jones
On 11/25/2017 06:35 AM, Rupert Gallagher wrote: I hardly see any difference: with or without sa updates, the sa grades are always too low to be useful. If I disable my own filters, and let sa do the job with its default rules, the ham/spam ratio is ~10%-90%. With my rules, I get ~95%-5% inste

Re: NOTE: Warning to Abusers of Update Servers

2017-11-25 Thread Rupert Gallagher
I hardly see any difference: with or without sa updates, the sa grades are always too low to be useful. If I disable my own filters, and let sa do the job with its default rules, the ham/spam ratio is ~10%-90%. With my rules, I get ~95%-5% instead. I think that sa is not different from other re

Re: NOTE: Warning to Abusers of Update Servers

2017-11-25 Thread Jens Schleusener
On Thu, 23 Nov 2017, Kevin A. McGrail wrote: On 11/23/2017 6:31 PM, Dave Warren wrote: Would more mirrors be useful? I've got a ton of spare upstream bandwidth and am in the progress of setting up a few mirrors for other projects. Sure.  Always helps to spread the load more. All you have to