Re: Trusted network mail spam detection

2019-10-16 Thread Bill Cole
On 16 Oct 2019, at 18:11, Simon Wilson wrote: Quoting Bill Cole : On 16 Oct 2019, at 7:55, Simon Wilson wrote: Quoting Tom Hendrikx : [...] RDNS_DYNAMIC tries to exclude authenticated email. Are you accepting email from senders without authentication? Or maybe your trusted_networks/intern

Re: Trusted network mail spam detection

2019-10-16 Thread Simon Wilson
Quoting Bill Cole : On 16 Oct 2019, at 7:55, Simon Wilson wrote: Quoting Tom Hendrikx : [...] RDNS_DYNAMIC tries to exclude authenticated email. Are you accepting email from senders without authentication? Or maybe your trusted_networks/internal_networks are misconfigured, so the authen

Re: Trusted network mail spam detection

2019-10-16 Thread Grant Taylor
On 10/16/19 6:57 AM, Simon Wilson wrote: So how do I configure it such that if it's an authenticated submission (587) mail through my mail host at (int)192.68.1.230/(ext)119.18.34.29 further upstream RECEIVED headers are NOT scanned by SA for dynamic IP? Am I still totally misunderstanding trus

Re: Hint to write a [raw]body rule

2019-10-16 Thread Giovanni Bechis
On 10/16/19 4:11 PM, Bill Cole wrote: > On 16 Oct 2019, at 8:44, Giovanni Bechis wrote: > >> I have lot of emails like this one (redacted): >> https://pastebin.com/v5NCRK9d >> and I would like to write a rule that matches the "=0D" that appears on some >> lines, > > Are you sure? > > That's a Q

Re: Trusted network mail spam detection

2019-10-16 Thread Bill Cole
On 16 Oct 2019, at 7:55, Simon Wilson wrote: Quoting Tom Hendrikx : [...] RDNS_DYNAMIC tries to exclude authenticated email. Are you accepting email from senders without authentication? Or maybe your trusted_networks/internal_networks are misconfigured, so the authentication is not properly

Re: AWL

2019-10-16 Thread Bill Cole
On 16 Oct 2019, at 9:19, John Schmerold wrote: Is the AWL score generated based on the experience of my server, or are other external sources feeding AWL? AWL is entirely local. The keys are tuples of the first 3 octets of the client IP and the sender address. On a new server, it is general

Re: Hint to write a [raw]body rule

2019-10-16 Thread Bill Cole
On 16 Oct 2019, at 8:44, Giovanni Bechis wrote: I have lot of emails like this one (redacted): https://pastebin.com/v5NCRK9d and I would like to write a rule that matches the "=0D" that appears on some lines, Are you sure? That's a QP-encoded carriage return. I would expect a lot of them in

AWL

2019-10-16 Thread John Schmerold
Is the AWL score generated based on the experience of my server, or are other external sources feeding AWL? I have a client, they sent me an email, they were dinged with an AWL of 3.575, my SA server was configured a couple days ago, so it hasn't had much time to auto-learn much of anything, I

Re: Trusted network mail spam detection

2019-10-16 Thread Simon Wilson
Quoting Simon Wilson : Quoting Tom Hendrikx : On 16-10-19 12:19, Simon Wilson wrote: Hi, I have a Horde system submitting to a postfix/amavisd-new/spamassassin server for spam detection (different servers, same subnet). I *do* consciously run SA over internally submitted emails to catch

Hint to write a [raw]body rule

2019-10-16 Thread Giovanni Bechis
I have lot of emails like this one (redacted): https://pastebin.com/v5NCRK9d and I would like to write a rule that matches the "=0D" that appears on some lines, any hints ? Giovanni

Re: Trusted network mail spam detection

2019-10-16 Thread Simon Wilson
Quoting Tom Hendrikx : On 16-10-19 12:19, Simon Wilson wrote: Hi, I have a Horde system submitting to a postfix/amavisd-new/spamassassin server for spam detection (different servers, same subnet). I *do* consciously run SA over internally submitted emails to catch compromised accounts (it

Re: Trusted network mail spam detection

2019-10-16 Thread Tom Hendrikx
On 16-10-19 12:19, Simon Wilson wrote: Hi, I have a Horde system submitting to a postfix/amavisd-new/spamassassin server for spam detection (different servers, same subnet). I *do* consciously run SA over internally submitted emails to catch compromised accounts (it happened once to me when a

Trusted network mail spam detection

2019-10-16 Thread Simon Wilson
Hi, I have a Horde system submitting to a postfix/amavisd-new/spamassassin server for spam detection (different servers, same subnet). I *do* consciously run SA over internally submitted emails to catch compromised accounts (it happened once to me when a family member's email password was c