Re: phishing by deceptive From address detection

2019-12-17 Thread RW
On Tue, 17 Dec 2019 16:15:37 -0500 AJ Weber wrote: > Just looking at a phishing email I received and at first glance I > wasn't sure how SA (or more-specifically my SA install/configuration) > didn't score this as spam. > > Looks like I have a whitelist setup for alerts from comcast (probably > a

Re: Warning from users@spamassassin.apache.org

2019-12-17 Thread MAILIST
> Hi! This is the ezmlm program. I'm managing the > users@spamassassin.apache.org mailing list. > > > Messages to you from the users mailing list seem to > have been bouncing. I've attached a copy of the first bounce > message I received. Hi, ezmlm, Yes, we have trained our Spamassassin to block

phishing by deceptive From address detection

2019-12-17 Thread AJ Weber
Just looking at a phishing email I received and at first glance I wasn't sure how SA (or more-specifically my SA install/configuration) didn't score this as spam. Looks like I have a whitelist setup for alerts from comcast (probably a bad idea, but let's address that separately). The followi

Re: Whitelist a domain for the URI_HEX check?

2019-12-17 Thread Henrik K
On Tue, Dec 17, 2019 at 05:41:53PM +, RW wrote: > On Tue, 17 Dec 2019 12:07:34 -0500 > Sean Hennessey wrote: > > > Is it possible to whitelist a domain for the URI_HEX check like you > > can with the uridnsbl_skip_domain directive? > > No. > > It currently only scores 0.1, which isn't worth

Re: Whitelist a domain for the URI_HEX check?

2019-12-17 Thread RW
On Tue, 17 Dec 2019 12:07:34 -0500 Sean Hennessey wrote: > Is it possible to whitelist a domain for the URI_HEX check like you > can with the uridnsbl_skip_domain directive? No. It currently only scores 0.1, which isn't worth the trouble of individual exceptions. If you are seeing anything else

Whitelist a domain for the URI_HEX check?

2019-12-17 Thread Sean Hennessey
Is it possible to whitelist a domain for the URI_HEX check like you can with the uridnsbl_skip_domain directive? Linux (Debian/Ubuntu) with 3.3.1 used for testing.