Re: Two different machines running same versoin of SA giving different scores for scores that are commented out

2021-04-24 Thread Steve Dondley
On 2021-04-25 01:00 AM, John Hardin wrote: On Sun, 25 Apr 2021, Steve Dondley wrote: I'm running the same version of SA on the same email on two different machines and getting different scores in for some rules in the report: Machine A gives: 0.0 FSL_BULK_SIG Bulk signature with no

Re: Two different machines running same versoin of SA giving different scores for scores that are commented out

2021-04-24 Thread John Hardin
On Sun, 25 Apr 2021, Steve Dondley wrote: I'm running the same version of SA on the same email on two different machines and getting different scores in for some rules in the report: Machine A gives: 0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe Machine B gives: 1.0 FSL_BULK_SI

Two different machines running same versoin of SA giving different scores for scores that are commented out

2021-04-24 Thread Steve Dondley
I'm running the same version of SA on the same email on two different machines and getting different scores in for some rules in the report: Machine A gives: 0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe Machine B gives: 1.0 FSL_BULK_SIG Bulk signature with no Unsubsc

Re: Script or command for testing new rules to ensure new rules don't generate false positives/negatives?

2021-04-24 Thread John Hardin
On Sat, 24 Apr 2021, Steve Dondley wrote: And if you want to test your rules against a corpus rather than testing against a few one-off spamples, then look into setting up a local masscheck instance. You don't need to upload the results to SA, but it will give you a good overview of how a rul

Re: Script or command for testing new rules to ensure new rules don't generate false positives/negatives?

2021-04-24 Thread Steve Dondley
And if you want to test your rules against a corpus rather than testing against a few one-off spamples, then look into setting up a local masscheck instance. You don't need to upload the results to SA, but it will give you a good overview of how a rule behaves against multiple messages. I'm

Re: Script or command for testing new rules to ensure new rules don't generate false positives/negatives?

2021-04-24 Thread John Hardin
On Sat, 24 Apr 2021, Steve Dondley wrote: On 2021-04-23 05:41 PM, Martin Gregorie wrote: On Fri, 2021-04-23 at 16:28 -0400, Steve Dondley wrote: I'm experimenting with writing a library of my own SA rules and scores. Treat this like any other code development project: use a rule development

Re: Script or command for testing new rules to ensure new rules don't generate false positives/negatives?

2021-04-24 Thread Steve Dondley
On 2021-04-23 05:41 PM, Martin Gregorie wrote: On Fri, 2021-04-23 at 16:28 -0400, Steve Dondley wrote: I'm experimenting with writing a library of my own SA rules and scores. I do this on a separate computer, which has Spamassassin installed but not linked into anything else. It also has a cop

Re: Why single periods in regex in spamassassin rules?

2021-04-24 Thread John Hardin
On Fri, 23 Apr 2021, RW wrote: On Fri, 23 Apr 2021 13:52:40 -0500 (CDT) David B Funk wrote: On Fri, 23 Apr 2021, Steve Dondley wrote: I'm looking at KAM.cf. There is this rule: body__KAM_WEB2 /INDIA based IT|indian.based.website|certified.it.company/i I'm wondering if there is a good

Re: how to disable spamcheck for Outgoing mail

2021-04-24 Thread Matus UHLAR - fantomas
default spamassassin DO scan rfc1918, but there is no rbl that lists ips this is not true. SpamAssassin contains code to avoid querying DNS lists against RFC1919 ranges. internal_networks 192.168.0.0/16 don't do this. Only your mail relays (mx backups and submission servers), should be in i

AW: how to disable spamcheck for Outgoing mail

2021-04-24 Thread mauric
>default spamassassin DO scan rfc1918, but there is no rbl that lists ips >in rfc1918, its a dns waste to test > >internal_networks 192.168.0.0/16 >trusted_networks 192.168.0.0/16 Yes this are done with my own ranges but still the same issue. Sending mail from own domain Will received as sp

Re: KAM_DMARC_REJECT on internal emails

2021-04-24 Thread RW
On Sat, 24 Apr 2021 13:32:09 +0200 Matus UHLAR - fantomas wrote: addresses. > > I still think that DMARC check should be done on edge of internal > network, not anywhere behind it. It's not about that, it's about whether or not you apply it to -> -> "&& !ALL_INTERNAL" does allow the sligh

Re: KAM_DMARC_REJECT on internal emails

2021-04-24 Thread Matus UHLAR - fantomas
>> On 21.04.21 00:11, RW wrote: >> >Anything that enters through through the remote trusted network >> >and hits ALL_TRUSTED will almost certainly pass whatever >> >authentication mechanism are set-up for the domain. >> > >> >The difference between ALL_TRUSTED and ALL_INTERNAL will likely be >> >s

Re: Why does SA add SPF check fail to this message?

2021-04-24 Thread Martin Gregorie
On Sat, 2021-04-24 at 03:22 -0700, Yuri wrote: > All messages from the FreeBSD mailing list are labeled as 'SPF check > fail'. > > Here is the message: > https://bugs.freebsd.org/bugzilla/attachment.cgi?id=224393 > > People said that SA does this by mistake: > https://bugs.freebsd.org/bugzilla/

Re: Why does SA add SPF check fail to this message?

2021-04-24 Thread Matus UHLAR - fantomas
On 24.04.21 03:22, Yuri wrote: All messages from the FreeBSD mailing list are labeled as 'SPF check fail'. Here is the message: https://bugs.freebsd.org/bugzilla/attachment.cgi?id=224393 it's the encapsulated message, but the first header from included message: Received: from mail0.{redacted

Re: Why does SA add SPF check fail to this message?

2021-04-24 Thread Paul Stead
Headers of original mail, for reference : Received: from mail0.{redacted}.com (mail0.{redacted}.com [198.144.192.41]) by mail1.{redacted}.com (8.14.2/8.14.2) with ESMTP id 13MHIACI036176 for ; Thu, 22 Apr 2021 10:18:10 -0700 (PDT) (envelope-from owner-ports-committ...@freebsd.org) Received: from m

Re: Why does SA add SPF check fail to this message?

2021-04-24 Thread Paul Stead
Replied to Yuri directly, This could result of not having internal_networks set. mail2.{redacted} considers mail1.{redacted} to be an external server - thus checking the SPF record for freebsd.org against the IP address of mail1.{redacted} Paul On Sat, 24 Apr 2021 at 11:45, Antony Stone < anton

Re: Why does SA add SPF check fail to this message?

2021-04-24 Thread Antony Stone
On Saturday 24 April 2021 at 12:22:15, Yuri wrote: > All messages from the FreeBSD mailing list are labeled as 'SPF check fail'. I would firstly observe that you (or whomever runs mail0.{redacted}.com) are running SpamAssassin version 3.3.1 (eleven years old now), so therefore i wonder how up-t

Why does SA add SPF check fail to this message?

2021-04-24 Thread Yuri
All messages from the FreeBSD mailing list are labeled as 'SPF check fail'. Here is the message: https://bugs.freebsd.org/bugzilla/attachment.cgi?id=224393 People said that SA does this by mistake: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=255356 Is it a mistake? A bug in SA? Or can