Re: Rules for not passing SPF

2010-02-03 Thread Francis Russell
dar...@chaosreigns.com wrote: > If everyone uses SPF, all we need to block all spam is these rules > (SPF_NOT_PASS alone should do it), and a blacklist of domains that have > SPF records including IPs that send spam. You might also want to read this: http://homepages.tesco.net/J.deBoynePollard/F

Re: Rules for not passing SPF

2010-02-03 Thread Francis Russell
Ned Slider wrote: > It's never going to happen. We can't even get half the banks to > implement measures like SPF or DKIM, and they are getting the hell > phished out of them and are exactly the type of sector you'd expect to > be using such measures to prevent spoofing and making it easier for >

Re: [Sare-users] painting everybody in Taiwan with the same brush

2010-01-28 Thread Francis Russell
Michael Scheidell wrote: > which in itself has a bunged up RDNS . > > Received: from [208.97.132.207] (HELO homiemail-a7.g.dreamhost.com) > (208.97.132.207) > > > host 208.97.132.207 > 207.132.97.208.in-addr.arpa domain name pointer caiajhbdccah.dreamhost.com. > if you don't follow the RFC's, y

Re: Interesting Low Scoring SPAM with odd script

2010-01-12 Thread Francis Russell
Jason Bertoch wrote: > By no means a JS coder, and haven't dug deeper to find out, but couldn't > it be pre-compiled JS and not just random text? > Doubtful. I don't believe JavaScript has a bytecode or any other (except in some JavaScript engines internal representation) compiled format. Franc

Re: Russian spam

2009-01-14 Thread Francis Russell
Benny Pedersen wrote: Unfortunately, these two are because I receive mail via BT/Yahoo who never do a PTR lookup on the IP. > 3.3 TVD_RCVD_IP4 TVD_RCVD_IP4 > 1.6 TVD_RCVD_IPTVD_RCVD_IP Oddly, I cant get this one to fire on my SA install. > 2.0 FROM_EXCESS_BASE64 Fro

Russian spam

2009-01-14 Thread Francis Russell
Anyone know of any good rule-sets to block this sort of spam? http://www.unchartedbackwaters.co.uk/files/russian_spam.txt I find that Pyzor and Razor completely miss it as well as the DNS blacklists (although I believe this one has a relay in one of the Spamhaus ones now). I'm aware of the langua

Re: What does it mean?

2009-01-05 Thread Francis Russell
schnee wrote: > 1: "MIME_HTML_ONLY BODY: Message only has text/html MIME parts" > So what ? Do I have to send a text only part also? All my users can read > HTML. Typically, mailers should send a text version of the message as well, in case the mail client can't read HTML. The text versio

Re: rDNS problem

2008-11-21 Thread Francis Russell
> RDNS_NONE is defined by the following rules: > > meta RDNS_NONE (__RDNS_NONE && !__CGATE_RCVD) > header __RDNS_NONEX-Spam-Relays-Untrusted =~ /^[^\]]+ rdns= / > header __CGATE_RCVD Received =~ /by \S+ \(CommuniGate Pro/ OK, I'm going to have one more go. The RDNS_NONE rule is tri

Re: rDNS problem

2008-11-21 Thread Francis Russell
Jeff Koch wrote: > Hopefully another pair of eyes can help find the reason for this rDNS > error. Here's SA header message: > > * 1.0 RDNS_NONE Delivered to trusted network by a host with no > rDNS > Received: from unknown (HELO cronus.intersessions.com) (74.220.16.65) > > As far as I c

Re: Checking for SPF & DKIM Checks

2008-11-10 Thread Francis Russell
>> Even with the default DKIM scores, I finding I am getting spam that are >> DKIM_VERIFIED causing the score to dip below zero and let the message >> through, for example: >> >> http://micah.riseup.net/1 > > that's spam relayed by a debian list. definitely a different beast... I interpret those

Re: Checking for SPF & DKIM Checks

2008-11-09 Thread Francis Russell
>> Even with the default DKIM scores, I finding I am getting spam that are >> DKIM_VERIFIED causing the score to dip below zero and let the message >> through, for example: >> >> http://micah.riseup.net/1 > > that's spam relayed by a debian list. definitely a different beast... I interpret those

False positives for TVD_RCVD_IP and TVD_RCVD_IP4 rules

2008-11-08 Thread Francis Russell
Greetings fellow users, from what I understand, the TVD_RCVD_IP and TVD_RCVD_IP4 rules are used to determine when messages have been relayed via hosts without domain names. As both of these are just regular expressions, this relies on the various mail relays bothering to do the lookups. My