Re: Anyone have a rule to detect "Dear xxx" in the body of the message where the "To:" address is xxx@domain?

2024-07-19 Thread Grant Taylor via users
On 7/19/24 5:34 AM, giova...@paclan.it wrote: do you intend to have a rule like this one ? header __TO_NAME To:name =~ /(?.*)/ body   DEAR_NAME /Dear %{TO_NAME}/ Once I'm dealing with versions of SpamAssassin that support such, yes. I'm currently caring for and feeding a small group o

Re: Anyone have a rule to detect "Dear xxx" in the body of the message where the "To:" address is xxx@domain?

2024-07-18 Thread Grant Taylor via users
On 7/18/24 15:58, Mark London wrote: I asked ChatGPT how to test for a "Dear 'username'".  After a bit of work, I got working code. Okay. ChatGPT knows perl. I question the value of "knows" as in knowledge of Perl. I already had a Perl file EvalTests.pm file with customized Perl eval func

Re: Anyone have a rule to detect "Dear xxx" in the body of the message where the "To:" address is xxx@domain?

2024-07-17 Thread Grant Taylor via users
On 7/17/24 18:04, Matija Nalis wrote: I.e. would you consider it to be significantly less likely to be spam if it contained "Dear Elizabeth," while being addressed to "mark@domain" instead of to "elizabeth@domain" ? I've seen quite a bit of spam that opens message bodies with: Where is

Re: ChatGPT > Spamassassin? :) -- move along, this is not the reply you are looking for.

2024-06-25 Thread Grant Taylor via users
On 6/25/24 12:21 PM, Adam Bowen wrote: I asked a well known chatbot: What would Bill Cole say if he was asked about integrating AI in to spamassassin? LOL I needed that laugh. Thank you Adam. -- Grant. . . . unix || die

Re: OT: Trigger words in email addresses?

2024-04-08 Thread Grant Taylor via users
On 4/8/24 5:44 AM, Antony Stone wrote: - make your systems transparent so that people feel they understand what's happening and when at different stages in the process - don't create a "corporate black box" which customers can't understand I'll add to this and say that URLs that include things

Re: OT: Trigger words in email addresses?

2024-04-07 Thread Grant Taylor via users
Below is my opinion, it's worth everything you paid for it. But I do suggest you read it and think about it for a few minutes. On 4/7/24 20:40, Jerry Malcolm wrote: I send the validation email from donotre...@xyz.com. I absolutely hate the do not reply type email addresses as you're trying

Re: Correct way to allowlist an IP from DNSBL checks when it's not the final Received?

2023-09-28 Thread Grant Taylor via users
On 9/27/23 2:15 PM, Andy Smith wrote: Hi, Hi, The IP address of a supplier is currently listed by Spamhaus SBL-CSS. Oops. How would I go about allowlisting this IP address against DNSBL hits? Ideally for a specified range of from addresses and/or envelope senders, but for every sender if

Re: OT - Re: DNFTEC - was My apologies

2023-08-06 Thread Grant Taylor via users
On 8/6/23 12:04 AM, David B Funk wrote: For the most part they can be pretty much interchangeable but slight shading: EC -> alignment: neutral/chaotic T -> alignment: evil IE an EC can be unpredictable and occasionally positive but at a cost T is pretty predictability undesirable Ah ha! Tha

Re: OT - Re: DNFTEC - was My apologies

2023-08-05 Thread Grant Taylor via users
On 8/5/23 6:42 PM, Martin Gregorie wrote: Yes given that he is Sorry, I as asking for differences between Energy Creatures and Trolls. I agree with your advice about the particular EC / T. I'm still trying to understand the conceptual difference between an EC and a T or if they are synonyms

OT - Re: DNFTEC - was My apologies

2023-08-05 Thread Grant Taylor via users
On 8/5/23 1:51 PM, Kevin A. McGrail wrote: REDACTED is the definition of something I learned decades ago as an energy creature. Is there anything to differentiate an Energy Creature from a Troll? The tricky thing about this particular ${ENTITY} is that they are seemingly on topic and seem to

PSA: ${HE} is now using a new email address.

2023-08-05 Thread Grant Taylor via users
On 8/5/23 12:23 PM, Grant Taylor via users wrote: The catch is that he keeps tripping up people that have not had the ... experience of dealing with him and thus have not ... quieted him yet. For those of you that have started filtering someone -- who I'm not going to name -- ${HE

Re: My apologies

2023-08-05 Thread Grant Taylor via users
On 8/5/23 8:04 AM, Ralph Seichter wrote: Well, that is what local mail killfiles are for. The world is sadly full of morons, but one does not necessarily have to accept mail from them. Agreed. The catch is that he keeps tripping up people that have not had the ... experience of dealing with

Re: My apologies

2023-08-03 Thread Grant Taylor via users
Having myself been through what Thomas is appologizing for, I have some comments on what Reindl H. is doing. On 8/3/23 3:06 PM, Ken D'Ambrosio wrote: I ... think he should be blocked. He /is/ blocked from from sending messages to / through the mailing list. I've been online for over 40 years

Re: Ensuring SPF/DKIM for @gmail.com

2023-07-27 Thread Grant Taylor via users
On 7/27/23 6:25 AM, Matus UHLAR - fantomas wrote: I use spamass-milter on my system and amavisd-milter on other systems especially to be able to reject spam at SMTP time. Definitely a good thing. :-) You just should not use it for "outgoing" mail from your clients, so they don't complain abou

Re: Ensuring SPF/DKIM for @gmail.com

2023-07-26 Thread Grant Taylor via users
On 7/26/23 7:20 PM, Matija Nalis wrote: I'd appreciate more civil expressions of disagreement +1 I personally know several people who still use procmail today, sooo... +1 That at least I can attest is not always the case (I still see systems with custom sendmail.cf which nobody dares to t

Re: Ensuring SPF/DKIM for @gmail.com

2023-07-26 Thread Grant Taylor via users
On 7/26/23 2:09 PM, Matija Nalis wrote: Only way to make SPF never incorrectly fail/softwail is to use "+all", but that kind of kills its point :-) I question the veracity of that. Is SPF failing to perform it's intended function if an unauthorized server is blocked from sending email with an

Re: Ensuring SPF/DKIM for @gmail.com

2023-07-26 Thread Grant Taylor via users
On 7/26/23 1:44 PM, Marc wrote: so your ip does not generate a softfail or fail I assume that you mean so that your outbound SMTP server is actually authorized in some capacity and fall under "all". Is that correct? When you configure your spf your result is either pass, softfail or fail I

Re: Ensuring SPF/DKIM for @gmail.com

2023-07-26 Thread Grant Taylor via users
On 7/26/23 2:34 AM, Benny Pedersen wrote: milters should not be spam scanners, spamassassin is better {spamass-milter,milter-spamc} combined with SpamAssassin cause me to question the veracity of that statement. Milter implies doing the filtering during the SMTP transaction. I consider the

Re: Ensuring SPF/DKIM for @gmail.com

2023-07-26 Thread Grant Taylor via users
On 7/26/23 1:44 AM, Marc wrote: asking them to correctly setup spf is mostly enough. At the risk of starting a flame war... What does "correctly setup SPF" mean to you? What makes your opinion better than someone else's opinion that differs? (I take it for granted that someone will have a d

Re: Sudden surge in spam appearing to come from my email address

2023-07-17 Thread Grant Taylor via users
On 7/17/23 6:07 PM, Reindl Harald wrote: because we have 2023 and in the last decade everybod with a brain was using spf and sender-spoofing-rejection fro envelopes I wish that was the case. There was a recommendation on mailop less than a week ago that people only set up SPF records to appea

Re: Sudden surge in spam appearing to come from my email address

2023-07-17 Thread Grant Taylor via users
On 7/17/23 4:49 PM, Reindl Harald wrote: Alias expansion does this is not a mailing list What definition are you using for a mailing list? Do you consider Majordomo to be a mailing list? Because as far as I'm concerned, alias expansion in the MTA is where mailing lists originated. in the

Re: Sudden surge in spam appearing to come from my email address

2023-07-17 Thread Grant Taylor via users
On 7/17/23 4:29 PM, Reindl Harald wrote: no single mailing-list on this planet does this - period Can we agree to disagree? Maybe no /contemporary/ mailing list. But there have been -- and I contend still are -- LOTS of mailing lists that did / do this very thing. .forward does this. Alias

Re: Sudden surge in spam appearing to come from my email address

2023-07-17 Thread Grant Taylor via users
On 7/16/23 5:57 PM, Benny Pedersen wrote: why accept local envelope SENDER domains on port 25 ? Do you subscribe to any mailing lists that don't rewrite the sender? Thus your mail server would receive messages that you sent to the mailing list as your SENDING domain on port 25 inbound from th

Re: Sudden surge in spam appearing to come from my email address

2023-07-16 Thread Grant Taylor via users
On 7/16/23 12:41 AM, Matija Nalis wrote: So, it fails SPF, but DKIM passes. Meaning, your mail would pass normally modern servers which check both. That is predicated on the receiving server(s) not rejecting the message for SPF failure. You probably might want to use some nice frontend to vi

Re: Sudden surge in spam appearing to come from my email address

2023-07-16 Thread Grant Taylor via users
On 7/16/23 9:37 AM, Thomas Cameron wrote: It does clarify, ... :-) ... but unfortunately, it doesn't alleviate my concerns. :-/ I totally understand why SPF et al. are good ideas. :-) But I swear, I feel like they introduce darned near as many problems as they "solve." I question th

Re: Sudden surge in spam appearing to come from my email address

2023-07-15 Thread Grant Taylor via users
On 7/15/23 10:04 PM, Thomas Cameron wrote: I'd love to do this, but see below. I get TONS of warnings every time I send email to lists (even this list) that make me hesitant to do hard fails. I understand and appreciate what you're describing. I do, as well, but mailing lists outside of my sph

Re: Sudden surge in spam appearing to come from my email address

2023-07-15 Thread Grant Taylor via users
On 7/15/23 2:00 AM, Reindl Harald wrote: SPF don't care about the visible From-header I agree that SPF doesn't (SHOULDN'T) care about the RFC522.From header. However my experience has been that the vast majority of messages that are spoofing the RFC522.From header are also spoofing the RFC52

Re: Sudden surge in spam appearing to come from my email address

2023-07-14 Thread Grant Taylor via users
On 7/14/23 6:06 PM, Thomas Cameron wrote: I'm trying to figure out how to block this stuff. Something like "if it appears to come from me, but it's not actually coming from my email server," block it. SPF with hard fail in your own domain /and/ filtering that respects SPF hard fail will almos

Re: Espoofer - An Email Spoofing Testing Tool That Aims To Bypass SPF/DKIM/DMARC And Forge DKIM Signatures

2022-12-28 Thread Grant Taylor via users
On 12/28/22 10:32 AM, Greg Troxel wrote: It would be great if someone(tm) went through the blackhat pdf and wrote rules for all the evasions, and fixed the MTAs etc. I have seen and heard discussion about the raft number of bugs fixed 30 - 90 days after the annual Blackhat / Pwn2Own conference

Re: Espoofer - An Email Spoofing Testing Tool That Aims To Bypass SPF/DKIM/DMARC And Forge DKIM Signatures

2022-12-28 Thread Grant Taylor via users
On 12/28/22 6:17 AM, Kevin A. McGrail wrote: Sigh.  Yet another borderline ethical posting / tool like far too many pentesters who think transparency is the ultimate way to move the needle of security Many tools can be used for both good and evil. I have yet to find a kitchen knife that can te

Facepalm

2022-11-23 Thread Grant Taylor via users
I am terribly sorry. I accidentally forwarded one (or more) messages to the SpamAssassin mailing list which I meant to forward to SpamCop. High-latency remote control, address prefix collision, and lack of sleep are contributing factors. I will update address books to reduce likelihood of colli

Fwd: #1 Secret to PERFECT Blood Sugar

2022-11-23 Thread Grant Taylor via users
-- Grant. . . . unix || die --- Begin Message ---   If you’re never to get an email from me click  here:https://click.superiorbrainhealth.net/?t=u&schedule_campaign_id=NzA0Ng%3D%3D&subscriber_id=MTYwNjg3OTQ%3D&ids=MjYw__MjY1MTU1MzY3__NDY4  and say goodbye forever :-( -

Re: Gmail confidential mode

2022-11-17 Thread Grant Taylor via users
On 11/17/22 10:13 PM, Dave Warren wrote: This isn't e-mail, it's a hosted text document and a link sent by email. It is functionally the same as putting something on a (vaguely) private PasteBin and telling your recipient where to go look at it. Agreed. I have read about some email encryption

Re: spam subject marking

2022-11-17 Thread Grant Taylor via users
On 11/17/22 9:00 AM, Bill Cole wrote: Easier said than done. It's actually quite easy to do. But most people don't want to do what I think should be done. IMHO, the email list itself is a 1st class / proper entity that you are emailing or reading email from. -- I'm not emailing Bill or G

Re: spam subject marking

2022-11-16 Thread Grant Taylor via users
On 11/16/22 4:46 AM, Greg Troxel wrote: Can you expand on that? I'll try. My understanding is that few MUAs test DKIM signatures /client/ /side/. -- The only exception that I'm aware of is that there was a Thunderbird add-on that would test DKIM signatures /client/ /side/. Almost all DKIM

Re: spam subject marking

2022-11-15 Thread Grant Taylor via users
On 11/15/22 1:16 PM, Marc wrote: Hmmm, good point, not really thought about this even. Are email clients complaining about this? Few email clients are testing DKIM. Some servers are testing DKIM. Some systems are mis-treating DKIM failure as something more sever than the specification allows

Re: How to incorporate network blocks

2022-11-14 Thread Grant Taylor via users
On 11/11/22 10:10 AM, Bill Cole wrote: From my bashrc... # type cidrcon cidrcon is a function cidrcon () { for a in $*; do echo $a; done | perl -e "use Net::CIDR::Lite; \$cidr = Net::CIDR::Lite->new(<>) ; \$_ = join (\"\n\",\$cidr->list) ; print \"\$_\n\";" } Oh ...

Re: How to incorporate network blocks

2022-11-11 Thread Grant Taylor via users
On 11/11/22 9:09 AM, Bert Van de Poel wrote: - IP/CIDR lists like the one you mention, but also lists like Stop Forum Spam (https://www.stopforumspam.com/) I cron fetch then add to an ipset with a DROP (which is quite similar to what others are suggesting). Stop Forum Spam seems interesting.

Re: How to incorporate network blocks

2022-11-10 Thread Grant Taylor via users
On 11/10/22 9:54 AM, Joey J wrote: Hello All, Hi, I'm trying to see if there is a way to incorporate network ranges into SA to essentially flag messages. N.B. at least one of the lists below is individual IPs and not networks / ranges of IPs. -- I'm not sure how to square that peg with y

Re: Gmail confidential mode

2022-10-16 Thread Grant Taylor via users
On 10/16/22 8:14 AM, Alex wrote: Hi, Hi, What do you know about "Gmail confidential mode" emails? Not much. I'm starting to see a few of these come in to users now, and not sure how to treat them. I think the /notification/ emails that Gmail sends for confidential messages are /probabl

Re: Supposed bounces

2022-07-18 Thread Grant Taylor via users
On 7/18/22 5:30 PM, Noel Butler wrote: Which is a joke, because it does not, and qmails ezmlm has never included enough of the headers telling us _why_ we rejected it. Your opinion of the notification doesn't change the intention behind the notification. Most of the notifications that I see

Re: Supposed bounces

2022-07-18 Thread Grant Taylor via users
On 7/18/22 4:23 PM, @lbutlr wrote: Don't know why this didn't go through. chuckle The copy with your comment /did/. But I suppose the message that prompted you to make the comment didn't. That is what it is SUPPOSED to be. What it actually is is something else. Every version of what you

Re: Supposed bounces

2022-07-13 Thread Grant Taylor via users
On 7/13/22 12:19 PM, @lbutlr wrote: So, a supposed bounce from also three years ago. And that bounce did not come from my mail server as I have never run qmail. No IP addresses, no Received headers, nothing that could possibly be used to figure out what is going on here. I think this is a cou