Re: Looking for advice about limiting DNS queries

8.8. Running your own DNS server seems to be more acceptable to the anti-spam sites. . -- Jeremy

Re: IPv6 issue

On 6/5/22 6:31 pm, Ted Mittelstaedt wrote: For unrelated reasons I had to turn off IPv6 on my incoming mailserver. Spam plummeted.  Like by 80% at least.  Both uncaught and caught spam did. Were there more hostname variations with records than A records? -- Jeremy

Re: Sequential spamassassin scans get different results

is still present in messages processed solely by 'internal'. I'm using the package as supplied by debian/armbian. I assume the 3.4.6-1_all deb. /var/cache/apt/archives/spamassassin_3.4.6-1_all.deb X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on 'internal' -- Jeremy OpenPGP_signature Description: OpenPGP digital signature

Re: Sequential spamassassin scans get different results

o limit spammers? Would I get better results if I greylisted as well as postscreen? Or instead of? -- Jeremy OpenPGP_signature Description: OpenPGP digital signature

Re: I have developed a new method of blocking spam that's a game changer

I'd be willing to test it. -- Jeremy McSpadden | Flux Labs Local - 850-250-5590x501 | Mobile - 850-890-2543 Fax - 850-254-2955 | Toll Free - 877-699-FLUX Web - http://www.fluxlabs.net<http://www.fluxlabs.net/> On Jan 13, 2016, at 7:12 PM, Marc Perkel mailto:supp...@junkemai

Re: sa-update not updating the rules

current version is 1720996 new version is 1720996, skipping channel 1720996 == 1720996 -- Jeremy McSpadden | Flux Labs Local - 850-250-5590x501 | Mobile - 850-890-2543 Fax - 850-254-2955 | Toll Free - 877-699-FLUX Web - http://www.fluxlabs.net<http://www.fluxlabs.net/> On Jan 4, 2016

Re: all connections being refused

Make sure it's running. Check firewall/iptables/selinux -- Jeremy McSpadden | Flux Labs Local - 850-250-5590x501 | Mobile - 850-890-2543 Fax - 850-254-2955 | Toll Free - 877-699-FLUX Web - http://www.fluxlabs.net<http://www.fluxlabs.net/> On Jul 29, 2015, at 12:48 PM, jo

Re: Turning off queries to SORBS

dig +trace and see if your ISP is intercepting queries. -- Jeremy McSpadden | Flux Labs Local - 850-250-5590x501 | Mobile - 850-890-2543 Fax - 850-254-2955 | Toll Free - 877-699-FLUX Web - http://www.fluxlabs.net<http://www.fluxlabs.net/> On May 12, 2015, at 8:49 PM, Chris mailto

Re: The query to URIBL was blocked

Use only 127.0.0.1 as your DNS in /etc/resolv.conf ... Nothing else. -- Jeremy McSpadden | Flux Labs Local - 850-250-5590x501 | Mobile - 850-890-2543 Fax - 850-254-2955 | Toll Free - 877-699-FLUX Web - http://www.fluxlabs.net<http://www.fluxlabs.net/> On May 2, 2015, at 8:31 PM,

Re: Lots of Polish spam

Usually scores are 6 low 10 high. Are you running any RBLs ? -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net<http://www.fluxlabs.net/> | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Feb 24, 2015, at 11:35 AM, Yves Goergen mailto:no

Re: Some tips email gateway

Are you using any RBLs with postfix ? -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net<http://www.fluxlabs.net/> | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Feb 17, 2015, at 1:05 PM, ricky gutierrez mailto:xserverli...@gmail.com&g

Re: Amazon phishing spam

ums of money 0.0 T_REMOTE_IMAGE Message contains an external image -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net<http://www.fluxlabs.net/> | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Feb 12, 2015, at 3:25 PM, Alex Regan mail

Re: Spamassassin doesn't work

http://www.mimedefang.org/node/14 -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net<http://www.fluxlabs.net/> | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Oct 16, 2014, at 7:32 AM, Carlo Filippetto mailto:carlo.filippe...@gmail.com&g

Re: Delays with Check_Bayes

Do not have enough HAM to kick on bayes. -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net<http://www.fluxlabs.net/> | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Aug 20, 2014, at 10:36 AM, "redtailjason" mailto:ja...@redta

Re: Filters Don't Seem to Be Learning

, RP_MATCHES_RCVD=-0.001, T_DKIM_INVALID=0.01] autolearn=no -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net<http://www.fluxlabs.net/> | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Jul 23, 2014, at 12:55 PM, "Asai" mailto:a...@globa

Re: Filters Don't Seem to Be Learning

Would need more info than this; rather vague. If your receiving the same email daily it's more than likely been trained as HAM, but marked as spam through TB. -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net<http://www.fluxlabs.net/> | Endless Solutions Office : 850-250-5590

Re: Dealing with a bad network device affecting DNS lookups

Then I think we can all agree that just extending the timeout is not a fix. You have network issues that should be resolved. -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net<http://www.fluxlabs.net/> | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 8

Re: Dealing with a bad network device affecting DNS lookups

Have you considered running your own DNS server locally ? -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net<http://www.fluxlabs.net/> | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Jul 15, 2014, at 3:47 PM, "Quanah Gibson-Mount&q

Re: production MTA not doing URIBL lookups, why?

What does a debug output show ? On both .. Pastebin -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net<http://www.fluxlabs.net/> | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Jul 11, 2014, at 4:34 PM, "Quanah Gibson-Mount&q

Re: getting tons of SPAM

pastebin .. and do not edit the message, do not remove headers or email addresses -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net<http://www.fluxlabs.net/> | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955

Re: getting tons of SPAM

No mention of RBLs or greylisting ... -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net<http://www.fluxlabs.net/> | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Jul 1, 2014, at 2:06 PM, "Steve Bergman" mailto:sbergma...@g

Re: getting tons of SPAM

... A catchall ? -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net<http://www.fluxlabs.net/> | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Jun 26, 2014, at 9:24 AM, "motty cruz" mailto:motty.c...@gmail.com>> wrote:

Re: Bayer Filter Not Working

Try adding -U to your mailscanner banger/# line. -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net<http://www.fluxlabs.net/> | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Jun 24, 2014, at 5:42 PM, "Bruce Sackett" mailto

Re: CentOS/RHEL repo?

Centalt may have it. I'm not sure. 3.4 is still fairly new. -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net | Endless Solutions Office : 850-250-5590x501 | Cell : 850-890-2543 | Fax : 850-254-2955 On Fri, Mar 14, 2014 at 2:01 PM -0700, "Bowie Bailey" mailto:bowie

Re: dependency hell]

You've still left as all wondering what the purpose of that machine is considering it has no internet access. -- Jeremy McSpadden Flux Labs | http://www.fluxlabs.net<http://www.fluxlabs.net/> | Endless Solutions Office : 850-250-5590x101 | Cell : 850-890-2543 | Fax : 850-254-2955

Re: Errors when processing mail.

Check as to why this directory/file doesn't exist or change paths. -- Jeremy McSpadden Flux Labs, Inc | http://www.fluxlabs.net<http://www.fluxlabs.net/> | Endless Solutions Office : 850-250-5590x101 | Cell : 850-890-2543 | Fax : 850-254-2955 On Jul 14, 2013, at 5:16 PM, "

Re: Bayes - Problem using SQLite

SQLite is/can-be extremely slow with inserts/updates. It uses a temporary file for each write operation. It also waits for the OS to complete the insert/update. … Thats all assuming you can even get it working. -- Jeremy McSpadden Flux Labs, Inc | http://www.fluxlabs.net<http://www.fluxlabs.

Problem with SpamAssassin wiki formatting

shebang line at all; see here where I had to replace the exclamation mark to get that line to appear: http://wiki.apache.org/spamassassin/IntegratedSpamdInPostfix Any chance this could be fixed, or a tip as to how I might get it to work? -- Best regards, Jeremy Morton (Jez)

Added me to wiki contributors?

Hi, I'm told you added me to the Spamassassin wiki contributors list with username jez. Could you please tell me how I can obtain a password for login? I don't remember creating a jez account previously. -- Best regards, Jeremy Morton (Jez)

Re: Is the SpamAssassin wiki dead?

Sorry, I'm not sure what you mean by "added me". I don't think I already had an account with username jez so I was expecting to be send a password too. What should I do? -- Best regards, Jeremy Morton (Jez) On 06/01/2013 14:25, Jeremy McSpadden wrote: Kevin added

Re: Is the SpamAssassin wiki dead?

Kevin added you back on the 31st. Should be done. Happy new year, KAM On 12/28/2012 7:53 AM, Jeremy Morton wrote: Hi, Please add me to the Contributors Group with the wiki username jez. -- Jeremy McSpadden Flux Labs | Endless Solutions Cell : 850-890-2543 | Fax : 850-254-2955 On Jan 6

Is the SpamAssassin wiki dead?

mprove the documentation when they are willing to do so. -- Best regards, Jeremy Morton (Jez)

Request for wiki access

Hi, Please add me to the Contributors Group with the wiki username jez. -- Best regards, Jeremy Morton (Jez)

Re: Somewhat OT: Is this wrong?

Microsoft handles SPF using the Edge Transport service, in 2010. If it is configured on the domain. You are correct with the article, although 2003 is old ... -- Jeremy McSpadden Flux Labs, Inc | http://www.fluxlabs.net<http://www.fluxlabs.net/> | Endless Solutions Office : 850-250-5590

Re: Somewhat OT: Is this wrong?

Topic Last Modified: 2006-04-05 http://technet.microsoft.com/en-us/library/aa996295.aspx .. for Exchange 2010 -- Jeremy McSpadden Flux Labs, Inc | http://www.fluxlabs.net<http://www.fluxlabs.net/> | Endless Solutions Office : 850-250-5590 x 101 | Cell : 850-890-2543 | Fax : 850-254-2955

Pyzor broke after update

3:48.083 [742] dbg: pyzor: [745] finished successfully Jun 15 10:13:48.083 [742] dbg: pyzor: got response: public.pyzor.org:24441 (200, 'OK') 351 0 MailScanner --lint --debug: pyzor: check failed: internal error, python traceback seen in response But cannot find the trace -- Jeremy Mc

Re: Suddenly getting lots of false positives.

Server: google-public-dns-a.google.com Address: 8.8.8.8 Non-authoritative answer: Name:40.152.71.64.list.dnswl.org Address: 127.0.6.3 -- Best regards, Jeremy Morton (Jez) On 27/05/2012 10:41, Niamh Holding wrote: Hello Jeremy, Sunday, May 27, 2012, 10:28:17 AM, you wrote: JM>

Re: Suddenly getting lots of false positives.

I don't see what relevance the DNS servers I use on my my machine have to do with querying dnswl.org - surely dnswl.org shouldn't even know if I'm using Google's nameservers? -- Best regards, Jeremy Morton (Jez) On 27/05/2012 08:53, Niamh Holding wrote: Hello Jeremy, Sa

Re: Suddenly getting lots of false positives.

happening just after that. Can anyone think of why this might have caused the problem and how I can fix it? -- Best regards, Jeremy Morton (Jez) On 24/05/2012 10:14, Jeremy Morton wrote: I've gotten a lot of false positives coming into my inbox lately, and the principle reason for most o

Re: Suddenly getting lots of false positives.

Not sure. I get this: http://pastebin.com/0U3WrgSS -- Best regards, Jeremy Morton (Jez) On 24/05/2012 16:12, Benny Pedersen wrote: Den 2012-05-24 17:03, Jeremy Morton skrev: Nope, but it doesn't actually give an answer section as part of its output. where it timeout or rejected ?,

Re: Suddenly getting lots of false positives.

Nope, but it doesn't actually give an answer section as part of its output. -- Best regards, Jeremy Morton (Jez) On 24/05/2012 16:06, Benny Pedersen wrote: Den 2012-05-24 16:41, Jeremy Morton skrev: I actually get: Host 40.152.71.64.list.dnswl.org not found: 5(REFUSED) dig +

Re: Suddenly getting lots of false positives.

On 24/05/2012 15:30, dar...@chaosreigns.com wrote: On 05/24, Kevin A. McGrail wrote: Normally, I blame a DNS server. See pages like this for more information: http://www.surbl.org/faqs#dnsproxy Yup, that could do it. Icky. Jeremy: You could manually check if you're getting the wron

Re: Suddenly getting lots of false positives.

Where would the rules for these blocklists be, so I can check my rules files to see whether they're there? -- Best regards, Jeremy Morton (Jez) On 24/05/2012 11:09, Niamh Holding wrote: Hello Jeremy, Thursday, May 24, 2012, 10:53:33 AM, you wrote: JM> Interesting that they didn&#

Re: Suddenly getting lots of false positives.

On 24/05/2012 10:37, corpus.defero wrote: On Thu, 2012-05-24 at 10:14 +0100, Jeremy Morton wrote: I've gotten a lot of false positives coming into my inbox lately, and the principle reason for most of them seems to be that they are matching the following rule: -4.0 RCVD_IN_DNSWL_MED

Re: Suddenly getting lots of false positives.

s. Sounds like something from a Monty Python sketch. -- Best regards, Jeremy Morton (Jez)

Re: Missed SPAM

Post what you feel. The ML will help if they can. You can replace IPs and domains etc. -- Jeremy McSpadden On Mar 31, 2012, at 11:19 AM, "joea" wrote: >>>> On 3/31/2012 at 8:22 AM, Michael Scheidell > wrote: >> On 3/31/12 8:04 AM, joea wrote: >>>

Re: sa-update

Sa-update should reload SA, therefore reloading rules. What error are you getting ? -- Jeremy McSpadden On Mar 26, 2012, at 9:46 PM, "j...@j4computers.com" wrote: > After running sa-update, will restarting spamd load the new rulesets? I see > references to "spamassas

Re: uribl lastminute.com listed in uribl whte and is now used for nordea phisting mails (SOLVED)

Leap Year -- Jeremy McSpadden On Mar 2, 2012, at 11:11 AM, "Benny Pedersen" wrote: > Den 2012-03-02 17:50, Axb skrev: >> On 03/02/2012 05:36 PM, Benny Pedersen wrote: >>> just a note to whom it might concern :) >> why no pastebin a sample? > > februar

Re: uribl lastminute.com listed in uribl whte and is now used for nordea phisting mails

Ha. Nice -- Jeremy McSpadden On Mar 2, 2012, at 10:38 AM, "Michael Scheidell" wrote: > On 3/2/12 11:36 AM, Benny Pedersen wrote: >> just a note to whom it might concern :) >> > phisting? > > OUCH. > > > -- > Michael Scheidell, CTO >

Re: Spam messages with no payload

For starters, your using qmail. I know postfix will give you more protection up front with just rbl and certain restrictions that would help quite a bit. Are you running any rbl or dns checks with qmail? -- Jeremy McSpadden On Feb 19, 2012, at 4:46 PM, "Jason Haar" wrote: > I

Re: Spam messages with no payload

Can you pastebin some sample messages + headers ? -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net <http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On 2/18/12 6:55 PM, "neon_overload" wrote: > >I

Re: DNSWL will be disabled by default as of tomorrow

eries therefore banned" which returns a score that is giving a negative score ... has no justification. (sorry for the run on sentence) -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax :

Re: DNSWL will be disabled by default as of tomorrow

Thank you! I raised this question a few months ago and was in awe that it was enabled by default. It has caused quite a few issues that i've seen around the ML. They should return a different value than a negative score. Very bad design. -- Jeremy McSpadden Flux Labs, Inc

Re: dns problems :/

connection refused means your dns servers are not responding properly. Check your entries in /etc/resolv.conf. The format should be: nameserver 1.2.3.4 -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 8

Re: Disable a Rule

n 0.1% are affected by this stricter enforcement ... I have setup bind to do name-caching and no longer doing forwarding. I will continue to examine longs and monitor the system. Thanks for those who took the time to reply w/ enough information, rather than smart comments; or vague 1 liners. -- J

Re: Disable a Rule

Thanks for the help Benny. .. Anyone besides this guy have anything to say ? -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Oct 30, 2011, at 3:40 PM, Benny Pedersen wrot

Re: Disable a Rule

Yes, that is in place. (not a newbie here) -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Oct 30, 2011, at 3:14 PM, Benny Pedersen wrote: On Sun, 30 Oct 2011 20:05:08

Re: Disable a Rule

Very well. DNSMasq setup and running local, yet still returns HI -- Jeremy McSpadden Flux Labs, Inc http://www.fluxlabs.net<http://www.fluxlabs.net/> Endless Solutions Office : 850-588-4626 Cell : 850-890-2543 Fax : 850-254-2955 On Oct 30, 2011, at 3:14 PM, Benny Pedersen wrote: On Sun,

Re: Disable a Rule

Then why would this rule be enabled by default, or even setup for SA out of the box. So your telling me that in order to use this rule, i have to setup a local dns ? i don't think so. I've run SA boxes for years and never had to run a local dns server. -- Jeremy McSpadden Flux Labs

Re: Disable a Rule

org>. spamassassin -t -D < MSGID = -5.0 RCVD_IN_DNSWL_HI RBL: Sender listed at http://www.dnswl.org/, hightrust [98.126.47.12 listed in list.dnswl.org<http://list.dnswl.org>] I am using local dns servers. The server is at SoftLayer's DC. Using their local DNS servers, 10.0.X

Re: Disable a Rule

clean; all are. Does not make sense to me. -- Jeremy McSpadden Flux Labs, Inc On Oct 30, 2011, at 12:54 PM, John Hardin wrote: On Sun, 30 Oct 2011, Jeremy McSpadden wrote: It seems nightly the rule is re-enabled. Don't edit the files that are deep in the SpamAssassin working directories,

Disable a Rule

. -- Jeremy McSpadden

Re: Freemail problem

"Noel Butler" wrote in message news:1297993593.5473.74.camel@tardis... /Very Ancient/ On Thu, 2010-06-10 at 18:40 +0200, Jeremy Fairbrass wrote: Hi, I've noticed what seems to be unexpected behaviour with the Freemail plugin, which I'm hoping someone can shed some

Re: email address forgery

I get the following (bounce back email): "Delivery Status Notification (Failure)" or "Message Undeliverable!" with the original email attached which is spam. PS: I'm using Exim4 with SA-Exim and Spamassassin. Hope this will help for details. Thanks for your help in adv

email address forgery

l spoofing for me on my server. Can anybody explain to me how to do this and how would I be able to test it? (Apologies if this was discussed in the passed of this list.) Thanks Jeremy

Re: Spam tagging not happening

Hi Dominic and Users, I was not using the split configuration of exim4, I'm using the monolithic config at /etc/exim4/exim4.conf.template. So I added this line to my /etc/exim4/exim4.conf.template config file right at the top "local_scan_path = /usr/lib/exim4/local_scan/sa-exim.so" restarted exim4

Re:Spam tagging not happening

", the output is null. Does this mean I don't have sa-exim configured properly? I really appreciate the help guys:-) Jerry On Mon, Oct 18, 2010 at 5:48 PM, Dominic Benson wrote: > On 18/10/10 16:11, Jeremy Van Rooyen wrote: > > > Thanks for the quick reply Dominic, >

Re: Spam tagging not happening

mean I don't have sa-exim configured properly? I really appreciate the help guys:-) Jerry On Mon, Oct 18, 2010 at 5:48 PM, Dominic Benson wrote: > On 18/10/10 16:11, Jeremy Van Rooyen wrote: > > > Thanks for the quick reply Dominic, > > I just checked and the SApermrej

Re: Spam tagging not happening

add a message rule that subject starts with *SPAM* ? Do I add to my local.cf? I'm sure I did this already. On Mon, Oct 18, 2010 at 4:40 PM, Dominic Benson wrote: > On 18/10/10 15:22, Jeremy Van Rooyen wrote: > > > When I look at the rejected emails in the rejected logs f

Re: Spam tagging not happening

ne X-SPF-Guess: neutral X-Spam-Score: 23.9 (+++) X-Spam-Report: Spam detection software So as far a I know, the tagging happens here, but I don't see anything in the email though. On Mon, Oct 18, 2010 at 3:46 PM, John Hardin wrote: > On Mon, 18 Oct 2010,

Spam tagging not happening

Hi all, I need help with my spamassasin configuration. Setup is as follows: Ubuntu (OS), Exim4 (MTA), Spamassasin (Spam Filter). When I look at my logs I can see messages been identified as spam, but it does not get tagged on the email client side. I did look at some forums and I also made the ne

Freemail problem

headers, as shown above. If you know what I mean. However that still seems like there's a bug or something, because I've never had a similar problem with any other rules at all, even with emails sent through a mailing list like this. It's only the FREEMAIL_FROM rule that does this. Any ideas? Cheers, Jeremy

Re: Spamhaus DBL

pport, for example by reusing a SURBL or URIBL configuration for DBL. You risk wrongly flagging legitimate email if you make IP queries to the DBL. ** Also check out the announcement at http://www.spamhaus.org/news.lasso?article=655 which goes into further detail on this new list. Cheers, Jeremy

Re: Spam with my company domain

o you want to prevent from happening? Mail that isn't specifically addressed "To" you not to get to you? Look at the mail on this list: To: users@spamassassin.apache.org Subject: Re: Spam with my company domain From: Jeremy Davila You realize, that would mean you wouldn'

Re: Spam with my company domain

n Wed, 28 Oct 2009, Jeremy Davila wrote: > I'm getting Spam which is addressed to another person in my company , > but it getting sent to me . So in my inbox the To Field is Kristin , but > in Jeremy's inbox. The information in the To: header has nothing to do with who actual

Spam with my company domain

Hi all, I'm getting Spam which is addressed to another person in my company , but it getting sent to me . So in my inbox the To Field is Kristin , but in Jeremy's inbox.

RE: keyword scoring on a per domain basis.

on who the user is, I do not believe this would ever happen due to the users email usage policies (No mailing lists, no personal email, etc) unless the email sent was spam anyway. regards, Jeremy

keyword scoring on a per domain basis.

achieve this? Cheers, Jeremy

Re: [NEW SPAM FLOOD] www.shopXX.net

Why are you bothering with that? It seems unnecessarily complex. Here's my amended rule: /\bwww\s?\W?\s?\w{3,6}\d{2,6}s?\W?\s?(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g)\b/i Best regards, Jeremy Morton (Jez) John Hardin wrote: On Fri, 26 Jun 2009, Pawe�~B T�~Ycza wrote: Dnia 2009-06-23,

Re: Apache.org spam??

To reply to myself I guess that was sent to the spamassassin.apache.org list and the list was BCC'd so it didn't get put into my list folder. Ah well. Best regards, Jeremy Morton (Jez) Jeremy Morton wrote: I recently got this spam that made its way thru SpamAssas

Apache.org spam??

I recently got this spam that made its way thru SpamAssassin: http://pastebin.ca/1474274 Looks like it was received from mail.apache.org which is in the DNSWL.org DB, unsurprisingly. Why would mail.apache.org send out this obvious spam? Best regards, Jeremy Morton (Jez)

Re: SORBS bites the dust

ago I had the same problem and got NO response. Its death actually is good news because it means not so many innocent people will be able to be listed now. Best regards, Jeremy Morton (Jez)

Re: A difficult one to weed out?

John Hardin wrote: On Mon, 22 Jun 2009, Jeremy Morton wrote: John Hardin wrote: On Sun, 21 Jun 2009, Jeremy Morton wrote: > My SpamAssassin apparently isn't checking this blocklist; how do I get > it to? Another highly-regarded DNSBL that listed that IP is zen.spamhaus.org, whi

Re: SORBS bites the dust

cidentally blacklist your domain. You then have to pay their tithe money to get people to start receiving your e-mail again. I say that sucks. BTW, it happened to my domain, I tried to contact them, and got one automated response e-mail. Nothing more. Good riddance to them. Best regar

Re: SORBS bites the dust

All together now, 3... 2... 1... WOOHOOO!!! rich...@buzzhost.co.uk wrote: Noted this over at NANAE; QUOTE: All, Please feel free to forward this message to any other location/mailing list. It comes with great sadness that I have to announce the imminent closure of SORBS. The

Re: A difficult one to weed out?

John Hardin wrote: On Sun, 21 Jun 2009, Jeremy Morton wrote: My SpamAssassin apparently isn't checking this blocklist; how do I get it to? Another highly-regarded DNSBL that listed that IP is zen.spamhaus.org, which includes the cbl feed. A lot of people trust zen enough to use it at th

Re: A difficult one to weed out?

My SpamAssassin apparently isn't checking this blocklist; how do I get it to? Best regards, Jeremy Morton (Jez) Benny Pedersen wrote: On Sun, June 21, 2009 12:04, Jeremy Morton wrote: http://pastebin.com/m3b9629b6 http://cbl.abuseat.org/lookup.cgi?ip=190.244.172.161

A difficult one to weed out?

Best regards, Jeremy Morton (Jez)

Re: Dealing with backscatter

Another one, from Lyris ListManager, subject: "re: your email message" These damn mailing lists cause ridiculous backscatter. Can't the admins take a bit more respondibility as to the crap they return to the so-called 'sender'? Best regards, Jeremy Morton (Jez) Jer

Dealing with backscatter

s this, rule: -4.0 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/, medium trust ... meaning the mail probably won't get blocked by other factors. What can I do? Best regards, Jeremy Morton (Jez)

Re: new spam image with random body message

to my scanning, that were mentioned by rich...@buzzhost? Is there a good reason why a default cPanel install might not include these, like checking in them takes up significantly more resources? Best regards, Jeremy Morton (Jez) Cory Hawkless wrote: The RBL is a good point, I'm only getti

New slew of spams

spam. What do your SpamAssassin analyses give of this e-mail, and any tips as to how I can get these marked as spam? Best regards, Jeremy Morton (Jez)

New image spam

34.html I don't suppose there any rules around to deal with anything like this? I suppose theoretically you might get a ham e-mail with just an inline image and not much content... although I can't remember ever having one. Best regards, Jeremy Morton (Jez)

Re: Out of interest

Mind telling me which DNSBLs you subscribe to and how I subscribe to them? Best regards, Jeremy Morton (Jez) Ned Slider wrote: Jeremy Morton wrote: ... what do you guys get when you put this through your SA install? http://rafb.net/p/0z7rXo65.html Mine only gives me a Bayesian spam

Out of interest

higher? Best regards, Jeremy Morton (Jez)

Re: Another yukky email

Karsten Bräckelmann wrote: On Fri, 2009-05-15 at 18:45 +0100, Jeremy Morton wrote: Here's another e-mail that got through SpamAssassin: http://rafb.net/p/cFMnIy61.html Backscatter. These types of arbitrarily phrased "I changed my email address" auto-responses are pretty muc

Another yukky email

Is my Bayesian filtering screwed up? What score does your SA install give for this message? Best regards, Jeremy Morton (Jez)

Re: What score does this get?

Karsten Bräckelmann wrote: On Fri, 2009-05-15 at 09:25 +0100, Jeremy Morton wrote: Another request, please: what score does SpamAssassin give this email for you? http://rafb.net/p/FMejnS80.html Hmm, that looks like a stupid auto-response, likely backscatter. Subject: Ihre Anfrage an AVM

Re: Why aren't the right rules matching?

Karsten Bräckelmann wrote: On Fri, 2009-05-15 at 17:26 +0100, Jeremy Morton wrote: Karsten Bräckelmann wrote: A: Because they are not defined. (See second half of this post.) Where did you come across that rule at all? How did you get the impression it should be in your stock install

Re: Manually changing rule weightings?

Yes. All I could find was stuff about creating your own rules, not actually changing the weightings of existing rules. Best regards, Jeremy Morton (Jez) Matus UHLAR - fantomas wrote: On 15.05.09 17:28, Jeremy Morton wrote: How do I manually override the default scores that SA assigns to

  1   2   3   >