qq.com rule false positives

2023-11-19 Thread Sean Greenslade
Hi, all. I received a mail from a qq.com user that went over the spam threshold. From the rules that triggered, it looks like the dynamic rDNS rules triggered on the qq.com sending server, which contributed around 4.2 points to this message (which was not spam). Relevant headers: X-Spam-Checker-Ve

Re: Really hard-to-filter spam

2023-08-05 Thread Sean Greenslade
On Fri, Aug 04, 2023 at 08:38:24AM -0500, Thomas Cameron wrote: > It was a typo, sorry. I have a cron job that uses --spam against the spam > folder, and --ham against the ham folder. I just copied and pasted poorly. > This is the actual script for my account: > > [thomas.cameron@mail-east ~]$ cat

Re: Really hard-to-filter spam

2023-08-04 Thread Sean Greenslade
On Wed, Aug 02, 2023 at 04:17:22PM -0500, Thomas Cameron via users wrote: > On 8/2/23 15:52, David B Funk wrote: > > > > I have the users move spam to an imap folder, and then run (via the user's > cron job): > > sa-learn --mbox --spam /home/[username]/mail/spam > > If something is flagged as sp

Re: Memory requirement for SpamAssassin/Postfix/Roundcube/Dovecot stack

2022-05-27 Thread Sean Greenslade
On Thu, May 26, 2022 at 02:12:01PM -0600, Grant Taylor wrote: > On 5/26/22 8:32 AM, Ian Evans wrote: > > Is it safe to assume that a $5/mth 1gig memory account will laugh at the > > resources needed to run a SpamAssassin/Postfix/Roundcube/Dovecot/Nginx > > stack and not ever break a sweat? > > Sad

Re: SPF check though external relay

2017-11-13 Thread Sean Greenslade
>On 11.11.17 20:06, Sean Greenslade wrote: >>SPF checks the final server that transmits the mail. If you are using >a relay server, that server will need to be in the SPF records. > >no. Only outgoing mail servers really need to be in SPF records. Sorry, I misread the original m

Re: SPF check though external relay

2017-11-11 Thread Sean Greenslade
On November 11, 2017 5:31:08 PM PST, Stephan Herker wrote: >I'm running spam assassin default configuration which checks spf >records.  In my case I received an email and it checked if the last >relay was a valid sender for SPF.  The last relay was a server I have >in >the cloud, so it failed S

Re: How to undo ham-ing a message

2017-04-01 Thread Sean Greenslade
On March 31, 2017 2:36:41 PM PDT, David Niklas wrote: >Hello, >I accidentally learned a single message as ham from the menu of my MUA >claws-mail. >I immediately re-learned it as spam, but I want to know if there is >anything else I might want to do to reverse the ham-ing process. Nope, that's al

Re: training the filter

2016-11-07 Thread Sean Greenslade
On November 7, 2016 9:26:29 AM PST, Eric Abrahamsen wrote: >What a lot of people (including myself) do is have two IMAP folders >learn/spam and learn/ham. When a message is incorrectly classified you >put it in the right folder, then run sa-learn on a cron job, looking in >the appropriate folder,

Re: TxRep very slow

2016-11-03 Thread Sean Greenslade
On November 3, 2016 11:41:07 AM PDT, Birta Levente wrote: >I do not use spamassissin daemon. It's called by amavisd 2.10 > You're probably better off asking on an amavis list in that case. I have no experience with amavis. However, given that it seems to be a lock contention issue, you might s

Re: TxRep very slow

2016-11-03 Thread Sean Greenslade
On October 13, 2016 5:39:50 AM PDT, Levente Birta wrote: >Hi > >I have postfix with amavisd as content_filter and spamassassin 3.4.2 >When I enable the TxRep plugin the mail stay very long in the SA check: > > >Oct 13 15:28:40 wsrv amavis[24727]: (24727-01) SA dbg: locker: mode is >384 >Oct 13 15:

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-25 Thread Sean Greenslade
On Sun, Sep 25, 2016 at 07:57:37PM -0400, Alex wrote: > I think the rule still has a use, perhaps in a meta or something. I believe (though don't quote me on this) that a zero-weight rule will still be checked if it's used as part of a metarule. --Sean

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-25 Thread Sean Greenslade
On Sun, Sep 25, 2016 at 04:51:20PM -0400, Alex wrote: > On Sun, Sep 25, 2016 at 4:41 PM, Sean Greenslade > wrote: > > On Sun, Sep 25, 2016 at 03:54:53PM -0400, Alex wrote: > >> > If you want to see what that rule's code looks like, here's a link: > >

Re: FROM_WORDY and score

2016-09-25 Thread Sean Greenslade
On Sun, Sep 25, 2016 at 04:46:28PM -0400, Alex wrote: > Hi, > > I have another rule with a questionable score that's hitting too much ham. > > From: "Customer Support" > dbg: rules: ran header rule __FROM_WORDY ==> got hit: "Customer.Support@" > > http://pastebin.com/3qw6jLZp > > This rule

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-25 Thread Sean Greenslade
On Sun, Sep 25, 2016 at 03:54:53PM -0400, Alex wrote: > > If you want to see what that rule's code looks like, here's a link: > > > > https://fossies.org/dox/Mail-SpamAssassin-3.4.1/classMail_1_1SpamAssassin_1_1Plugin_1_1HTTPSMismatch.html > > > > It's possible there is a bug in that rule. If you s

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-25 Thread Sean Greenslade
On Sun, Sep 25, 2016 at 03:39:20PM -0400, Alex wrote: > I think it must be something more than that. I've included the HTML > component of an FP I received, and I don't see any occurrences of an > https link where the text component is just http, or even vice-versa. > > http://pastebin.com/BNM9sLR

Re: HTTPS_HTTP_MISMATCH and explanation

2016-09-25 Thread Sean Greenslade
On Sun, Sep 25, 2016 at 03:12:00PM -0400, Alex wrote: > Hi, I'm seeing quite a few FPs with HTTPS_HTTP_MISMATCH and its score > of 2.0. Isn't that kind of high for a rule that doesn't even have a > description? > > Can someone explain what the rule does, and consider whether its score > should be

Re: Spam by IP-address? Spamassassin with geoiplookup?

2016-09-24 Thread Sean Greenslade
On September 24, 2016 6:12:10 AM EDT, Thomas Barth wrote: >Instead of URIBL_BLOCKED=0.001 I see URIBL_ABUSE_SURBL=1.948, >URIBL_BLACK=1.7 > >It s still not ok, is it? That means it is working as intended, and your message has triggered hits on two separate blacklists. --Sean

Re: DNS Terminology

2016-09-23 Thread Sean Greenslade
On Fri, Sep 23, 2016 at 05:03:00PM +0100, RW wrote: > I've been wondering whether recursive is actually the correct term. > > As I understand it there are two types of DNS lookup: > > 1. Iterative - where results are found by working down through > multiple servers from the root servers. > >

Re: Spam by IP-address? Spamassassin with geoiplookup?

2016-09-21 Thread Sean Greenslade
On Wed, Sep 21, 2016 at 05:23:46PM +0200, Thomas Barth wrote: > I cant do that because I dont have spam mails. I dont make store&forward. I > didnt thought that I need the spam uncompressed in a folder for > autolearning, I thought it works when sa is analyzing the mail. My > mailsystem checks mail