Re: line endings in body tests

Rainer, Take a look at https://spamassassin.apache.org/full/4.0.x/doc/Mail_SpamAssassin_Conf.html body SYMBOLIC_TEST_NAME /pattern/modifiers ... "All body paragraphs (double-newline-separated blocks text) are turned into a linebreaks-removed, whitespace-normalized, single line. Any lines longer

Re: Bayes in V4 compared to V3

> > As documented: > > # perldoc Mail::SpamAssassin::BayesStore::SQL > NAME > Mail::SpamAssassin::BayesStore::SQL - SQL Bayesian Storage Module > Implementation > > DESCRIPTION > This module implements a SQL based bayesian storage module. It's > compatible with SQLite and possibly other standard SQ

Re: Bayes in V4 compared to V3

On Mon, Nov 11, 2024 at 4:48 PM hg user wrote: > In spamassassin 3 you could debug bayes points running command line > spamassassin with "-D bayes" parameter. I think you can in version 4 too. > > In the log all the tokens extracted from the message are listed with the > points assigned, so you c

Re: SA treats percentage spaces wording as uri

On Mon, May 13, 2024 at 8:10 PM Noel Butler wrote: > This morning one of our ent_domains DMARC weekly report from a third party > was listed as spam by SA which took the wording > Not_percent-twenty_Resolved and passed it off to URI checks adding > dot.com to it when there is no dot com after it

Re: MS-relayed spam

On Wed, Jan 3, 2024 at 5:06 AM Matus UHLAR - fantomas wrote: > What? > > If the message came from .outlook.com hosts, it should be reported to > ab...@outlook.com. > > You are right, it did come from an .outlook.com host. My mistake. I'm not sure why they blocked the user, then.

Re: MS-relayed spam

On Tue, Jan 2, 2024 at 3:11 PM Torpey List wrote: > I started forwarding full headers and text to "ab...@outlook.com" and > they > blocked my IP. > > ab...@outlook.com is for reporting abuse on the freemail Outlook/Hotmail/MSN platforms, not Microsoft tenants. https://msrc.microsoft.com/report/

Re: SA build from cpan fails under certain conditions

I will not engage in furthering this conversation. Sad there seems to be some toxicity here. On Wed, Dec 21, 2022, 7:46 PM Reindl Harald wrote: > > > Am 22.12.22 um 01:36 schrieb Shawn Iverson: > > I already build my own rpms > > so use them > > > This is not for

Re: SA build from cpan fails under certain conditions

I already build my own rpms. This is not for my use. Sorry if trying to provide a helpful tid on cpan as described in the SA release was wrong. On Wed, Dec 21, 2022, 7:34 PM Reindl Harald wrote: > > > Am 21.12.22 um 21:43 schrieb Shawn Iverson: > > I agree with you on that.

Re: SA build from cpan fails under certain conditions

I agree with you on that. In my specific use case I need fallback to cpan when rpms aren't available. On Wed, Dec 21, 2022, 3:32 PM Matus UHLAR - fantomas wrote: > On 21.12.22 13:05, Shawn Iverson wrote: > >sudo cpan Mail::Spamassassin seems to only build properly on recent &

SA build from cpan fails under certain conditions

Hello SA Users, Just posting this in case anyone else runs into similar trouble... sudo cpan Mail::Spamassassin seems to only build properly on recent flavors of rhel under very specific conditions, notably: You are not root The cpan configuration is set to build specifically using local lib or

Re: Mial hits MISSING rules despite presence of headers

As someone that is running a large distributed spamassassin installation, I depend on shortcircuit to handle large amounts of mail quickly that does not need scored further. The change in behavior has potential for negative impact that I will have to test carefully before moving to v4. On Sun, De

Re: spam subject marking

On Tue, Nov 15, 2022 at 9:46 PM Loren Wilton wrote: > > If SA sees the message and classifies it as spam, it normally adds (from > an > example) > X-Spam-Flag: YES > X-Spam-Level: > X-Spam-Status: Yes, score=8.2 required=5.0 > tests=BAYES_50=0.8,DKIM_SIGNED=0.1, > > It should be trivial

Re: Spam DKIM signed by Paypal coming from their Microsoft Tenant?

Thank you Giovanni, I'll give this rule a try. I think the bigger issue was that the default welcomelist was shortcircuiting any further rule evaluation. Now I'm able to score these emails with rules like this one :) On Tue, Nov 15, 2022 at 2:44 AM wrote: > On 11/14/22 21:14,

Re: Spam DKIM signed by Paypal coming from their Microsoft Tenant?

Thank you Matus. I was not aware of an unwelcomelist_from_dkim option. This helps immensely. On Tue, Nov 15, 2022 at 4:35 AM Matus UHLAR - fantomas wrote: > On 14.11.22 16:39, Shawn Iverson wrote: > >Corrected... > > > >Default Whitelist Exceptions handling -- SJI 11/

Re: Spam DKIM signed by Paypal coming from their Microsoft Tenant?

ed senders score CUSTOM_DKIM_OK -100 On Mon, Nov 14, 2022 at 4:38 PM Shawn Iverson wrote: > For those fighting the same battles... > > # Default Whitelist Exceptions handling -- SJI 11/14/22 > shortcircuit USER_IN_DKIM_WHITELIST off > score USER_IN_DKIM_WHITELIST

Re: Spam DKIM signed by Paypal coming from their Microsoft Tenant?

OK All other whitelisted senders score CUSTOM_DKIM_OK -100 On Mon, Nov 14, 2022 at 3:56 PM Shawn Iverson wrote: > So what I'm going to do is turn shortcircuit off for USER_IN_DKIM_WHITELIST > > Create a meta to catch papal.com as the from address and score > appropr

Re: Spam DKIM signed by Paypal coming from their Microsoft Tenant?

Oh yeah? [@x~]$ grep DEF_WHITELIST /var/lib/spamassassin/3.004006/updates_spamassassin_org/* /var/lib/spamassassin/3.004004/updates_spamassassin_org/30_text_de.cf:lang de describe USER_IN_DEF_WHITELIST Absenderadresse steht in der allgemeinen weien Liste /var/lib/spamassassin/3.004004/upda

Re: Spam DKIM signed by Paypal coming from their Microsoft Tenant?

Bottom line is I don't think paypal deserves to be default whitelisted in recent history. I've received a lot of spam actually from paypal and judiciously report it to phish...@paypal.com with no apparent action or response. On Mon, Nov 14, 2022 at 3:56 PM Shawn Iverson wrote: >

Re: Spam DKIM signed by Paypal coming from their Microsoft Tenant?

on, 2022-11-14 at 15:14 -0500, Shawn Iverson wrote: > > How do I stop this? paypal.com is in the default DKIM whitelist! > > > > That message really looks like it came from Paypal and then was > forwarded by Microsoft to your server. Was it really a fake? That's a > lo

Re: Spam DKIM signed by Paypal coming from their Microsoft Tenant?

The DKIM signature looks valid. On Mon, Nov 14, 2022 at 3:43 PM Alan Hodgson wrote: > On Mon, 2022-11-14 at 15:14 -0500, Shawn Iverson wrote: > > How do I stop this? paypal.com is in the default DKIM whitelist! > > > > That message really looks like it came from Paypal and

Re: Spam DKIM signed by Paypal coming from their Microsoft Tenant?

Are you asking me to rescore these back to 0? That will take some effort to do, but if that's what it takes... On Mon, Nov 14, 2022 at 3:42 PM Marc wrote: > > > > How do I stop this? paypal.com is in the default > > DKIM whitelist! > > > > > > > score USER_IN_DKIM_WHITELI

Spam DKIM signed by Paypal coming from their Microsoft Tenant?

How do I stop this? paypal.com is in the default DKIM whitelist! X-Spam-Status: No, score=-107.7 required=6.0 tests=DKIM_VALID,DKIM_VALID_AU, ,FREEMAIL_FROM,SHORTCIRCUIT,SPF_HELO_PASS, USER_IN_DEF_DKIM_WL,USER_IN_DKIM_WHITELIST shortcircuit=ham autolearn=disabled version=3.4.4 X-Spam-Relay-Countr

Re: Intuit servers sending paypal phishes

Just got one as well, deciding how to handle it... On Fri, May 6, 2022 at 1:52 PM Kevin A. McGrail wrote: > Oh joy. > On 5/6/2022 11:19 AM, Dave Wreski wrote: > > Hi, Intuit's servers are being used to send Paypal phishing invoices > combined with the "evil numbers" scam. > > -- > Kevin A. mcgra

Re: Managing long welcome_senders list

You can break up the rule into multiple rules and use a meta rule, definitely more readable and gives you some flexibility as well as more information when debugging rules and timing things. header __WELCOMING_LIST1 From =~ ... header __WELCOMING_LIST2 From =~ ... score LOCAL_WELCOMING_4 -4 meta

Re: A new high score!

This sounds like a really fun game! SpamAssassin's Creed! On Tue, Aug 25, 2020 at 8:32 AM Philipp Ewald wrote: > We have a own rule that mark special mails with spam score 1000 > but with default values record is round about 22 > > Am 24.08.20 um 23:27 schrieb micah anderson: > > > > What is the

Re: dcc-servers.net seems to have gone away

Well, crud. Anyone have a replica from before the records dropped they would be willing to share out? On Sat, May 23, 2020 at 5:12 AM Dominic Raferd wrote: > On Sat, 23 May 2020 at 09:55, hospice admin > wrote: > > > > Hi Gang, > > > > Looks like DCC/Rhyolite has stopped working. First noticed

Spamassassin 3.4.4-rc1 testing

So far testing is looking good for 3.4.4-rc1. Packaging went well and more testing is underway. Package is out in my testing repo and have others giving it a go.

Re: New Release Candidate: 3.4.4-rc1 - Testers Needed

Thanks a bunch! Look forward to testing this. On Sat, Jan 18, 2020 at 8:57 PM Kevin A. McGrail wrote: > Good Evening Assassins, > > 3.4.4 release candidate 1 is now available at > https://people.apache.org/~kmcgrail/devel > > There are CVEs fixed in 3.4.4 that we will disclose more at release so