FOUND_YOU rule

What exactly is the "FOUND_YOU" rule? The wiki entry on it is empty and I can't find anything about it on the internet.

RE: Regex in case of spaces

Hi dude, Try the following - need to buy (a\s)?products?([\s?]{0,})? added a conditional a with a space "(a\s)?" added a conditional s after product s? added a conditional combination of space and question marks ([\s?]{0,})? Hope it helps Rgds Tony > Subject: Re: Regex in c

false positive: KHOP_BIG_TO_CC

ients instaed of Bcc or a list scoreKHOP_BIG_TO_CC 3.199 3.399 3.199 3.399 Tony. -- f.anthony.n.finchhttp://dotat.at/ Forties, Cromarty: East, veering southeast, 4 or 5, occasionally 6 at first. Rough, becoming slight or moderate. Showers, rain at first. Moderate or good, occasionally po

Re: SOLVED: failed to compile Mail::SpamAssassin::Plugin::Check::_body_tests

@benny *su defang -s /bin/bash -c 'spamassassin -x -p /etc/mail/sa-mimedefang.cf -D < testmessage.txt'* is a command I run on test spam mail (testmessage.txt) to see that spamassassin is processing it correctly and not throwing up errors. I run spamd on centos 5.9 and run it alongside of mimedefang

Re: failed to compile Mail::SpamAssassin::Plugin::Check::_body_tests

I ran the command *#/usr/bin/sa-compile* on it's own and since cleaning up local.cf (posted earlier) it all seems ok now, no more errors. The latest sa-compile output is attached. sa-compile.txt -- View this message in co

SOLVED: failed to compile Mail::SpamAssassin::Plugin::Check::_body_tests

thankyou kevin you found the problem. I did have errors in local.cf and when I cleared these up I did '#su defang' again on a test spam and this time there were no errors and no warnings. -- View this message in context: http://spamassassin.1065346.n5.nabble.com/failed-to-compile-Mail-SpamA

Re: failed to compile Mail::SpamAssassin::Plugin::Check::_body_tests

ok I've re-done the sa-compile and uploaded a new text file. The command I used was: /usr/bin/sa-compile --siteconfigpath=/etc/mail/spamassassin --updatedir=/var/lib/spamassassin/3.003001/updates_spamassassin_org sa-compile.txt

Re: failed to compile Mail::SpamAssassin::Plugin::Check::_body_tests

sa-compile.txt I've uploaded sa-compile.txt which is the output I got when I ran: /usr/bin/sa-compile --siteconfigpath=/etc/mail/spamassassin --updatedir=/etc/mail/spamassassin -- View this message in context: http://spa

Re: failed to compile Mail::SpamAssassin::Plugin::Check::_body_tests

thanks for your response. I went into v320.pre and *loadplugin Mail::SpamAssassin::Plugin::Rule2XSBody* is already commented ie: it has a '#' at the beginning on the line. Did you mean uncomment? -- View this message in context: http://spamassassin.1065346.n5.nabble.com/failed-to-compile-Mail-S

failed to compile Mail::SpamAssassin::Plugin::Check::_body_tests

I'm running a centos 5.9 server with spamassassin-3.3.1-2.el5, when I do an '#su defang' check on a test spam I'm getting: *warn: rules: failed to compile Mail::SpamAssassin::Plugin::Check::_body_tests_0_3, skipping:* I did a search on google but found nothing for this particular error. How do I co

Re: increase in spams getting though

now I've given it some more thought it's a certain type of spam that gets through. I never get scams or marital aid spam, never. The spam mails that get through are consistently to do with hospitality, increased sales and business courses. Are there rules I should be using to combat this type of sp

increase in spams getting though

I've been running spamassassin for about 4 years on a centos 5 server, currently running spamassassin-3.3.1-2.el5. I've always been impressed and very pleased with the way SA works and I regularly run sa-update and I update the bayes databases. I use plugins too - raor, pyzor, dkim etc but over the

RE: PreRBL with spamassasdon

Recently there was a good thread about postscreen and rbl. I just updated my config and have seen a decent improvement. Here is the starter message: http://archives.neohapsis.com/archives/postfix/2013-04/0468.html Hope this helps, Tony From: Raymond Dijkxhoorn [mailto:raym

sudden increase in spam

centos 5.8 server running spamassassin-3.3.1-2.el5 I've been using spamassassin for three years and during that period it's been doing a great job of keeping spam down to almost zero but in the last couple of weeks I've seen and increase in junk mail slipping through - about 3 to 4 a day which is a

Re: sa-update 3.3 daily changes

On Wed, 8 Sep 2010, John Hardin wrote: > > It's expected and very welcome. It means the age-limited nightly masscheck > corpora have once again gotten large enough that the score generator can > safely publish updated rules and scores on a regular basis. Ah, go

sa-update 3.3 daily changes

sa-update for version 3.3 is usually very quiet - last update 4 July; previous one 12 June. We have been getting daily updates since Saturday morning. Is this expected? Tony. -- f.anthony.n.finchhttp://dotat.at/ HUMBER THAMES DOVER WIGHT PORTLAND: NORTH BACKING WEST OR NORTHWEST, 5 TO 7

Re: Extending XBL to all untrusted

tives. You will get false positives from senders that are using remote message submission, and from some webmail users if their server puts the webmail client IP address in the message headers. Tony. -- f.anthony.n.finchhttp://dotat.at/ GERMAN BIGHT HUMBER: SOUTHWEST 5 TO 7. MODERATE OR RO

Any amavisd-milter help out there?

re, make and make install but don't see anything that should place a file in /etc/sysconfig. Can anyone familiar with amavisd-milter know whether such a file should be created and installed in a default unpackaging of amavisd-milter? TIA, Tony

Newbie Help! Scalix11 OpenSuSE SA

ogging messages but is spamassassin really scanning? 2. Does anyone have a reference to a similar procedure to what I described? Perhaps a different reference describing the same procedure might be either "more accurate" or "more explanatory/complete." TIA. Tony

RE: Low Score?

also use it with some meta rules to filter out some specific stuff that was sneaking by. It appears that I should get Razor going and at least take a look at the KHOP_* rules and JunkEmailFilter BL. Thanks everyone for taking the time to check the messages through your filters. -Tony B

RE: Low Score?

> So.. What score are you seeing? What version of spamassassin are you > running? What is your spam level set at? Here are the scores and hits I am getting: x-spam-status: No, score=2.4 required=5.0 tests=DCC_CHECK,RCVD_IN_FIVETENSG, RCVD_IN_FIVETENSG_SUSPECT,SPF_HELO_PASS,SPF_PASS autol

Low Score?

I am starting to see more messages than usual get through our spam filters. Anyone have any tips on what would make these score higher? http://pastebin.com/m41d3437a http://pastebin.com/d626a4352 http://pastebin.com/m14c73cab Thanks in advance, Tony

False Negatives

://pastebin.com/m16055c85 http://pastebin.com/m52635526 http://pastebin.com/m491c4882 http://pastebin.com/m7c1240f2 Anyone have any suggestions? Thanks in advance! --- Tony Bunce: [EMAIL PROTECTED] Sr. Prog

RE: [OT] Yahoo Deferred

> I have heard using Domainkeys or DKIM helps greatly? Is that true? So far DomainKeys has not helped from what I can tell. Yahoo is deferring the message as soon as my server connects, so it never even gets a chance to see the DomainKeys header. -Tony B

RE: [OT] Yahoo Deferred

(postal mail). Even then the feedback loop is DomainKeys based instead of IP based, so for ISPs you don't know if your customers are sending spam to yahoo. At least I know that I'm not alone now, thanks for the input. I'll let everyone know if I make any headway. -Tony -O

[OT] Yahoo Deferred

customer complaints are getting more frequent every day. ____ Tony Bunce: [EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]> Sr. Programming Systems Administrator - GO Concepts Inc.<http://www.go-concepts.com/> Phone: (513) 934-8234

Re: Mail marked as spam on outgoing mail

On 9 Nov 2007, at 12:39, wolfgang wrote: In an older episode (Friday, 9. November 2007), Tony Baker wrote: X-Spam-Status: Yes, score=5.373 tagged_above=-999 required=2.7 tests=[ALL_TRUSTED=-1.8, AWL=9.772, BAYES_00=-2.599] AWL=9.772: This seems to indicate that a recent mail with your

Mail marked as spam on outgoing mail

rated internally been marked as SPAM? If I can supply more info that would assist in getting an answer please let me know Tony

Re: running sa-update gives error

place, hopefully inside one of your @INClude directory. Installed LWP::UserAgent through cpan now when running sa-update I get the folowing: server: admin# /usr/bin/sa-update error: gpg required but not found! Tony

Re: running sa-update gives error

On 2 Nov 2007, at 09:20, Daryl C. W. O'Shea wrote: Tony Baker wrote: server:~ root# sa-update Can't locate LWP/UserAgent.pm in @INC (@INC contains: /Library/ Perl/5.8.6/darwin-thread-multi-2level /Library/Perl/5.8.6 /System/ Library/Perl/5.8.6/darwin-thread-multi-2level /System/Li

running sa-update gives error

brary/Perl /System/Library/Perl/ Extras/5.8.6/darwin-thread-multi-2level /System/Library/Perl/Extras/ 5.8.6 /Library/Perl/5.8.1) at /usr/bin/sa-update line 79. BEGIN failed--compilation aborted at /usr/bin/sa-update line 79. What have I broken, and how can I fix it Tony

RE: Support - spamassassin

don't get it. Really appreciate your reply. Best Regards, Tony -Original Message- From: Duane Hill [mailto:[EMAIL PROTECTED] Sent: August 31, 2007 11:07 AM To: users@spamassassin.apache.org Subject: Re: Support - spamassassin On Fri, 31 Aug 2007 at 10:38 -0400, [EMAIL PROTECTED] co

Invalid Date header - Date not RFC 2822

irport (Pearson)Sub > Location:   4298 TOTAL EXPRESS INTERNATIONAL FREIGHT > FORWARDING Release Code:   4 - Goods > Released > > > > > > I have attached an example of our email that is now being considered spam. > > > > > > Thank-you for any possible gu

Support - spamassassin

irport (Pearson)Sub > Location:   4298 TOTAL EXPRESS INTERNATIONAL FREIGHT > FORWARDING Release Code:   4 - Goods > Released > > > > > > I have attached an example of our email that is now being considered spam. > > > > > > Thank-you for any possible gu

RE: white_list is not working.....HELP!

YEP! that did it i will have to work around that. thanks VERY MUCH!! *** Tony Guadagno Guadagno Consulting [EMAIL PROTECTED] 585.703.6700 *** >>> Bowie Bailey <[EMAIL PROTECTED]> 8/2

RE: white_list is not working.....HELP!

PROTECTED] whitelist_from [EMAIL PROTECTED] whitelist_from [EMAIL PROTECTED] whitelist_from [EMAIL PROTECTED] *** Tony Guadagno Guadagno Consulting [EMAIL PROTECTED] 585.703.6700 *** >>> Bowie Baile

RE: white_list is not working.....HELP!

-Correlator: Thread-Topic: OffZHook pushes needed today thread-index: AcfpzX9sYZtuwDNJRcim8H0+6Lyt/wADEuq5 References: <[EMAIL PROTECTED]><[EMAIL PROTECTED]><[EMAIL PROTECTED]><[EMAIL PROTECTED]><[EMAIL PROTECTED]><[EMAIL PROTECTED]><[EMAIL PROTECTED]><

white_list is not working.....HELP!

why is it not whitelisting!!! thanks for your help!!! *** Tony Guadagno Guadagno Consulting [EMAIL PROTECTED] 585.703.6700 *** BEGIN:VCARD VERSION:2.1 X-GWTYPE:USER FN:Tony Guadagno EMAIL;WORK;PREF;NGW:[

Re: Posioned MX is a bad idea [Was: Email forwarding and RBL trouble]

have to incorporate enough randomness that a dictionary attack will fail - relying on obscurity or 100% blacklist coverage isn't enough. Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ IRISH SEA: SOUTHERLY, BACKING NORTHEASTERLY FOR A TIME, 3 OR 4. SLIGHT OR MODERATE. SHOWERS. MODERATE OR GOOD, OCCASIONALLY POOR.

Re: Posioned MX is a bad idea [Was: Email forwarding and RBL trouble]

On Sat, 25 Aug 2007, Dave Pooser wrote: > > So do you run your servers with VRFY enabled? Yes. If you are verifying addresses at RCPT time, which you must to avoid spam blowback, then there's no point disabling VRFY. Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://do

pdfinfo - how to prove it is working

in/ PDFInfo.pm line 131. failed to create instance of plugin Mail::SpamAssassin::Plugin::PDFInfo: Can't locate object method "new" via package "Mail::SpamAssassin::Plugin::PDFInfo" at (eval 32) line 1. Where line 131 reads use Mail::SpamAssassin::Logger; Can someone give me some pointers as to what may be wrong Regards Tony

pdfinfo - how to prove it is working

using this plugin I get the following from the headers of pdf spam mail X-Spam-Status: No, hits=-1.757 tagged_above=-999 required=2.7 tests=AWL, BAYES_00, HTML_MESSAGE, RCVD_BY_IP How can I prove that the plugin is operational. TIA for any help or pointers Tony

Re: DNS timeout problem

In <[EMAIL PROTECTED]>, Bob Proulx wrote: > For your Debian machine it is very easy with the following commands. > > $ sudo apt-get update > $ sudo apt-get install bind9 > > The default package configuration is a caching nameserver and the > above commands should be all that is needed to set

Re: DNS timeout problem

In <[EMAIL PROTECTED]>, Gary V wrote: > >Gary V wrote: > > > >> As mentioned twice, use a local caching DNS server (like bind for > >> example). Even if configured to forward requests to your ISP's DNS > >> server it may make a big difference. What OS are you running? > > > >Linux. > > Exactly

Re: DNS timeout problem

In <[EMAIL PROTECTED]>, SM wrote: > At 06:10 07-07-2007, Tony Houghton wrote: > >SA used to kill a different router I used to have, but I don't think > >that's the problem here. I temporarily pointed /etc/resolv.conf to my > >ISP's servers and restarted

Re: DNS timeout problem

In <[EMAIL PROTECTED]>, Gary V wrote: > As mentioned twice, use a local caching DNS server (like bind for example). > Even if configured to forward requests to your ISP's DNS server it may make > a big difference. What OS are you running? Linux. -- TH * http://www.realh.co.uk

Re: DNS timeout problem

In <[EMAIL PROTECTED]>, Bob Proulx wrote: > Tony Houghton wrote: > > SA used to kill a different router I used to have, but I don't think > > that's the problem here. > > I don't see how even a low end router would have a problem with the > amount of

Re: DNS timeout problem

In <[EMAIL PROTECTED]>, SM wrote: > Hi Tony, > At 15:01 06-07-2007, Tony Houghton wrote: > >I just use the one built in to my ADSL router; I don't know whether it > >caches. The one it forwards to at my ISP is probably bind. > > The DNS server on your A

Re: DNS timeout problem

In <[EMAIL PROTECTED]>, James D. Rallo wrote: > Are you running a local dns caching server? I just use the one built in to my ADSL router; I don't know whether it caches. The one it forwards to at my ISP is probably bind. > Do manual queries to rbls take a long time? (Hint: Don't run the query >

DNS timeout problem

il: PATH included '/bin', keeping [14452] dbg: util: PATH included '/usr/bin/X11', keeping [14452] dbg: util: PATH included '/usr/games', keeping [14452] dbg: util: PATH included '/home/tony/bin', keeping [14452] dbg: util: PATH included '/sbin', keepi

RE: Add DNS checks at MTA

-4.66/doc/html/spec_html/ch07.html#id2579986 Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ BAILEY: SOUTH OR SOUTHWEST 6 TO GALE 8, OCCASIONALLY SEVERE GALE 9 AT FIRST. ROUGH OR VERY ROUGH, OCCASIONALLY HIGH AT FIRST. OCCASIONAL RAIN. MODERATE OR GOOD, OCCASIONALLY POOR.

Re: Add DNS checks at MTA

On Thu, 12 Apr 2007, Suhas Ingale wrote: > > Following is my ACL list from exim conf. I want to add DNS checks for hosts > so that connections from blacklisted IP addresses are blocked at MTA level. http://www.exim.org/exim-html-4.66/doc/html/spec_html/ch40.html#SECTmorednsli

Re: per user scanning

se an ACL variable, $acl_m* (the * part is chosen by you), which you set in the RCPT ACL depending on the recipient. You can add some logic to detect if the variable is already set (i.e. a message with multiple recipients) and adjust it accordingly - e.g. choose a default user. Tony. -- f.a.n.finch

Re: per user scanning

th multiple recipients, then hack around to implement it. Unfortunately there's no easy solution, even for common policies. Tony. -- <[EMAIL PROTECTED]> <[EMAIL PROTECTED]> http://dotat.at/ ${sg{\N${sg{\ N\}{([^N]*)(.)(.)(.*)}{\$1\$3\$2\$1\$3\n\$2\$3\$4\$3\n\$3\$2\$4}}\ \N}{

Re: Techworld says "spam shows sudden slide'?

was in the first half of November and levels have been fairly constant (but with a level slightky lower than the peak) since then. Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ BAILEY: WEST 7 OR GALE 8, BECOMING CYCLONIC SEVERE GALE 9 OR STORM 10. VERY HIGH. RAIN OR SHOWERS. MODERATE OR GOOD.

RE: Help! rewrite_header subject not working for me

I see, yes, I am calling SA directly, no Amavis etc involved.. *** Tony Guadagno Guadagno Consulting [EMAIL PROTECTED] 585.703.6700 *** >>> Bowie Bailey <[EMAIL PROTECTED]> 12/21/2006 9

RE: Help! rewrite_header subject not working for me

I guess i don't understand, you say that "Rewriting the subject is ultimately the responsibility of the MTA.", but SA has this option, so that means that it is SA's responsibility...right? *** Tony Guadagno Guadagno Consult

Help! rewrite_header subject not working for me

agno EMAIL;WORK;PREF;NGW:[EMAIL PROTECTED] N:Guadagno;Tony END:VCARD

Yet another question about rewrite_header subject not working for me

EMAIL;WORK;PREF;NGW:[EMAIL PROTECTED] N:Guadagno;Tony END:VCARD

Yet another question about rewrite_header subject not working for me

EMAIL;WORK;PREF;NGW:[EMAIL PROTECTED] N:Guadagno;Tony END:VCARD

Re: A false positive...

two seconds > before it was received. The Date: header above is malformed, so SpamAssassin can't extract the timezone offset. Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ BAILEY: CYCLONIC BECOMING NORTHWESTERLY SEVERE GALE 9 TO VIOLENT STORM 11, OCCASIONALLY HURRICAN

Re: Them spammers are getting smarter..

On Tue, 21 Nov 2006, Evan Platt wrote: > So used to be mail from Richard Smith, subject "Me again Richard". Now > they're using the last name, ie "Me again Smith" Their fake Received: line is still the same. Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http:

Re: Well, that didn't take very bloody long

utz is, they're adapting > a lot. http://article.gmane.org/gmane.mail.spam.spamassassin.general/90322 Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ VIKING: SOUTHERLY VEERING WESTERLY 6 TO GALE 8, OCCASIONALLY SEVERE GALE 9. HIGH. RAIN THEN SHOWERS. MODERATE OR GOOD.

current stock scams are easy to spot

riority: Normal X-Mailer: Microsoft Office Outlook, Build 11.0.5510 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2670 Thread-Index: Aca6QB0)-/ZA;3SO+O/M?G<3G3C(7,== Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ FORTIES CROMARTY: SOUTHERLY VEERING WESTERLY 6 TO GALE 8, OCCA

RE: Amazon / RFCI false positives

to flame someone who's trying to help. Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ THAMES: WEST OR NORTHWEST 4 OR 5. SLIGHT TO MODERATE. FAIR. GOOD.

RE: Amazon / RFCI false positives

On Fri, 3 Nov 2006, Michael Scheidell wrote: > > Not a false positive if their servers are broken. True from the RFCI point of view, but NOT true from the SpamAssassin point of view. These messages are wanted by their recipients so should not be scored as spam by SpamAssassin.

Re: Amazon / RFCI false positives

On Fri, 3 Nov 2006, Ralf Hildebrandt wrote: > * Tony Finch <[EMAIL PROTECTED]>: > > > Amazon.co.uk was listed by RFC-Ignorant at the start of this week, and it > > is now scoring more than 5: DNS_FROM_RFC_DSN 2.87, DNS_FROM_RFC_POST 1.44, > > FROM_EXCESS_BASE64 1.05.

Amazon / RFCI false positives

Amazon.co.uk was listed by RFC-Ignorant at the start of this week, and it is now scoring more than 5: DNS_FROM_RFC_DSN 2.87, DNS_FROM_RFC_POST 1.44, FROM_EXCESS_BASE64 1.05. Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ IRISH SEA: VARIABLE 3 OR LESS, BECOMING WESTERLY 4 OR 5

Re: forged headers

to malware activity, because it shows up in my virus infection audit reports. Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ FORTIES CROMARTY FORTH: SOUTHERLY 6 TO GALE 8, DECREASING 5 OR 6 LATER. RAIN OR SHOWERS. MODERATE OR GOOD.

Re: DNSing MX to 127.0.0.1: Ruleset (or something) for this?

reserved It would probably be good to augment this list with bogon or hijacked address space, but then it would be more work to keep up-to-date. Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ FISHER: WEST OR NORTHWEST 4 OR 5 BECOMING VARIABLE 3 OR 4. FAIR. MODERATE OR GOOD.

Re: 0451.com

s and delegations from TLDs. The host name syntax described in RFC 1035 is informative, not normative. RFC 1912 is also informative, and it obviously misinterprets RFC 1123 which clearly allows all-numeric labels. All RFCs are not created equal and the earlier ones especially must be interpreted

Re: 0451.com

ware MUST support this more liberal syntax. Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ FISHER: WEST OR NORTHWEST 4 OR 5 BECOMING VARIABLE 3 OR 4. FAIR. MODERATE OR GOOD.

RE: 0451.com

asier for people to deal with than alphabetic domains. For example, 263.com is China's second-largest ISP. You can't just assume that an all-numeric domain is necessarily abusive, any more so than Yahoo or Fastmail. Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ FISHER:

Re: Allowing IMAP/POP to Send Email

would no longer be the official > source of messages for domains that they pretend to be. It would not. They could still talk SMTP or steal users' login credentials. Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ FISHER: WEST OR NORTHWEST 4 OR 5 BECOMING VARIABLE 3 OR 4. FAIR. MODERATE OR GOOD.

Re: SPF is now a standard: RFC4408

;. Note that all the MARID RFCs haave an extremely scathing IESG note which basically says you should expect interoperability problems if you use any MARID technique, including SPF. > It's not a standard until it's STD-4408, IIRC. STD numbers are not allocated like that. Tony

false positive on FORGED_MUA_OUTLOOK (v.3.1)

x/spamassassin-users/200509.mbox/[EMAIL PROTECTED] and about halfway down http://list-archive.xemacs.org/xemacs-design/xemacs-design.200603 (search for SlipStream) Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ HEBRIDES BAILEY: WEST 5 TO 7, OCCASIONALLY GALE 8 IN BAILEY AND

Re: Exiscan + subject rewrite not working

t the message rewrite parts of SpamAssassin, and instead relies on Exim's own facilities for this.. Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ BISCAY: WEST 5 OR 6 BECOMING VARIABLE 3 OR 4. SHOWERS AT FIRST. MODERATE OR GOOD.

spamcopuri and SA 3.1.0

? Tony

Re: I'm afraid I might have to report this list as a spam source

On Wed, 21 Dec 2005, [EMAIL PROTECTED] wrote: > You see, it does not allow me to unsubscribe. It's ezmlm, so you can just reject all messages from the list and it will unsubscribe you :-) Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ BISCAY: WEST 5 OR 6 BECOMING V

Re: sender-valid SMTP callbacks (Re: Does "tuxorama.com" sound fa miliar to anyone?)

#x27;t had much success yet. Ideally, the Linux machine would do an LDAP > query to the Exchange server, but unless you can help me figure out how to > do it, then I guess I'll just remain a "f*cking idiot admin". It's fairly straightforward with Exim. http://www.exim.o

Questions

would be useful.  I have tried adding -D to the spamd commandline in init.d and /etc/sysconfig/spamassassin  (using fedora Core 4) but it seems to ignore it.   Regards, Tony      

Picture based spam

.  Obviously SA can't read the message since it is an image, but is there a way to make a rule that blocks a mail where there is an image only, no text?   Regards, Tony

Score Info (was RE: error in counting score?)

gards, ____ Tony Melia -Original Message- From: Michael Monnerie [mailto:[EMAIL PROTECTED] Sent: Wednesday, 16 November 2005 6:58 PM To: users@spamassassin.apache.org Subject: error in counting score? X-Virus-Scanned: amavisd-new at X-Spam-Status: Yes, hits=5.55 tagged_above

Spamassassin Distro

!   Regards,Tony

Re: SA Gateway -> MS Exchange -- what if MSE down?

Thanks for all the input. The diagram was "simplistic" - the real MSE is a couple layers away. Tony

SA Gateway -> MS Exchange -- what if MSE down?

ble", as SA is a filter not an MTA and that Postfix is a check/forwarding agent (not "store" & forward). Would I be correct in assuming, in the event that if MS Exchange was down, in order to "store" mail -- I would need to have a backup MTA with all the users mailboxes replicated? Thanks, Tony

Re: Exim with Spamassassin and mimedefang

ware? I see HOWTOs using sendmail but I want to switch to > Exim or am I just making things hard? Recent versions of Exim come with support for SpamAssassin and anti-virus software built in. See the section in the documentation about Content Scanning. Tony. -- f.a.n.finch <[EMAIL

Re: Observation on secondary MX

On Mon, 2 May 2005, Justin Mason wrote: > > It might be worthwhile maintaining some kind of spammer tactics > knowledge base, on the wiki maybe? There's http://www.jgc.org/tsc/ but it's more focussed on textual obfuscation than low-level tactics. Tony. -- f.a.n.finch <[E

Re: Webmail and IP rules

with the esmtpa/esmtpsa/asmtp protocol tokens. http://svn.apache.org/viewcvs.cgi/spamassassin/trunk/lib/Mail/SpamAssassin/Message/Metadata/Received.pm?rev=112024&r1=57557&r2=112024 Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ NORTH UTSIRE SOUTH UTSIRE: VARIABLE 3 OR 4 BECOMI

Problems with spamassassin suddenly forward all mails as SPAM

that deleting the following two files will solve the problem, ~/.spamassassin/bayes_seen ~/.spamassassin/bayes_token What is the possible problem? Any suggestion on how I can prevent this problem? I am using spamassassin 3.01 on Red Hat Linux 9.0. Thank you. Tony Cheung

Re: Hotmail message scored high: bug?

On Wed, 2 Feb 2005, Matthew Newton wrote: > > I have been asked why this message got such a "high" score. It seems to > mainly be because of the > > 3.9 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook http://bugzilla.spamassassin.org/s

Re: HELO_DYNAMIC_IPADDR matches wrongly on hotmail

16.181]:30781 > by itself as the from clause is legitimate. That string matches neither a Domain nor an Address-literal. You're only allowed one of them after the from keyword; any other information must appear in () afterwards. What's more, they must be separated by spaces, not juxtaposed.

Re: HELO_DYNAMIC_IPADDR matches wrongly on hotmail

On Mon, 31 Jan 2005, Ole Nomann Thomsen wrote: > > So I don't feel able to bugzilla this one - any takers? It isn't a bug in SpamAssassin. Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ FAEROES: NORTHWEST 5 TO 7, OCCASIONALLY VARIABLE 3 OR 4 FOR A TIME. RAIN

Re: HELO_DYNAMIC_IPADDR matches wrongly on hotmail

rd is wrong. The specification for Received: lines is in RFC 2821. A correctly formatted line would be something like Received: from hotmail.com (bay22-dav1.bay22.hotmail.com [64.4.16.181]:30781) by mailgateway.sitc.dk ([195.231.241.98]:25) (F-Secure Anti-Virus for Internet Mail 6.41.1

Re: HELO_DYNAMIC_IPADDR matches wrongly on hotmail

r Internet Mail 6.41.149 Release) with SMTP; Wed, 19 Jan 2005 > 19:41:14 - F-Secure Anti-Virus for Internet Mail is producing incorrectly-formatted Received: lines. Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ FORTIES CROMARTY FORTH TYNE DOGGER: NORTH BACKING NORTHWEST

logs and probably-spam almost-certainly-spam directories

n't getting false positives. In summary I'd like to know where to dig and would appreciate any advice on a basic setup for a few users. If anybody has time to assist I can divulge more details as needed. Regards, -Tony

Re: FORGED_MUA_OUTLOOK false positives

On Wed, 12 Jan 2005, Martin Hepworth wrote: > > you guys running that rule live at cam.ac.uk? I haven't actually finished testing it properly yet, because it has got muddled up in the upgrade to SA 3.0.2 which I keep forgetting to finish :-) Tony. -- f.a.n.finch <[EMAIL PRO

Re: FORGED_MUA_OUTLOOK false positives

On Wed, 12 Jan 2005, Menno van Bennekom wrote: > > I noticed that FORGED_MUA_OUTLOOK falsely triggers with this hotmail-email > that is sent from Outlook-Express via the http-hotmailserver. http://bugzilla.spamassassin.org/show_bug.cgi?id=4065 Tony. -- f.a.n.finch <[EMAIL PROTE

Re: consensus on SPF

old-style nonstandard SMTPS) on port 465. In Exim: daemon_smtp_ports = 25 : 465 : 587 tls_on_connect_ports= 465 Tony. -- f.a.n.finch <[EMAIL PROTECTED]> http://dotat.at/ COLWYN BAY TO THE MULL OF GALLOWAY INCLUDING THE ISLE OF MAN: SOUTHWEST VEERING WEST 7 OR GALE 8, OCCASIONALL

Re: consensus on SPF

On Tue, 14 Dec 2004, Clarke Brunt wrote: > > it seems to me that a 'fail' result is a perfectly good reason to reject > a message outright, which is what I do (without it even being passed to > SpamAssassin). How many users do you have? Do none of them have v

  1   2   >