Re: Certain spam not parsed by spamd!

2009-07-24 Thread Matus UHLAR - fantomas
> >> LuKreme wrote: > >> > On Jul 23, 2009, at 22:45, snowweb wrote: > >> > > >> > Is the email with attachment over 250KB? > > > > On 24.07.09 01:13, snowweb wrote: > >> No, it's just 74Kb > Matus UHLAR - fantomas wrote: > > the email or the attachment? In config you posted e-mails over 100K >

Re: Certain spam not parsed by spamd!

2009-07-24 Thread Jari Fredriksson
> > > > Jari Fredriksson wrote: >> >>> >>> The headers of the strange spam are: >>> >>> Return-path: >>> Envelope-to: u...@host.co.uk >>> Delivery-date: Fri, 24 Jul 2009 11:12:38 +0800 >>> Received: from [190.144.0.42] (helo=CWXNQKBTZ) >>>by s1.host.info with esmtp (Exim 4.67) >>>(

Re: Certain spam not parsed by spamd!

2009-07-24 Thread snowweb
to adresu chcem NEDOSTAVAT akukolvek reklamnu postu. > 99 percent of lawyers give the rest a bad name. > > Well done... Solved by Matus! Thanks buddy. -- View this message in context: http://www.nabble.com/Certain-spam-not-parsed-by-spamd%21-tp24638560p24642832.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Certain spam not parsed by spamd!

2009-07-24 Thread Matus UHLAR - fantomas
> Jari Fredriksson wrote: > > It apparently was never seen by SpamAssassin, if there were no X-Spam-* > > -headers. > > > > How you call SpamAssassin? Any whitelisting there, do you call > > SpamAssassin for your own mail? It seems the sender address is same as > > receiver address. Whitelisted so

Re: Certain spam not parsed by spamd!

2009-07-24 Thread Matus UHLAR - fantomas
> LuKreme wrote: > > On Jul 23, 2009, at 22:45, snowweb wrote: > > > > Is the email with attachment over 250KB? On 24.07.09 01:13, snowweb wrote: > No, it's just 74Kb the email or the attachment? In config you posted e-mails over 100K aren't checked. 74K attachment results in >100K mail. -- M

Re: Certain spam not parsed by spamd!

2009-07-24 Thread snowweb
rect that the From: header is the same as the recipient (obviously spoofed), but the envelope is from an external sender and also the first Received: line acknowledges that it was received from an external server and email address. Which line does it check the SPF record of, just the spoofable From: or one of the others? -- View this message in context: http://www.nabble.com/Certain-spam-not-parsed-by-spamd%21-tp24638560p24640671.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: Certain spam not parsed by spamd!

2009-07-24 Thread snowweb
retry_use_local_part transport = spamcheck no_verify I guess if their was whitelisting, that would have to be in the exim.conf too, but i can't see any explicit whitelisting there. -- View this message in context: http://www.nabble.com/Certain-spam-not-parsed-by-spamd%21-tp24638560p24640480.ht

Re: Certain spam not parsed by spamd!

2009-07-24 Thread snowweb
LuKreme wrote: > > On Jul 23, 2009, at 22:45, snowweb wrote: > > Is the email with attachment over 250KB? > No, it's just 74Kb -- View this message in context: http://www.nabble.com/Certain-spam-not-parsed-by-spamd%21-tp24638560p24640402.html Sent from the SpamAssa

Re: Certain spam not parsed by spamd!

2009-07-24 Thread LuKreme
On Jul 23, 2009, at 22:45, snowweb wrote: there is one email which seems capable of avoiding getting parsed by spamd. Is the email with attachment over 250KB?

Re: Certain spam not parsed by spamd!

2009-07-23 Thread Jari Fredriksson
> I've recently implemented relaycountry and seen 90%+ > improvement in our ability to trap spam but there is one > email which seems capable of avoiding getting parsed by > spamd. > > All other messages get the x-spam headers added > successfully but this one for some reason completely > slips t

Certain spam not parsed by spamd!

2009-07-23 Thread snowweb
0.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 The above email contained a .zip file. This was not random, as I've received three similar emails this morning and none of them have x-spam headers all other emails are fine. pete -- View this message in context: http://www.n