Re: DOS_OE_TO_MX rule and trusted_networks

2011-10-12 Thread Matus UHLAR - fantomas
On Mon, 10 Oct 2011 13:14:21 +0200 (CEST), Tomas Macek wrote: OK, this should be good: trusted_networks 213.0.0.5 213.0.0.10 # primary mx IP and backup mx IP internal_networks 213.0.0.5 # only the IP of primary mx Right? On 10.10.11 16:40, Benny Pedersen wrote: backup is i

Re: DOS_OE_TO_MX rule and trusted_networks

2011-10-12 Thread Matus UHLAR - fantomas
will send to you. hope that helps, if not post sample on pastebin, and just mangle sender donain with example.org But there is still the question what bad happened when DOS_OE_TO_MX matched the message? because the client used outlook express and has sent mail directly to destination (your

Re: DOS_OE_TO_MX rule and trusted_networks

2011-10-11 Thread Benny Pedersen
On Tue, 11 Oct 2011 07:37:53 +0200 (CEST), Tomas Macek wrote: [snip] No, there is not ALL_TRUSTED in the headers. I'm sorry, I did not write here the rules that matched the message, so here it is: X-Spam-Status: Yes, score=5.988 tagged_above=3 required=5 tests=[DOS_OE_TO_MX=

Re: DOS_OE_TO_MX rule and trusted_networks

2011-10-10 Thread Tomas Macek
r donain with example.org But there is still the question what bad happened when DOS_OE_TO_MX matched the message? yes, check if msg is with ALL_TRUSTED test or not The client sent the mail from internal network 213.x.x.x/y from his public static IP through our mailserver into some mailbox ho

Re: DOS_OE_TO_MX rule and trusted_networks

2011-10-10 Thread Benny Pedersen
on what bad happened when DOS_OE_TO_MX matched the message? yes, check if msg is with ALL_TRUSTED test or not The client sent the mail from internal network 213.x.x.x/y from his public static IP through our mailserver into some mailbox hosted on our mailserver. I think I must have some misconfigura

Re: DOS_OE_TO_MX rule and trusted_networks

2011-10-10 Thread Jernej Porenta
On Oct 10, 2011, at 1:14 PM, Tomas Macek wrote: >> hope that helps, if not post sample on pastebin, and just mangle sender >> donain with example.org > > But there is still the question what bad happened when DOS_OE_TO_MX matched > the message? > The client sent the ma

Re: DOS_OE_TO_MX rule and trusted_networks

2011-10-10 Thread Tomas Macek
at bad happened when DOS_OE_TO_MX matched the message? The client sent the mail from internal network 213.x.x.x/y from his public static IP through our mailserver into some mailbox hosted on our mailserver. I think I must have some misconfiguration in spamassassin...

Re: DOS_OE_TO_MX rule and trusted_networks

2011-10-10 Thread Benny Pedersen
On Mon, 10 Oct 2011 12:19:56 +0200 (CEST), Tomas Macek wrote: I suggest something like this: trusted_networks 213.x.x.x/y # all our public ip addresses range internal_networks 213.0.0.5 # let's say that's our mailserver's IP the above should only list all the mailserver(s) you have as isp, not

DOS_OE_TO_MX rule and trusted_networks

2011-10-10 Thread Tomas Macek
d outgoing mail traffic to/from all of our domains. We are ISP. Our customer complained about false positive mail with DOS_OE_TO_MX. How exactly this rule works? Should I add all my range 213.x.x.x/y to the trusted_networks and my mailserver should be added to the internal_networks? I guess

Re: DOS_OE_TO_MX

2010-09-30 Thread njjrdell
\n >> Sep 28 12:49:29 nsmail spamd[268]: spamd: identified spam (288.2/5.0) for >> (unknown):500 in 1.2 seconds, 2345 bytes.\n >> Sep 28 12:49:29 nsmail spamd[268]: spamd: result: Y 288 - >> AWL,BAYES_40,DOS_OE_TO_MX,FAKE_REPLY_C >> scantime=1.2,size=2345,user=(unknow

Re: DOS_OE_TO_MX

2010-09-30 Thread Matus UHLAR - fantomas
nsmail spamd[268]: spamd: result: Y 288 - > AWL,BAYES_40,DOS_OE_TO_MX,FAKE_REPLY_C > scantime=1.2,size=2345,user=(unknown),uid=500,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=50226,mid=<001101cb5f2d$1c3937b0$6629a...@traci>,bayes=0.297864,autolearn=no\n > > I'm trying

Re: DOS_OE_TO_MX

2010-09-29 Thread Karsten Bräckelmann
On Wed, 2010-09-29 at 08:32 -0700, njjrdell wrote: > Sep 28 08:35:55 nsmail spamd[287]: spamd: identified spam (4006.3/5.0) for > (unknown):500 in 1.0 seconds, 142218 bytes.\n > Sep 28 08:35:55 nsmail spamd[287]: spamd: result: Y 4006 - > AWL,BAYES_50,DATE_IN_FUTURE_12_24,DOS_OE_TO_M

RE: DOS_OE_TO_MX

2010-09-29 Thread Rosenbaum, Larry M.
> From: njjrdell [mailto:nruggi...@dellmagazines.net] > Sent: Wednesday, September 29, 2010 12:05 PM > To: users@spamassassin.apache.org > Subject: RE: DOS_OE_TO_MX > > > also, won't whitelisting her address open her up for spoofing? AWL has nothing to do with whitel

RE: DOS_OE_TO_MX

2010-09-29 Thread njjrdell
m: njjrdell [mailto:nruggi...@dellmagazines.net] >> Sent: Wednesday, September 29, 2010 11:32 AM >> To: users@spamassassin.apache.org >> Subject: Re: DOS_OE_TO_MX >> >> >> I'm pretty sure she would not send a GTUBE. Here is another from her >> >&

RE: DOS_OE_TO_MX

2010-09-29 Thread Rosenbaum, Larry M.
> -Original Message- > From: njjrdell [mailto:nruggi...@dellmagazines.net] > Sent: Wednesday, September 29, 2010 11:32 AM > To: users@spamassassin.apache.org > Subject: Re: DOS_OE_TO_MX > > > I'm pretty sure she would not send a GTUBE. Here is another

Re: DOS_OE_TO_MX

2010-09-29 Thread njjrdell
ssage <000b01cb5f6e$b1bbfe80$6629a...@traci> for (unknown):500\n Sep 28 08:35:55 nsmail spamd[287]: spamd: identified spam (4006.3/5.0) for (unknown):500 in 1.0 seconds, 142218 bytes.\n Sep 28 08:35:55 nsmail spamd[287]: spamd: result: Y 4006 - AWL,BAYES_50,DATE_IN_FUTURE_12_24,DOS_OE_TO_MX scanti

Re: DOS_OE_TO_MX

2010-09-29 Thread John Hardin
YES_40,DOS_OE_TO_MX,FAKE_REPLY_C scantime=1.2,size=2345,user=(unknown),uid=500,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=50226,mid=<001101cb5f2d$1c3937b0$6629a...@traci>,bayes=0.297864,autolearn=no\n I'm trying to track down why this message is getting such a high score. I

DOS_OE_TO_MX

2010-09-29 Thread njjrdell
: checking message <001101cb5f2d$1c3937b0$6629a...@traci> for (unknown):500\n Sep 28 12:49:29 nsmail spamd[268]: spamd: identified spam (288.2/5.0) for (unknown):500 in 1.2 seconds, 2345 bytes.\n Sep 28 12:49:29 nsmail spamd[268]: spamd: result: Y 288 - AWL,BAYES_40,DOS_OE_TO_MX,FAKE_REPLY_C scanti

Re: Change DOS_OE_TO_MX score

2008-03-06 Thread Daryl C. W. O'Shea
On 06/03/2008 11:15 AM, R.Smits wrote: > Hello, > > I have tried to change the score for : DOS_OE_TO_MX because we have a > lot of false positives with this rule. > > It gives 2.75 points. > This is defined in the /var/lib/spamassassin/etc directory. > > I have pu

Re: Change DOS_OE_TO_MX score

2008-03-06 Thread Matus UHLAR - fantomas
On 06.03.08 17:15, R.Smits wrote: > I have tried to change the score for : DOS_OE_TO_MX because we have a > lot of false positives with this rule. We had the same problem when they were sending e-mail to our clients (with no intermediate mailserver) without SMTP authentication. We advised t

Change DOS_OE_TO_MX score

2008-03-06 Thread R.Smits
Hello, I have tried to change the score for : DOS_OE_TO_MX because we have a lot of false positives with this rule. It gives 2.75 points. This is defined in the /var/lib/spamassassin/etc directory. I have put the usual score statement in the local.cf , but it does not work ? With the other

Re: ALL_TRUSTED and DOS_OE_TO_MX

2008-02-25 Thread Daryl C. W. O'Shea
On 24/02/2008 10:06 AM, giga328 wrote: > Client in example is Outlook Express at 89.110.202.24 also in trusted > networks. > Relevant configuration lines are: > trusted_networks 212.62.32.0/19 > trusted_networks 89.110.192.0/18 Not that this is the cause of your problem, but I'm wondering why 89.

Re: ALL_TRUSTED and DOS_OE_TO_MX

2008-02-24 Thread giga328
r MX and for clients and I would like to configure SpamAssassin to trust users relayed by mtaout1.isp.ptt.rs from my example. Regards, Giga -- View this message in context: http://www.nabble.com/ALL_TRUSTED-and-DOS_OE_TO_MX-tp15659736p15669827.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Re: ALL_TRUSTED and DOS_OE_TO_MX

2008-02-24 Thread Matus UHLAR - fantomas
On 23.02.08 17:34, giga328 wrote: > I'm testing SpamAssassin and I'm getting false positives. Both tests > ALL_TRUSTED and DOS_OE_TO_MX are firing for emails sent by Outlook Express > for local clients and it seems like I have something wrong in *_networks. > Here is my setup

Re: ALL_TRUSTED and DOS_OE_TO_MX

2008-02-24 Thread giga328
oted-printable dva su dela --=_NextPart_000_000A_01C876F7.C1872B80 Content-Type: text/html; .charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable dva su dela   --=_NextPart_000_000A_01C876F7.C1872B80-- This is just sample email, not representing ham or sp

Re: ALL_TRUSTED and DOS_OE_TO_MX

2008-02-23 Thread Daryl C. W. O'Shea
On 23/02/2008 8:34 PM, giga328 wrote: > I'm testing SpamAssassin and I'm getting false positives. Both tests > ALL_TRUSTED and DOS_OE_TO_MX are firing for emails sent by Outlook Express > for local clients and it seems like I have something wrong in *_networks. > Here is my s

ALL_TRUSTED and DOS_OE_TO_MX

2008-02-23 Thread giga328
I'm testing SpamAssassin and I'm getting false positives. Both tests ALL_TRUSTED and DOS_OE_TO_MX are firing for emails sent by Outlook Express for local clients and it seems like I have something wrong in *_networks. Here is my setup: All my servers and my clients IP are in truste

Re: Not sure why DOS_OE_TO_MX fired

2007-12-14 Thread Daryl C. W. O'Shea
Andrew Hearn wrote: Hello, I'm not sure why DOS_OE_TO_MX fired on this message, as the headers say it was delivered to b.painless.aaisp.net.uk which relayed it on to z.hopeless.aaisp.net.uk. b.painless isn't the MX for the domain... SA support for IPv6 is currently non-existent

RE: Not sure why DOS_OE_TO_MX fired

2007-12-14 Thread Giampaolo Tomassoni
> -Original Message- > From: Andrew Hearn [mailto:[EMAIL PROTECTED] > Sent: Friday, December 14, 2007 1:27 PM > To: users@spamassassin.apache.org > Subject: Not sure why DOS_OE_TO_MX fired > > Hello, > > I'm not sure why DOS_OE_TO_MX fired on this mess

Not sure why DOS_OE_TO_MX fired

2007-12-14 Thread Andrew Hearn
Hello, I'm not sure why DOS_OE_TO_MX fired on this message, as the headers say it was delivered to b.painless.aaisp.net.uk which relayed it on to z.hopeless.aaisp.net.uk. b.painless isn't the MX for the domain... Any ideas? -Thanks! Return-path: <[EMAIL PROTECTED]> Env

Re: DOS_OE_TO_MX

2007-10-12 Thread Matus UHLAR - fantomas
> Paolo De Marco wrote: > >I can't understand the test DOS_OE_TO_MX. > >Can anyone tell me what this test does? On 11.10.07 14:07, Daryl C. W. O'Shea wrote: > My rule: Outlook Express Sent mail directly to Your MX > > DOS_ OE_ TO_

Re: DOS_OE_TO_MX

2007-10-11 Thread Matt Kettler
Paolo De Marco wrote: > Hi, > I can't understand the test DOS_OE_TO_MX. > Can anyone tell me what this test does? > Thanks > >From reading the rule "code", it appears to detect if a message claiming to be generated by Outlook Express was delivered directly to you

Re: DOS_OE_TO_MX

2007-10-11 Thread Daryl C. W. O'Shea
Paolo De Marco wrote: Hi, I can't understand the test DOS_OE_TO_MX. Can anyone tell me what this test does? My rule: Outlook Express Sent mail directly to Your MX DOS_ OE_ TO_MX Daryl

DOS_OE_TO_MX

2007-10-11 Thread Paolo De Marco
Hi, I can't understand the test DOS_OE_TO_MX. Can anyone tell me what this test does? Thanks -- Paolo De Marco Real Comm srl Tel. +39 0434 923134