Re: Earthlink emails

2006-09-30 Thread Ramprasad
On Fri, 2006-09-29 at 11:20 -0400, Michel Vaillancourt wrote: > Ramprasad wrote: > > On Fri, 2006-09-29 at 08:12 -0400, Michel Vaillancourt wrote: > >> Ramprasad wrote: > >>> Why not SPF ?? > >>Over two thirds of the email I receive that is UCE/Spam has an > >> "SPF_PASS" associated with it fr

Re: Earthlink emails

2006-09-29 Thread hamann . w
gt; List-Post: <mailto:users@spamassassin.apache.org> >> List-Id: >> Delivered-To: mailing list users@spamassassin.apache.org >> X-ASF-Spam-Status: No, hits=0.0 required=10.0 tests= >> Subject: Re: Earthlink emails >> From: Ramprasad <[EMAIL PROTECTED]&g

Re: Earthlink emails

2006-09-29 Thread Michel Vaillancourt
Ramprasad wrote: > On Fri, 2006-09-29 at 08:12 -0400, Michel Vaillancourt wrote: >> Ramprasad wrote: >>> Why not SPF ?? >> Over two thirds of the email I receive that is UCE/Spam has an >> "SPF_PASS" associated with it from SA. All SPF seems to do is make the >> "stupid" spammers look more

Re: Earthlink emails

2006-09-29 Thread Ramprasad
On Fri, 2006-09-29 at 08:12 -0400, Michel Vaillancourt wrote: > Ramprasad wrote: > > > > Why not SPF ?? > > Over two thirds of the email I receive that is UCE/Spam has an > "SPF_PASS" associated with it from SA. All SPF seems to do is make the > "stupid" spammers look more stupid. The c

Re: Earthlink emails

2006-09-29 Thread Michel Vaillancourt
Ramprasad wrote: > > Why not SPF ?? Over two thirds of the email I receive that is UCE/Spam has an "SPF_PASS" associated with it from SA. All SPF seems to do is make the "stupid" spammers look more stupid. The clever ones aren't affected. > DK is a resource HOG. And I cant do that ea

Re: Earthlink emails

2006-09-29 Thread Graham Murray
"Loren Wilton" <[EMAIL PROTECTED]> writes: > SPF can be a pain for a number of reasons that have been discussed > endlessly. I suspect Dirtlink found them to be effectively useless. > > Why not try using domainkeys instead? SPF and domainkeys protect different things and therefore serve differen

Re: Earthlink emails

2006-09-28 Thread Ramprasad
On Thu, 2006-09-28 at 11:05 -0700, Loren Wilton wrote: > > Apparently they have removed SPF records after publishing them once. > > Thats a stupid idea IMHO. Today I am forced to TEMP FAIL earthlink ids > > whenever there is a spam attack on my servers > > SPF can be a pain for a number of reasons

Re: Earthlink emails

2006-09-28 Thread Ramprasad
On Thu, 2006-09-28 at 19:11 -0700, jdow wrote: > From: "Ramprasad" <[EMAIL PROTECTED]> > > > On Tue, 2006-09-26 at 21:28 -0700, jdow wrote: > >> Before you blame Earthlink note that it has NOT gone through Earthlink > >> servers. > >> > >> relay2.corp.good-sam.com is the receiving email server. >

Re: Earthlink emails

2006-09-28 Thread jdow
From: "Ramprasad" <[EMAIL PROTECTED]> On Tue, 2006-09-26 at 21:28 -0700, jdow wrote: Before you blame Earthlink note that it has NOT gone through Earthlink servers. relay2.corp.good-sam.com is the receiving email server. It's a forged email, at a guess. (It also has mangled headers. Newlines

Re: Earthlink emails

2006-09-28 Thread Loren Wilton
Apparently they have removed SPF records after publishing them once. Thats a stupid idea IMHO. Today I am forced to TEMP FAIL earthlink ids whenever there is a spam attack on my servers SPF can be a pain for a number of reasons that have been discussed endlessly. I suspect Dirtlink found them

Re: Earthlink emails

2006-09-28 Thread Ramprasad
On Tue, 2006-09-26 at 21:28 -0700, jdow wrote: > Before you blame Earthlink note that it has NOT gone through Earthlink > servers. > > relay2.corp.good-sam.com is the receiving email server. > > It's a forged email, at a guess. (It also has mangled headers. Newlines > are missing. MAYBE it would

Re: Earthlink emails

2006-09-26 Thread jdow
ity:X-Mailer:X-MimeOLE:X-ELNK-Trace:X-Originating-IP; {^_^} - Original Message - From: "Loren Wilton" <[EMAIL PROTECTED]> To: Sent: Tuesday, September 26, 2006 20:17 Subject: Re: Earthlink emails Received: from SHERI-PTIN5DJM8 (cpe-74-71-30-143.twcny.res.rr.com [74.71.30.1

Re: Earthlink emails

2006-09-26 Thread jdow
Before you blame Earthlink note that it has NOT gone through Earthlink servers. relay2.corp.good-sam.com is the receiving email server. It's a forged email, at a guess. (It also has mangled headers. Newlines are missing. MAYBE it would do better if you sent it plain text. HTML tends to mangle th

Re: Earthlink emails

2006-09-26 Thread Loren Wilton
> Received: from SHERI-PTIN5DJM8 (cpe-74-71-30-143.twcny.res.rr.com [74.71.30.143])   That mail came from a RoadRunner zombie account in Minnesota, has nothing to do with Earthlink other than the forged headers.   If that is the entire message, and there isn't an image attached, they might

Re: Earthlink emails

2006-09-26 Thread Benny Pedersen
On Tue, September 26, 2006 18:44, Gino Cerullo wrote: >> update to 3.1.5 if posible >> and enable spf check > How does this help? Earthlink does not publish SPF records. sorry i was to fast here :/ -- "This message was sent using 100% recycled spam mails."

Re: Earthlink emails

2006-09-26 Thread Gino Cerullo
On 26-Sep-06, at 12:43 PM, Benny Pedersen wrote: On Tue, September 26, 2006 18:24, bryan haase wrote: I am getting a lot of earthlink.net emails with 4-5 random words in the body. I am at a lost how to prevent these. Any suggestions?? http://openspf.org/wizard.html?mydomain=earthlink.net

Re: Earthlink emails

2006-09-26 Thread Benny Pedersen
On Tue, September 26, 2006 18:24, bryan haase wrote: > I am getting a lot of earthlink.net emails with 4-5 random words in the body. > I am at a > lost how to prevent these. Any suggestions?? http://openspf.org/wizard.html?mydomain=earthlink.net > SpamAssassin 3.0.1 (2004-10-22) on relay2.corp.

Re: Earthlink emails

2006-09-26 Thread Martin Hepworth
bryan haase wrote: I am getting a lot of earthlink.net emails with 4-5 random words in the body. I am at a lost how to prevent these. Any suggestions?? Thanks Bryan Subject: axiom closure advocacy may I suggest you start with upgrading your SA to 3.1.5 which will solve security issues