Re: FPs on MSGID_FROM_MTA_ID

2005-03-03 Thread Bob Proulx
Nick Leverton wrote: > Outlook 2003 (I think, some M$ MUA anyway) was changed to not add a > Message-Id, on the assumption that Exchange would. I have no trouble with MUA clients not adding a message-id. My prefered mail client mutt does not either. It is added by the first MTA. I and I believe

Re: FPs on MSGID_FROM_MTA_ID

2005-03-02 Thread Nick Leverton
On Wed, Mar 02, 2005 at 10:59:20AM -0700, Bob Proulx wrote: > David B Funk wrote: > > I have a functionally equivalent rule that I created back in SA-2.5 days. > > Me too. I started out making that a hard test. But I needed to back > it out, darn it! Why can't legitimate MTAs play by the rules?

Re: FPs on MSGID_FROM_MTA_ID

2005-03-02 Thread Bob Proulx
David B Funk wrote: > I have a functionally equivalent rule that I created back in SA-2.5 days. Me too. I started out making that a hard test. But I needed to back it out, darn it! Why can't legitimate MTAs play by the rules? > I had given it a hefty score (1.5) as it seend a good spam-sign, b

Re: FPs on MSGID_FROM_MTA_ID

2005-03-01 Thread David B Funk
On Tue, 1 Mar 2005, Stuart Johnston wrote: > Eric A. Hall wrote: > > It appears to be doing the right thing. The message originated off-net, > > but the Message-ID was added locally, which is pretty good spam-sign. > > Frankly I wish it worked here, because I've had to create my own rule to > > hi

Re: FPs on MSGID_FROM_MTA_ID

2005-03-01 Thread Eric A. Hall
On 3/1/2005 11:53 AM, Stuart Johnston wrote: > it is just that I get the impression that a lot of legitimate > mail servers may be sending mail without proper Message-ID's, causing > FPs. So, I wondered if anyone else had seen this as well. This is really two separate questions. As to "legiti

Re: FPs on MSGID_FROM_MTA_ID

2005-03-01 Thread Stuart Johnston
Eric A. Hall wrote: On 3/1/2005 11:21 AM, Stuart Johnston wrote: I am seeing a lot of false positives on MSGID_FROM_MTA_ID. Anyone else seeing similar results? Suggestions? (SA 3.0.2) Here is a sample header: Return-Path: <[EMAIL PROTECTED]> Received: from [10.2.100.6] (HELO gateway.ebby.com)

Re: FPs on MSGID_FROM_MTA_ID

2005-03-01 Thread Eric A. Hall
On 3/1/2005 11:21 AM, Stuart Johnston wrote: > I am seeing a lot of false positives on MSGID_FROM_MTA_ID. Anyone else > seeing similar results? Suggestions? (SA 3.0.2) > > Here is a sample header: > > Return-Path: <[EMAIL PROTECTED]> > Received: from [10.2.100.6] (HELO gateway.ebby.com) >