On Fri, 12 Mar 2010 15:44:21 -1000, Julian Yap wrote:
> On Thu, Mar 11, 2010 at 7:58 AM, micah anderson wrote:
>
> > On Tue, 9 Mar 2010 11:56:56 -1000, Julian Yap
> > wrote:
> > > Just wanted to add that this particular line is incorrect:
> > > meta SC_HAM (USER_IN_WHITELIST||USER_IN_DEF_WHITEL
On Fri, Mar 12, 2010 at 3:44 PM, Julian Yap wrote:
> On Thu, Mar 11, 2010 at 7:58 AM, micah anderson wrote:
>
>> On Tue, 9 Mar 2010 11:56:56 -1000, Julian Yap
>> wrote:
>> > Just wanted to add that this particular line is incorrect:
>> > meta SC_HAM (USER_IN_WHITELIST||USER_IN_DEF_WHITELIST||
>
On Thu, Mar 11, 2010 at 7:58 AM, micah anderson wrote:
> On Tue, 9 Mar 2010 11:56:56 -1000, Julian Yap
> wrote:
> > Just wanted to add that this particular line is incorrect:
> > meta SC_HAM (USER_IN_WHITELIST||USER_IN_DEF_WHITELIST||
> > USER_IN_ALL_SPAM_TO||NO_RELAYS||ALL_TRUSTED||USER_IN_BLAC
On Tue, 9 Mar 2010 11:56:56 -1000, Julian Yap wrote:
> Just wanted to add that this particular line is incorrect:
> meta SC_HAM (USER_IN_WHITELIST||USER_IN_DEF_WHITELIST||
> USER_IN_ALL_SPAM_TO||NO_RELAYS||ALL_TRUSTED||USER_IN_BLACKLIST_TO||
> USER_IN_BLACKLIST)
>
> That will have Blacklisted ema
Just wanted to add that this particular line is incorrect:
meta SC_HAM (USER_IN_WHITELIST||USER_IN_DEF_WHITELIST||
USER_IN_ALL_SPAM_TO||NO_RELAYS||ALL_TRUSTED||USER_IN_BLACKLIST_TO||
USER_IN_BLACKLIST)
That will have Blacklisted email filters classified as ham.
- Julian
On Sun, Feb 24, 2008 at
On Friday 11 April 2008 15:05:59 Justin Mason wrote:
> Mark Martinec writes:
> > It would also block some messages which you may or may not want to block,
> > such as:
> > - some automatic notifications such as calendar/meeting reminders,
> > notifications from ticketing/PR systems (OTRS), statu
Justin Mason wrote:
Jeff Koch writes:
From what I've seen the VBounce ruleset catches ALL backscatter and does
not distinguish between legitimate bounce-backs and bounce-backs of emails
with forged return addresses - which basically makes it useless for
filtering out joe-jobs.
VBounce sh
> From: Jesse Regier <[EMAIL PROTECTED]>
> Organization: Access 2000, Inc.
> Date: Fri, 11 Apr 2008 15:37:16 -0500
> To:
> Subject: Re: Low Scores on Bounce Backs
>
> I have some domains whos users send mail from variouis places on the
> web and some whose re
Matus UHLAR - fantomas writes:
> > Jeff Koch writes:
> > > From what I've seen the VBounce ruleset catches ALL backscatter and does
> > > not distinguish between legitimate bounce-backs and bounce-backs of
> > > emails
> > > with forged return addresses - which basically makes it useless for
> Jeff Koch writes:
> > From what I've seen the VBounce ruleset catches ALL backscatter and does
> > not distinguish between legitimate bounce-backs and bounce-backs of emails
> > with forged return addresses - which basically makes it useless for
> > filtering out joe-jobs.
> >
> > VBounce sh
On 11 Apr 2008 at 16:55, Justin Mason wrote:
>
> Jeff Koch writes:
> > From what I've seen the VBounce ruleset catches ALL backscatter and does
> > not distinguish between legitimate bounce-backs and bounce-backs of emails
> > with forged return addresses - which basically makes it useless for
Jeff Koch writes:
> From what I've seen the VBounce ruleset catches ALL backscatter and does
> not distinguish between legitimate bounce-backs and bounce-backs of emails
> with forged return addresses - which basically makes it useless for
> filtering out joe-jobs.
>
> VBounce should be match
From what I've seen the VBounce ruleset catches ALL backscatter and does
not distinguish between legitimate bounce-backs and bounce-backs of emails
with forged return addresses - which basically makes it useless for
filtering out joe-jobs.
VBounce should be matching the forged name of the o
Joseph Brennan wrote:
> Jeff Koch <[EMAIL PROTECTED]> wrote:
> > One of the problems is that the actual spam email is sometimes not
> > attached. But interestly enough we are usually sent the email header of
> > the original email. From that we (the humans) can easily spot that the IP
> > address o
Jeff Koch <[EMAIL PROTECTED]> wrote:
One of the problems is that the actual spam email is sometimes not
attached. But interestly enough we are usually sent the email header of
the original email. From that we (the humans) can easily spot that the IP
address of the mailserver claiming to be our
> Justin Mason wrote:
> >There's no problem. SpamAssassin 3.2.x includes the VBounce ruleset which
> >is expressly designed to catch backscatter -- and does a good job at it.
> >
> >If you have a backscatter problem, you need to start using that ruleset.
On 11.04.08 21:13, Jason Haar wrote:
> ..
Mark Martinec writes:
> On Friday 11 April 2008 11:13:09 Jason Haar wrote:
> > So are you saying as I know what all our relays are (ie
> > whitelist_bounce_relays), I should pump that score up to 20, and
> > effectively blacklist (we block at scores >10) any bounces (which should
> > just happen t
> On Fri, Apr 11, 2008 at 09:13:09PM +1200, Jason Haar wrote:
> >
> > ...and the score is 0.1 - and I don't fiddle with SA scores as a rule
> > 'cause you guys
> > Know Best (TM).
On 11.04.08 12:17, Henrik K wrote:
> No, the guys can't know what the best scores are for _your_ system.
> Therefore
On Friday 11 April 2008 11:13:09 Jason Haar wrote:
> So are you saying as I know what all our relays are (ie
> whitelist_bounce_relays), I should pump that score up to 20, and
> effectively blacklist (we block at scores >10) any bounces (which should
> just happen to be 100% forged spam) sent from
Jason Haar wrote:
> So how do we fix this situation?
Peridoically there are a lot of bounces (especially to me and the
another sysadmin), but SA catches almost all of it.
What about getting SA to "detach" the
associated bounced message as a separate message and score that instead?
I do tha
Jason Haar writes:
> Justin Mason wrote:
> > There's no problem. SpamAssassin 3.2.x includes the VBounce ruleset
> > which is expressly designed to catch backscatter -- and does a good
> > job at it.
> >
> > If you have a backscatter problem, you need to start using that
> > ruleset.
> >
> ..
On Fri, Apr 11, 2008 at 09:13:09PM +1200, Jason Haar wrote:
>
> ...and the score is 0.1 - and I don't fiddle with SA scores as a rule
> 'cause you guys
> Know Best (TM).
No, the guys can't know what the best scores are for _your_ system.
Therefore if you want efficient SA, you need to modify man
Justin Mason wrote:
There's no problem. SpamAssassin 3.2.x includes the VBounce ruleset which
is expressly designed to catch backscatter -- and does a good job at it.
If you have a backscatter problem, you need to start using that ruleset.
...but vbounce scores 0.1 - and there's all this t
Jason Haar writes:
> I think we've detoured from the actual problem?
>
> The fact is that lots of spam is now being sent to other sites,
> pretending to be from (collectively) our email addresses, so that we get
> the bounces containing the spam. And SA isn't marking these messages as
> spam,
On Fri, April 11, 2008 01:28, Jason Haar wrote:
> How are others (successfully) handling backscatter? Moving bounces into
> yet another separate folder isn't a solution for our users - and I'm
> sure the same applies elsewhere. Spam is spam...
backscatter have more signs of why you get them, ma
Our users are getting hundreds of these!
One of the problems is that the actual spam email is sometimes not
attached. But interestly enough we are usually sent the email header of the
original email. From that we (the humans) can easily spot that the IP
address of the mailserver claiming to
I think we've detoured from the actual problem?
The fact is that lots of spam is now being sent to other sites,
pretending to be from (collectively) our email addresses, so that we get
the bounces containing the spam. And SA isn't marking these messages as
spam, whereas if it was directly sent
On Tue, 2008-04-08 at 12:33 +0200, Matus UHLAR - fantomas wrote:
> Sorry for previous mail, I accidentally hit send...
>
> > On Sun, 2008-04-06 at 23:25 -0400, Jeff Koch wrote:
> > > Thanks for the reply. I thought the purpose of adding the
> > >
> > > 'whitelist_bounce_relays mailserver_name.co
Sorry for previous mail, I accidentally hit send...
> On Sun, 2008-04-06 at 23:25 -0400, Jeff Koch wrote:
> > Thanks for the reply. I thought the purpose of adding the
> >
> > 'whitelist_bounce_relays mailserver_name.com'
> >
> > in local.cf was so that SA could assign a higher score to bounces
On 07.04.08 12:17, Karsten Bräckelmann wrote:
> From: Karsten Bräckelmann <[EMAIL PROTECTED]>
> Date: Mon, 07 Apr 2008 12:17:36 +0200
> Subject: Re: Low Scores on Bounce Backs
> To: users@spamassassin.apache.org
>
> On Sun, 2008-04-06 at 23:25 -0400, Jeff Koch wrote:
>
On Sun, 2008-04-06 at 23:25 -0400, Jeff Koch wrote:
> Thanks for the reply. I thought the purpose of adding the
>
> 'whitelist_bounce_relays mailserver_name.com'
>
> in local.cf was so that SA could assign a higher score to bounces that
> never originated at your own mailserver. Thereby identif
Hello Karsten:
Thanks for the reply. I thought the purpose of adding the
'whitelist_bounce_relays mailserver_name.com'
in local.cf was so that SA could assign a higher score to bounces that
never originated at your own mailserver. Thereby identifying return address
forgery.
At 02:04 PM 4
On Sun, 2008-04-06 at 13:19 -0400, Jeff Koch wrote:
> Maybe I'm doing something wrong but the bounces we receive are getting
> extremely low scores. My understanding was that by enabling VBounce in the
> V3.2.4 config's and by adding:
>
> whitelist_bounce_relays mailserver_name.com
>
> we would
* Michael Scheidell <[EMAIL PROTECTED]> [080223 13:46]:
> > I feel like a lot of pretty obvious spams are getting through my system
> > with appallingly low scores. I'm starting to wonder if something may be
> > wrong with my setup. Looking at what spam tests did fire, I'm frequently
> > surprised
> Micah Anderson schrieb:
>
> | [surprisingly low scores]
> | The spams can be pulled from here: http://micah.riseup.net/spams
On 24.02.08 02:15, Matthias Leisi wrote:
> Most (all?) of the samples are forwarded through some debian.org
> mechanism. In order for blacklists to take full effect, you
On Sun, 24 Feb 2008 02:15:24 +0100, Matthias Leisi wrote:
> Micah Anderson schrieb:
>
> | [surprisingly low scores]
> | The spams can be pulled from here: http://micah.riseup.net/spams
>
> Most (all?) of the samples are forwarded through some debian.org
> mechanism. In order for blacklists to ta
On Sat, 23 Feb 2008 18:52:01 -0800, Loren Wilton wrote:
>> I'm looking for people to have a look over these spams and give me some
>> ideas of some possible areas for improvement (either score adjustments,
>> configuration tweaks, plugins that I should try, etc.).
>>
>> The spams can be pulled fro
> From: Micah Anderson <[EMAIL PROTECTED]>
> Date: Sat, 23 Feb 2008 22:54:19 + (UTC)
> To:
> Subject: Low scores
>
>
> I feel like a lot of pretty obvious spams are getting through my system
> with appallingly low scores. I'm starting to wonder if something may be
> wrong with my setup. Loo
I'm looking for people to have a look over these spams and give me some
ideas of some possible areas for improvement (either score adjustments,
configuration tweaks, plugins that I should try, etc.).
The spams can be pulled from here: http://micah.riseup.net/spams
It appears to me you have just
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Micah Anderson schrieb:
| [surprisingly low scores]
| The spams can be pulled from here: http://micah.riseup.net/spams
Most (all?) of the samples are forwarded through some debian.org
mechanism. In order for blacklists to take full effect, you sho
Hi,
* Bill Landry wrote (2005-01-30 22:52):
>From: "Thorsten Haude" <[EMAIL PROTECTED]>
>> I just installed Razor and DCC, should I go for Pyzor
>> too? Or should I use only one?
>
>I use all three, but it's really up to you. You just need to make sure you
>monitor your hit counts (for FPs/FNs) w
- Original Message -
From: "Thorsten Haude" <[EMAIL PROTECTED]>
> One other thing: Will the score get mixed up if I only use some of the
> network tests?
No.
> I just installed Razor and DCC, should I go for Pyzor
> too? Or should I use only one?
I use all three, but it's really up to
Hi,
* Robert Menschel wrote (2005-01-30 22:04):
>You could reinstall and during the installation specify that you want
>network tests off, but I think you'll be better off by fixing your
>installation so the network tests work.
One other thing: Will the score get mixed up if I only use some of th
Hi,
please send me every mail only once.
* Robert Menschel wrote (2005-01-30 22:04):
>TH> I use Debian Sarge, which recently updated to SA 3.0.2. After this
>TH> update, SA started assigning low scores to high Bayesian probabilties.
>TH> I had a look at 50_scores.cf and it seems that SA uses the
Hi,
* Thomas Arend wrote (2005-01-30 21:39):
>-BEGIN PGP SIGNED MESSAGE-
>Am Sonntag, 30. Januar 2005 17:07 schrieb Thorsten Haude:
>> The manpage tells me that the fourth column is used when "network
>> tests are enabled". However, I couldn't find anything (neither in the
>> FAQ nor in th
Hello Thorsten,
Sunday, January 30, 2005, 8:07:06 AM, you wrote:
TH> I use Debian Sarge, which recently updated to SA 3.0.2. After this
TH> update, SA started assigning low scores to high Bayesian probabilties.
TH> I had a look at 50_scores.cf and it seems that SA uses the fourth
TH> column where
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Am Sonntag, 30. Januar 2005 17:07 schrieb Thorsten Haude:
[..]
>
> The manpage tells me that the fourth column is used when "network
> tests are enabled". However, I couldn't find anything (neither in the
> FAQ nor in the docs) about what these netwo
Rich wrote:
I have recently upgrades from 2.x to 3.0.1 and have been watching the
scores for stuff that is real spam. I had a bunch of up-weighted scores in
2.x but I didn't move those over to the new version while I evaluated what
the new version was doing. What I don't understand are what seem to
At 01:43 PM 9/23/2004, German Staltari wrote:
Hi, I would like to know why the Bayes rules has so low scores.
Read the FAQ, this explains how most rule scores are assigned, including
bayes:
http://wiki.apache.org/spamassassin/HowScoresAreAssigned
Basically, it's the result of a real-world statisti
49 matches
Mail list logo
