Re: NO_RELAYS spam

2010-07-01 Thread Randy Ramsdell
Karsten Bräckelmann wrote: On Fri, 2010-06-18 at 23:54 +0200, Karsten Bräckelmann wrote: Your issue is kind of weird and far less than common. Read, I cannot recall coming across such a report *ever* on this list. Thus, the collective list's lack of pin-pointing the cause with the info given

Re: NO_RELAYS spam

2010-06-25 Thread Karsten Bräckelmann
On Fri, 2010-06-18 at 23:54 +0200, Karsten Bräckelmann wrote: > Your issue is kind of weird and far less than common. Read, I cannot > recall coming across such a report *ever* on this list. > > Thus, the collective list's lack of pin-pointing the cause with the info > given. The very reason we ne

Re: NO_RELAYS spam

2010-06-21 Thread Noel Jones
On Thu, Jun 17, 2010 at 11:13 AM, Randy Ramsdell wrote: > Charles Gregory wrote: >> >> On Thu, 17 Jun 2010, Randy Ramsdell wrote: >>> >>> The original email did not hit the NO_RELAYS rule but subsequent runs >>> through do hit this rule and it isn't on all email. >> >> This sounds to me like you a

Re: NO_RELAYS spam

2010-06-21 Thread Matus UHLAR - fantomas
On Thu, 17 Jun 2010, Randy Ramsdell wrote: > The original email did not hit the NO_RELAYS rule but subsequent > runs through do hit this rule and it isn't on all email. >> On 17.06.10 12:13, Randy Ramsdell wrote: >>> Hmmm, this mail came in and went straight to the users inbox. 1.

Re: NO_RELAYS spam

2010-06-20 Thread Martin Gregorie
On Sun, 2010-06-20 at 08:22 -0500, David Morton wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > On 6/17/10 11:13 AM, Randy Ramsdell wrote: > > > Postfix ---> 2. Amavis ( Spamd/Clamd) ---> 3. Postfix ---> 4. > > Dovecot-deliver > > > No, I run a script on the mail server manually th

Re: NO_RELAYS spam

2010-06-20 Thread David Morton
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 6/17/10 11:13 AM, Randy Ramsdell wrote: > Postfix ---> 2. Amavis ( Spamd/Clamd) ---> 3. Postfix ---> 4. > Dovecot-deliver > No, I run a script on the mail server manually that simply moves the > files. Then I check with spamassassin. I wonder ab

Re: NO_RELAYS spam

2010-06-19 Thread Joseph Brennan
Randy Ramsdell wrote: Using sendmail without certain areguments will cause the To: field to show up as . Nothing would make sendmail write a bogus header like that one. That is not a valid email address. This is valid: To: undisclosed recipients:; It's the list syntax with a null list. Th

Re: NO_RELAYS spam

2010-06-18 Thread Karsten Bräckelmann
On Fri, 2010-06-18 at 13:33 -0400, Randy Ramsdell wrote: > Charles Gregory wrote: > > On Fri, 18 Jun 2010, Randy Ramsdell wrote: > > > I have no problem going over there but I am not convinced that the > > > Amavis program is the problem. The header field is changed by > > > spamassassin. Doesn't

Re: [sa] Re: NO_RELAYS spam

2010-06-18 Thread Randy Ramsdell
Charles Gregory wrote: On Fri, 18 Jun 2010, Randy Ramsdell wrote: I have no problem going over there but I am not convinced that the Amavis program is the problem. The header field is changed by spamassassin. Doesn't the email simply get handed to Spamassasin by Amavis where the headers are mo

Re: [sa] Re: NO_RELAYS spam

2010-06-18 Thread Charles Gregory
On Fri, 18 Jun 2010, Randy Ramsdell wrote: I have no problem going over there but I am not convinced that the Amavis program is the problem. The header field is changed by spamassassin. Doesn't the email simply get handed to Spamassasin by Amavis where the headers are modified by spam report et

Re: NO_RELAYS spam

2010-06-18 Thread Randy Ramsdell
Matus UHLAR - fantomas wrote: On Thu, 17 Jun 2010, Randy Ramsdell wrote: The original email did not hit the NO_RELAYS rule but subsequent runs through do hit this rule and it isn't on all email. Charles Gregory wrote: This sounds to me like you are 'resending' the mail

Re: NO_RELAYS spam

2010-06-18 Thread Randy Ramsdell
David B Funk wrote: On Thu, 17 Jun 2010, Randy Ramsdell wrote: get us added to lists, but Michael stated "then, check the blacklists to see how to get removed." as if we are already on a list. We are not. Back to the main issue. Here is an example pastbin. http://pastebin.com/mJqRPzkv I f

Re: NO_RELAYS spam

2010-06-18 Thread Randy Ramsdell
Michelle Konzack wrote: Hello Randy Ramsdell, Am 2010-06-17 10:38:08, hacktest Du folgendes herunter: We are getting a ton of this type and it scores low because there are no received headers. What is this type of mail? I do not recall seeing these in the past. Hehehe... sounds like a

Re: NO_RELAYS spam

2010-06-18 Thread Matus UHLAR - fantomas
>> On Thu, 17 Jun 2010, Randy Ramsdell wrote: >>> The original email did not hit the NO_RELAYS rule but subsequent runs >>> through do hit this rule and it isn't on all email. > Charles Gregory wrote: >> This sounds to me like you are 'resending' the mail from a local >> address to your mail se

Re: NO_RELAYS spam

2010-06-17 Thread Michelle Konzack
Hello Randy Ramsdell, Am 2010-06-17 10:38:08, hacktest Du folgendes herunter: > We are getting a ton of this type and it scores low because there > are no received headers. What is this type of mail? I do not recall > seeing these in the past. Hehehe... sounds like a new customer of me... His ma

Re: NO_RELAYS spam

2010-06-17 Thread David B Funk
On Thu, 17 Jun 2010, Randy Ramsdell wrote: > get us added to lists, but Michael stated "then, check the blacklists to > see how to get removed." as if we are already on a list. We are not. > > Back to the main issue. > > Here is an example pastbin. http://pastebin.com/mJqRPzkv > > I found this mes

Re: NO_RELAYS spam

2010-06-17 Thread Charles Gregory
On Thu, 17 Jun 2010, Randy Ramsdell wrote: Hmmm, this mail came in and went straight to the users inbox. 1. Postfix ---> 2. Amavis ( Spamd/Clamd) ---> 3. Postfix ---> 4. Dovecot-deliver So the problem is somewhere during the 2 --- > 3 or step 3 or 4. Step 4 it is unlikely since Deliver simply

Re: NO_RELAYS spam

2010-06-17 Thread Randy Ramsdell
Charles Gregory wrote: On Thu, 17 Jun 2010, Randy Ramsdell wrote: The original email did not hit the NO_RELAYS rule but subsequent runs through do hit this rule and it isn't on all email. This sounds to me like you are 'resending' the mail from a local address to your mail server, rather than

Re: NO_RELAYS spam

2010-06-17 Thread Charles Gregory
On Thu, 17 Jun 2010, Randy Ramsdell wrote: The original email did not hit the NO_RELAYS rule but subsequent runs through do hit this rule and it isn't on all email. This sounds to me like you are 'resending' the mail from a local address to your mail server, rather than 'feeding' the original

Re: NO_RELAYS spam

2010-06-17 Thread Randy Ramsdell
Michael Scheidell wrote: On 6/17/10 11:31 AM, Randy Ramsdell wrote: I just checked our spam reports and this rule never hits. It is not locally generated email either or I can not find any coming from us. This is an strange issue and I am not where to begin to determine what is doing this.

Re: NO_RELAYS spam

2010-06-17 Thread Michael Scheidell
On 6/17/10 11:31 AM, Randy Ramsdell wrote: I just checked our spam reports and this rule never hits. It is not locally generated email either or I can not find any coming from us. This is an strange issue and I am not where to begin to determine what is doing this. if you have an insecure

Re: NO_RELAYS spam

2010-06-17 Thread Randy Ramsdell
Michael Scheidell wrote: On 6/17/10 10:38 AM, Randy Ramsdell wrote: We are getting a ton of this type and it scores low because there are no received headers. What is this type of mail? I do not recall seeing these in the past. its coming from you then :-( or, your mail server is stripping

Re: NO_RELAYS spam

2010-06-17 Thread Randy Ramsdell
Michael Scheidell wrote: On 6/17/10 10:38 AM, Randy Ramsdell wrote: We are getting a ton of this type and it scores low because there are no received headers. What is this type of mail? I do not recall seeing these in the past. its coming from you then :-( or, your mail server is stripping

Re: NO_RELAYS spam

2010-06-17 Thread Michael Scheidell
On 6/17/10 10:38 AM, Randy Ramsdell wrote: We are getting a ton of this type and it scores low because there are no received headers. What is this type of mail? I do not recall seeing these in the past. its coming from you then :-( or, your mail server is stripping out or not adding headers.