RE: rbl for smtp auth hosts

2023-09-16 Thread Marc
> >> >>Anyone have any experience with a dns blacklist specific to known smtp > >> >>auth abuse? > > >> On 15.09.23 17:51, Benny Pedersen wrote: > >> >spamrats ? > >> > > >> >https://www.spamrats.com/ > > >> I have bad experiente with spam rats and thus wouldn't recommend using > >> them. > >> YM

Re: rbl for smtp auth hosts

2023-09-16 Thread Matus UHLAR - fantomas
>Marc skrev den 2023-09-15 17:01: >>Anyone have any experience with a dns blacklist specific to known smtp >>auth abuse? On 15.09.23 17:51, Benny Pedersen wrote: >spamrats ? > >https://www.spamrats.com/ I have bad experiente with spam rats and thus wouldn't recommend using them. YMMV of cour

Re: rbl for smtp auth hosts

2023-09-16 Thread Benny Pedersen
Marc skrev den 2023-09-15 23:57: >Marc skrev den 2023-09-15 17:01: >>Anyone have any experience with a dns blacklist specific to known smtp >>auth abuse? On 15.09.23 17:51, Benny Pedersen wrote: >spamrats ? > >https://www.spamrats.com/ I have bad experiente with spam rats and thus wouldn't reco

RE: rbl for smtp auth hosts

2023-09-15 Thread Marc
> >Marc skrev den 2023-09-15 17:01: > >>Anyone have any experience with a dns blacklist specific to known smtp > >>auth abuse? > > On 15.09.23 17:51, Benny Pedersen wrote: > >spamrats ? > > > >https://www.spamrats.com/ > > I have bad experiente with spam rats and thus wouldn't recommend using > t

Re: rbl for smtp auth hosts

2023-09-15 Thread Matus UHLAR - fantomas
Marc skrev den 2023-09-15 17:01: Anyone have any experience with a dns blacklist specific to known smtp auth abuse? On 15.09.23 17:51, Benny Pedersen wrote: spamrats ? https://www.spamrats.com/ I have bad experiente with spam rats and thus wouldn't recommend using them. YMMV of course. --

RE: rbl for smtp auth hosts

2023-09-15 Thread Marc
> > Anyone have any experience with a dns blacklist specific to known smtp > > auth abuse? > > spamrats ? > > https://www.spamrats.com/ yes thanks! this RATS-Auth maybe

Re: rbl for smtp auth hosts

2023-09-15 Thread Benny Pedersen
Riccardo Alfieri skrev den 2023-09-15 18:23: On 15/09/23 17:51, Reindl Harald (privat) wrote: limit the connections per hour on smtp-ports with iptables xt_recent and configure postfix properly anvil_rate_time_unit   = 1800s smtpd_client_connection_rate_limit = 100 smtpd_client_re

Re: rbl for smtp auth hosts

2023-09-15 Thread Riccardo Alfieri
On 15/09/23 17:51, Reindl Harald (privat) wrote: limit the connections per hour on smtp-ports with iptables xt_recent and configure postfix properly anvil_rate_time_unit   = 1800s smtpd_client_connection_rate_limit = 100 smtpd_client_recipient_rate_limit  = 400 smtpd_client_message

Re: rbl for smtp auth hosts

2023-09-15 Thread Riccardo Alfieri
On 15/09/23 17:49, Marc wrote: Is this a freely available list? It's included in all DQS accounts, free ones too -- Best regards, Riccardo Alfieri Spamhaus Technology https://www.spamhaus.com/

Re: rbl for smtp auth hosts

2023-09-15 Thread Benny Pedersen
Marc skrev den 2023-09-15 17:01: Anyone have any experience with a dns blacklist specific to known smtp auth abuse? spamrats ? https://www.spamrats.com/

RE: rbl for smtp auth hosts

2023-09-15 Thread Marc
> > > > > On 15.09.23 15:31, Riccardo Alfieri wrote: > >> Yes, at previous $dayjob. Applied on the submission MSA, it proved to > >> be useful in mitigating the fallout when users got their credentials > >> compromised. > > > > can you describe it more? > > > Well, I checked the connecting IP of

Re: rbl for smtp auth hosts

2023-09-15 Thread Riccardo Alfieri
On 15/09/23 17:35, Matus UHLAR - fantomas wrote: On 15.09.23 15:31, Riccardo Alfieri wrote: Yes, at previous $dayjob. Applied on the submission MSA, it proved to be useful in mitigating the fallout when users got their credentials compromised. can you describe it more? Well, I checked the

Re: rbl for smtp auth hosts

2023-09-15 Thread Matus UHLAR - fantomas
On 15/09/23 17:01, Marc wrote: Anyone have any experience with a dns blacklist specific to known smtp auth abuse? On 15.09.23 15:31, Riccardo Alfieri wrote: Yes, at previous $dayjob. Applied on the submission MSA, it proved to be useful in mitigating the fallout when users got their credentia

Re: rbl for smtp auth hosts

2023-09-15 Thread Riccardo Alfieri
On 15/09/23 17:01, Marc wrote: Anyone have any experience with a dns blacklist specific to known smtp auth abuse? Yes, at previous $dayjob. Applied on the submission MSA, it proved to be useful in mitigating the fallout when users got their credentials compromised. -- Best regards, Riccardo

Re: RBL timeouts

2022-12-02 Thread Bill Cole
On 2022-12-02 at 08:04:40 UTC-0500 (Fri, 2 Dec 2022 08:04:40 -0500) Alex is rumored to have said: Hi, Is anyone (everyone?) also experiencing DNS timeouts with barracuda? Chonically, for years, until I gave up on them. Not worthy of production use. 02-Dec-2022 07:03:02.229 query-errors:

Re: RBL timeouts

2022-12-02 Thread Benny Pedersen
Alex skrev den 2022-12-02 14:04: Any bind experts know of a way to record which nameserver is timing out so I can perhaps exclude them? Any idea why it wouldn't just rotate to the next one, or even how to confirm whether it's doing that? you are using 1: rbls not default in spamassassin 2: no

Re: RBL via Spamassasin configuration

2022-06-29 Thread Bill Cole
META: The message below seems to be a reply to a message by Harald Reindl, who was blocked from posting to this mailing list in the past for chronic unreasonably combative behavior. Unfortunately, there's no way to stop him from reading this mailing list via any of the public archives or a 's

Re: RBL via Spamassasin configuration

2022-06-29 Thread Matus UHLAR - fantomas
On 2022-06-29 10:25, Matus UHLAR - fantomas wrote: Since SpamAssassin does deep header scanning, it's more effective than just use incoming IP at MTA level. On 29.06.22 10:58, Benny Pedersen wrote: this is not good, its a sign of forwarding that forwards spam in the first place, that make the

Re: RBL via Spamassasin configuration

2022-06-29 Thread Benny Pedersen
On 2022-06-29 11:05, Marc wrote: I don't really get what you wrote. There is something for blocking at ip level, least resource intensive, and there is an application for doing the advanced header/body scans at a later stage. dont use deap ip scanning on dnsbl use deap content scanning is ok,

RE: RBL via Spamassasin configuration

2022-06-29 Thread Marc
> > On 2022-06-29 10:25, Matus UHLAR - fantomas wrote: > > Since SpamAssassin does deep header scanning, it's more effective than > > just use incoming IP at MTA level. > > this is not good, its a sign of forwarding that forwards spam in the > first place, that make the forwarding ip grey, not wh

Re: RBL via Spamassasin configuration

2022-06-29 Thread Benny Pedersen
On 2022-06-29 10:25, Matus UHLAR - fantomas wrote: Since SpamAssassin does deep header scanning, it's more effective than just use incoming IP at MTA level. this is not good, its a sign of forwarding that forwards spam in the first place, that make the forwarding ip grey, not white/wellcommed,

Re: RBL via Spamassasin configuration

2022-06-29 Thread Matus UHLAR - fantomas
Is this actually going out and doing a DNS query or reading from the header of the message? I think I want to actually do the DNS query and I will cache locally to avoid issues and increase performance. That is what dns servers do, cache. If you have your local dns, these requests are probably

Re: RBL via Spamassasin configuration

2022-06-28 Thread Benny Pedersen
On 2022-06-29 02:56, Joey J wrote: Hello All, not sure where I'm going wrong. in my custom.cf [3] I have #RBL's header RCVD_IN_ZENSPAMHAUS eval:check_rbl('zenspamhaus-lastexternal', 'zen.spamhaus.org.') describe RCVD_IN_ZENSPAMHAUS Relay is listed in zen.spamhaus.org [4] tflags RCVD_IN_ZENSPAMH

Re: RBL via Spamassasin configuration

2022-06-28 Thread Benny Pedersen
On 2022-06-28 23:22, Marc wrote: If you conclude something based on some month, there is no going back on this. I know people in IT that did not learn anything in 15 years. As for now, I am not really convinced by your arguments. Subject RE: RBL via Spamassasin configuration FromMarc To

Re: RBL via Spamassasin configuration

2022-06-28 Thread Joey J
Hello All, not sure where I'm going wrong. in my custom.cf I have #RBL's header RCVD_IN_ZENSPAMHAUS eval:check_rbl('zenspamhaus-lastexternal', 'zen.spamhaus.org.') describe RCVD_IN_ZENSPAMHAUS Relay is listed in zen.spamhaus.org tflags RCVD_IN_ZENSPAMHAUS net score RCVD_IN_ZENSPAMHAUS 5.0 if I qu

Re: RBL via Spamassasin configuration

2022-06-28 Thread Joey J
Thank you, this makes sense, I will look through the mentioned resource. On Tue, Jun 28, 2022 at 5:28 PM Bill Cole < sausers-20150...@billmail.scconsult.com> wrote: > On 2022-06-28 at 14:38:16 UTC-0400 (Tue, 28 Jun 2022 14:38:16 -0400) > Joey J > is rumored to have said: > > > Hello All, > > > >

RE: RBL via Spamassasin configuration

2022-06-28 Thread Marc
> biggest nonsense at all when it comes to spammes given that i added some > hundrets addresses never existed to collect the bodies for trainign and > for the outisde world they are still rejects (milter) How is the guessing of existing email addresses relevant to the current discussion?

Re: RBL via Spamassasin configuration

2022-06-28 Thread Bill Cole
On 2022-06-28 at 14:38:16 UTC-0400 (Tue, 28 Jun 2022 14:38:16 -0400) Joey J is rumored to have said: Hello All, In trying to setup RBL's with SA, I wanted to make sure the proper way to do it. I have seen some samples like this header RCVD_IN_BARRACUDACEN eval:check_rbl('bbarracuda-lastexter

RE: RBL via Spamassasin configuration

2022-06-28 Thread Marc
> BTW: "spammers also strife to optimize the usage of their resources" > shows that you know little to nothing! > > they are using infected machines all over they world > > that bot's are running completly without any feedback because it would > make it possible to track the origin > > even

RE: RBL via Spamassasin configuration

2022-06-28 Thread Marc
> > > Am 28.06.22 um 20:56 schrieb Marc: > > I also believe there is an advantage in rejecting messages, compared > to just marking them. Rejecting messages will train spam systems not to > try more. > > If they know you allow messages through, they will only send you more > > that's nonsense -

RE: RBL via Spamassasin configuration

2022-06-28 Thread Marc
> In trying to setup RBL's with SA, I wanted to make sure the proper way > to do it. > I have seen some samples like this > header RCVD_IN_BARRACUDACEN eval:check_rbl('bbarracuda-lastexternal', > 'b.barracudacentral.org.') > describe RCVD_IN_BARRACUDACEN Relay is listed in b.barracudacentral.org >

Re: RBL

2018-10-11 Thread Matus UHLAR - fantomas
On 10/11/2018 01:35 AM, Matus UHLAR - fantomas wrote: I for example run spamass-milter with -r 10 (rejects score over 10) at one machine, and amavisd-milter with "spam_kill_level_maps=> 10", along with postscreen. This way mail gets refused when listed in DNSBLs, while not when DNSWL (but

Re: RBL

2018-10-11 Thread Grant Taylor
On 10/11/2018 01:35 AM, Matus UHLAR - fantomas wrote: note that spamassassin can run at MTA level, refusing mail when it's found to be sure spam and tagging when it's not. Yes. That's how and why I recommend that people run SpamAssassin if they have the choice to do so. I for example run sp

Re: RBL

2018-10-11 Thread Matus UHLAR - fantomas
On 10/10/2018 01:56 PM, Tom Hendrikx wrote: However, in general it's better to use DNSBLs at the MTA level, which uses a lot less resources than implementing them in Spamassassin. So try and set them up in postfix first. On 10.10.18 14:09, Grant Taylor wrote: I conceptually agree. However, I

Re: RBL

2018-10-10 Thread David Jones
Street > Juneau, Alaska 99801 > Phone: (907) 586-0242, Fax: (907) 586-4588 Registered Linux User No: 307357 > > -Original Message- > From: Grant Taylor [mailto:gtay...@tnetconsulting.net] > Sent: Wednesday, October 10, 2018 12:09 PM > To: users@spamassassin.apache.org &

RE: RBL

2018-10-10 Thread Kevin Miller
User No: 307357 -Original Message- From: Grant Taylor [mailto:gtay...@tnetconsulting.net] Sent: Wednesday, October 10, 2018 12:09 PM To: users@spamassassin.apache.org Subject: Re: RBL On 10/10/2018 01:56 PM, Tom Hendrikx wrote: > However, in general it's better to use DNSBLs at

Re: RBL

2018-10-10 Thread Grant Taylor
On 10/10/2018 01:56 PM, Tom Hendrikx wrote: However, in general it's better to use DNSBLs at the MTA level, which uses a lot less resources than implementing them in Spamassassin. So try and set them up in postfix first. I conceptually agree. However, I prefer to do some RBL testing in SpamAs

Re: RBL

2018-10-10 Thread Tom Hendrikx
On 10-10-18 21:51, Tom Hendrikx wrote: > On 10-10-18 21:05, Gokan Atmaca wrote: >> Hello >> >> I'm using Postfix and Dovecot. I use Spamassassin as an antispam >> service. I don't know how to do RBL checks. >> How do I control RBL? (I don't want to do it with Postfix, because I >> don't want to

Re: RBL

2018-10-10 Thread John Hardin
On Wed, 10 Oct 2018, Gokan Atmaca wrote: Hello I'm using Postfix and Dovecot. I use Spamassassin as an antispam service. I don't know how to do RBL checks. How do I control RBL? (I don't want to do it with Postfix, because I don't want to do two different whitelists.) Search the mailing list

Re: RBL

2018-10-10 Thread Tom Hendrikx
On 10-10-18 21:05, Gokan Atmaca wrote: > Hello > > I'm using Postfix and Dovecot. I use Spamassassin as an antispam > service. I don't know how to do RBL checks. > How do I control RBL? (I don't want to do it with Postfix, because I > don't want to do two different whitelists.) > > Thanks. > Hi

Re: rbl

2017-12-19 Thread Matus UHLAR - fantomas
I use RBL on (zimbra) Postfix. But I can not use white list. Which whitelist you can not use? DNS based whitelists? On 16.12.17 23:52, Gokan Atmaca wrote: that's enough: "whitelist from @ domain.x". I'm checking the body, header. you apparently mean "whitelist_from @domain.x" that's a S

Re: rbl

2017-12-16 Thread Gokan Atmaca
> Which whitelist you can not use? DNS based whitelists? that's enough: "whitelist from @ domain.x". I'm checking the body, header. I'm doing a URI check. DNS is black, I'm on the white list. I just wanted to use it in addition to the RBL lists. I was looking for samples. thanks. On Sat, Dec 16

Re: rbl

2017-12-16 Thread Matus UHLAR - fantomas
On 16.12.17 20:37, Gokan Atmaca wrote: I use Zimbra OCS. How do I use RBL? (Except Postfix ... I just want to use spamassassin.) On Sat, Dec 16, 2017 at 10:04 PM, Matus UHLAR - fantomas wrote: zimbra bundles both postfix and spamassassin. What makes you think you don't use RBL's? On 16.12.

Re: rbl

2017-12-16 Thread Gokan Atmaca
> good point, why ask for help, and users here says what do provide to get > more help (postconf -nf) would help me and others to guide more on what to > do in both postfix and spamasssaasin, i give up I resolved with the example below. (1) I was just asking the configuration example. But I could

Re: rbl

2017-12-16 Thread Benny Pedersen
Gokan Atmaca skrev den 2017-12-16 20:11: I use RBL on (zimbra) Postfix. But I can not use white list. I just want to do this with spamassassin. So I will use the white list feature. should i ask about postconf -nf again ? no conf, no problem, you are on your own then

Re: rbl

2017-12-16 Thread Benny Pedersen
Matus UHLAR - fantomas skrev den 2017-12-16 20:04: On 16.12.17 20:37, Gokan Atmaca wrote: I use Zimbra OCS. How do I use RBL? (Except Postfix ... I just want to use spamassassin.) zimbra bundles both postfix and spamassassin. What makes you think you don't use RBL's? good point, why ask fo

Re: rbl

2017-12-16 Thread Gokan Atmaca
> zimbra bundles both postfix and spamassassin. What makes you think you don't > use RBL's? I use RBL on (zimbra) Postfix. But I can not use white list. I just want to do this with spamassassin. So I will use the white list feature. Thanks. On Sat, Dec 16, 2017 at 10:04 PM, Matus UHLAR - fantom

Re: rbl

2017-12-16 Thread Matus UHLAR - fantomas
On 16.12.17 20:37, Gokan Atmaca wrote: I use Zimbra OCS. How do I use RBL? (Except Postfix ... I just want to use spamassassin.) zimbra bundles both postfix and spamassassin. What makes you think you don't use RBL's? -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warnin

Re: rbl

2017-12-16 Thread Gokan Atmaca
> but that only helps if you really have some rbl in postfix, you like to have > in spamassassin > > oh dear is nearly xmax :=) I do not know spamassassins ... How can I do it. Do I need to look in the "local.cf" file to do this? I do not know what this is about. Please tell it to someone you do n

Re: rbl

2017-12-16 Thread Benny Pedersen
Gokan Atmaca skrev den 2017-12-16 19:11: spamassassin has a lot of rbl's preconfigured http://www.catb.org/esr/faqs/smart-questions.html#beprecise +1 Thank you for the information. Normally I do Postfix-based RBL checking. But I want to do it with Spamassassin. Could you support this? you

Re: rbl

2017-12-16 Thread Gokan Atmaca
> spamassassin has a lot of rbl's preconfigured > http://www.catb.org/esr/faqs/smart-questions.html#beprecise Thank you for the information. Normally I do Postfix-based RBL checking. But I want to do it with Spamassassin. Could you support this? Thank you. On Sat, Dec 16, 2017 at 9:04 PM, Reindl

Re: rbl check

2016-11-18 Thread RW
On Fri, 18 Nov 2016 15:59:59 + Nicola Piazzi wrote: > I use spamassassin in incoming and outgoing emails > Outgoing emails come from an internal ip > Is there a way to avoid rbl checks when it come from an ip class ? There are several ways: 1. put the IP address blocks into trusted_networks

Re: rbl check

2016-11-18 Thread Benny Pedersen
Nicola Piazzi skrev den 2016-11-18 16:59: I use spamassassin in incoming and outgoing emails +1 Outgoing emails come from an internal ip setup internal_networks and trusted_networks in local.cf see more info in perldoc Mail::SpamAssassin::Conf spamassassin needs to know ALL your wan ips,

Re: rbl check

2016-11-18 Thread Alex
Hi, On Fri, Nov 18, 2016 at 10:59 AM, Nicola Piazzi < nicola.pia...@gruppocomet.it> wrote: > I use spamassassin in incoming and outgoing emails > > Outgoing emails come from an internal ip > > Is there a way to avoid rbl checks when it come from an ip class ? > This isn't something you'd use spa

Re: RBL format to blacklist email addresses?

2015-08-04 Thread Marc Perkel
Yes - I'm going to convert all to lower case. On 07/29/15 16:56, Reindl Harald wrote: Am 30.07.2015 um 01:53 schrieb Bill Cole: Does this text look at all familiar? Verbs and argument values (e.g., "TO:" or "to:" in the RCPT command and extension name keywords) are not case sensitive, w

Re: RBL format to blacklist email addresses?

2015-07-29 Thread John Hardin
On Thu, 30 Jul 2015, Reindl Harald wrote: Am 30.07.2015 um 02:16 schrieb John Hardin: On Wed, 29 Jul 2015, Bill Cole wrote: > On 29 Jul 2015, at 18:56, David B Funk wrote: > > > IE the DNS system is always case-insensitive > The difference between DNS being specified as case-insensit

Re: RBL format to blacklist email addresses?

2015-07-29 Thread Bill Cole
On 29 Jul 2015, at 20:16, John Hardin wrote: On Wed, 29 Jul 2015, Bill Cole wrote: On 29 Jul 2015, at 18:56, David B Funk wrote: IE the DNS system is always case-insensitive ... The difference between DNS being specified as case-insensitive ...which restores my question about collision

Re: RBL format to blacklist email addresses?

2015-07-29 Thread Dianne Skoll
On Thu, 30 Jul 2015 01:56:08 +0200 Reindl Harald wrote: > * no mailserver on this world treats the local part case-sensitive Well possibly, but that doesn't apply to all mail-handling software. Mail::SRS originally treated the local part case-sensitively, but it had to weaken the protection

Re: RBL format to blacklist email addresses?

2015-07-29 Thread David B Funk
On Thu, 30 Jul 2015, Reindl Harald wrote: Am 30.07.2015 um 01:53 schrieb Bill Cole: Does this text look at all familiar? Verbs and argument values (e.g., "TO:" or "to:" in the RCPT command and extension name keywords) are not case sensitive, with the sole exception in this specificati

Re: RBL format to blacklist email addresses?

2015-07-29 Thread Reindl Harald
Am 30.07.2015 um 02:16 schrieb John Hardin: On Wed, 29 Jul 2015, Bill Cole wrote: On 29 Jul 2015, at 18:56, David B Funk wrote: IE the DNS system is always case-insensitive The difference between DNS being specified as case-insensitive ...which restores my question about collisions ba

Re: RBL format to blacklist email addresses?

2015-07-29 Thread John Hardin
On Wed, 29 Jul 2015, Bill Cole wrote: On 29 Jul 2015, at 18:56, David B Funk wrote: IE the DNS system is always case-insensitive ... The difference between DNS being specified as case-insensitive ...which restores my question about collisions based on case-insensitive comparison of bas

Re: RBL format to blacklist email addresses?

2015-07-29 Thread John Hardin
On Thu, 30 Jul 2015, Reindl Harald wrote: Am 29.07.2015 um 23:34 schrieb John Hardin: On Wed, 29 Jul 2015, Paul Stead wrote: > On 29/07/15 18:11, Benny Pedersen wrote: > > > > Henrik krohn did create a emailbl.pl but it was droppede later, it > > Was > > designede very well, i have

Re: RBL format to blacklist email addresses?

2015-07-29 Thread Reindl Harald
Am 30.07.2015 um 01:53 schrieb Bill Cole: Does this text look at all familiar? Verbs and argument values (e.g., "TO:" or "to:" in the RCPT command and extension name keywords) are not case sensitive, with the sole exception in this specification of a mailbox local-part (SMTP Extension

Re: RBL format to blacklist email addresses?

2015-07-29 Thread Bill Cole
On 29 Jul 2015, at 18:56, David B Funk wrote: IE the DNS system is always case-insensitive and most systems are too WRT the email ID. Does this text look at all familiar? Verbs and argument values (e.g., "TO:" or "to:" in the RCPT command and extension name keywords) are not case sensit

Re: RBL format to blacklist email addresses?

2015-07-29 Thread David B Funk
On Wed, 29 Jul 2015, John Hardin wrote: On Wed, 29 Jul 2015, Paul Stead wrote: On 29/07/15 18:11, Benny Pedersen wrote: Henrik krohn did create a emailbl.pl but it was droppede later, it Was designede very well, i have tryed Google it, but seems impossible to get links to it now. I have

Re: RBL format to blacklist email addresses?

2015-07-29 Thread Reindl Harald
Am 29.07.2015 um 23:34 schrieb John Hardin: On Wed, 29 Jul 2015, Paul Stead wrote: On 29/07/15 18:11, Benny Pedersen wrote: Henrik krohn did create a emailbl.pl but it was droppede later, it Was designede very well, i have tryed Google it, but seems impossible to get links to it now. I

Re: RBL format to blacklist email addresses?

2015-07-29 Thread Marc Perkel
On 07/29/15 12:00, David B Funk wrote: On Wed, 29 Jul 2015, Marc Perkel wrote: Just wondering. I'm thinking about creating an RBL to block email addresses. But you can't use an @ in a hostname for lookups. So - is there a standard RBL format for email addresses or do I need to just make som

Re: RBL format to blacklist email addresses?

2015-07-29 Thread John Hardin
On Wed, 29 Jul 2015, Paul Stead wrote: On 29/07/15 18:11, Benny Pedersen wrote: Henrik krohn did create a emailbl.pl but it was droppede later, it Was designede very well, i have tryed Google it, but seems impossible to get links to it now. I have got a copy of Henrik's code - I'm not sur

Re: RBL format to blacklist email addresses?

2015-07-29 Thread John Hardin
On Wed, 29 Jul 2015, Paul Stead wrote: On 29/07/15 21:32, Paul Stead wrote: The essential formula is strtolower(md5()). *ahem* md5(strtolower()). Never mind... :) -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174

Re: RBL format to blacklist email addresses?

2015-07-29 Thread Paul Stead
On 29/07/15 21:32, Paul Stead wrote: The essential formula is strtolower(md5()). *ahem* md5(strtolower()). -- Paul Stead Systems Engineer Zen Internet

Re: RBL format to blacklist email addresses?

2015-07-29 Thread Paul Stead
On 29/07/15 18:11, Benny Pedersen wrote: Henrik krohn did create a emailbl.pl but it was droppede later, it Was designede very well, i have tryed Google it, but seems impossible to get links to it now. I have got a copy of Henrik's code - I'm not sure on the procedure about uploading this. Th

Re: RBL format to blacklist email addresses?

2015-07-29 Thread David B Funk
On Wed, 29 Jul 2015, Marc Perkel wrote: Just wondering. I'm thinking about creating an RBL to block email addresses. But you can't use an @ in a hostname for lookups. So - is there a standard RBL format for email addresses or do I need to just make something up? Who says: "you can't use an

Re: RBL format to blacklist email addresses?

2015-07-29 Thread Benny Pedersen
On July 29, 2015 6:04:52 PM Marc Perkel wrote: Just wondering. We all do :) I'm thinking about creating an RBL to block email addresses. But you can't use an @ in a hostname for lookups. So - is there a standard RBL format for email addresses or do I need to just make something up? Henrik

Re: RBL format to blacklist email addresses?

2015-07-29 Thread Bill Cole
On 29 Jul 2015, at 12:02, Marc Perkel wrote: Just wondering. I'm thinking about creating an RBL to block email addresses. But you can't use an @ in a hostname for lookups. So - is there a standard RBL format for email addresses or do I need to just make something up? Are you unaware of the

Re: RBL format to blacklist email addresses?

2015-07-29 Thread Martin Gregorie
On Wed, 2015-07-29 at 09:02 -0700, Marc Perkel wrote: > Just wondering. > > I'm thinking about creating an RBL to block email addresses. But you > can't use an @ in a hostname for lookups. So - is there a standard > RBL > format for email addresses or do I need to just make something up? > How

Re: RBL format to blacklist email addresses?

2015-07-29 Thread Henrik K
Pretty sure you were reading the list back in 2009. Maybe you forgot EmailBL? Just md5 the address - but there's no standard so it's up to you. http://www.gossamer-threads.com/lists/engine?list=spamassassin&do=search_results&search_forum=forum_2&search_string=emailbl On Wed, Jul 29, 2015 at 09

RE: RBL format to blacklist email addresses?

2015-07-29 Thread Kevin Miller
Could you use the % conversion similarly to a URL that has a space, i.e. %20? Just use the conversion for whatever @ is... ...Kevin -- Kevin Miller Network/email Administrator, CBJ MIS Dept. 155 South Seward Street Juneau, Alaska 99801 Phone: (907) 586-0242, Fax: (907) 586-4500 Registered Linux

Re: RBL/SPF if header exists

2015-03-31 Thread David Jones
>From: Joe Quinn >Sent: Tuesday, March 31, 2015 11:44 AM >To: users@spamassassin.apache.org >Subject: Re: RBL/SPF if header exists >On 3/31/2015 12:23 PM, Mike Cardwell wrote: >> * on the Tue, Mar 31, 2015 at 12:15:31PM -0400, Joe Quinn wrote: >>> Here's an

Re: RBL/SPF if header exists

2015-03-31 Thread Joe Quinn
On 3/31/2015 12:23 PM, Mike Cardwell wrote: * on the Tue, Mar 31, 2015 at 12:15:31PM -0400, Joe Quinn wrote: Here's an example from when Yahoo's internal Received headers were hitting RCVD_ILLEGAL_IP, taken from here: http://www.pccc.com/downloads/SpamAssassin/contrib/KAM.cf header __KAM_YAHOO_

Re: RBL/SPF if header exists

2015-03-31 Thread Mike Cardwell
* on the Tue, Mar 31, 2015 at 12:15:31PM -0400, Joe Quinn wrote: >>> You can fairly easily write a meta that reverses the score of each RBL >>> and SPF rule if your condition fires. >> Any chance you could point me to an example of how to do this? > Here's an example from when Yahoo's internal R

Re: RBL/SPF if header exists

2015-03-31 Thread Joe Quinn
On 3/31/2015 12:12 PM, Mike Cardwell wrote: * on the Tue, Mar 31, 2015 at 11:59:39AM -0400, Joe Quinn wrote: Is it possible to enable or disable RBL and/or SPF checks according to the existence or lack of a header? Without going into too many details, I need a way of transmitting to SpamAssass

Re: RBL/SPF if header exists

2015-03-31 Thread John Hardin
On Tue, 31 Mar 2015, Mike Cardwell wrote: Is it possible to enable or disable RBL and/or SPF checks according to the existence or lack of a header? Without going into too many details, I need a way of transmitting to SpamAssassin at scan-time that it should not run SPF or RBL checks on a partic

Re: RBL/SPF if header exists

2015-03-31 Thread Mike Cardwell
* on the Tue, Mar 31, 2015 at 11:59:39AM -0400, Joe Quinn wrote: >> Is it possible to enable or disable RBL and/or SPF checks according to >> the existence or lack of a header? >> >> Without going into too many details, I need a way of transmitting to >> SpamAssassin at scan-time that it should n

Re: RBL/SPF if header exists

2015-03-31 Thread Joe Quinn
On 3/31/2015 11:45 AM, Mike Cardwell wrote: Is it possible to enable or disable RBL and/or SPF checks according to the existence or lack of a header? Without going into too many details, I need a way of transmitting to SpamAssassin at scan-time that it should not run SPF or RBL checks on a parti

Re: RBL effectiveness (was Re: Ready to throw in the towel on email providing...)

2014-07-31 Thread Noel Butler
On 31/07/2014 11:36, Dave Warren wrote: There is a difference: Gmail is a very major source of wanted, legitimate mail. Most "may 'n pa run outback country dialup ISPs" are not. Most mail to most clients are a "very major source of wanted mail" Again, playing favourites is plain wrong, and i

Re: RBL effectiveness (was Re: Ready to throw in the towel on email providing...)

2014-07-31 Thread Matthias Leisi
On Thu, Jul 31, 2014 at 1:06 AM, Noel Butler wrote: > There is no such thing as 'too big' when it comes to handling the shit storm > of spam that gets spewed out of some organisations, and I'll treat Gmail and > the likes the same as a ma 'n pa run outback country dialup ISP, there is At dnswl.

Re: RBL effectiveness (was Re: Ready to throw in the towel on email providing...)

2014-07-30 Thread Dave Warren
On 2014-07-30 16:06, Noel Butler wrote: Certainly have done it on employers network before (a public ISP), and would have no problem doing it again if the need arose. There is no such thing as 'too big' when it comes to handling the shit storm of spam that gets spewed out of some organisations,

Re: RBL effectiveness (was Re: Ready to throw in the towel on email providing...)

2014-07-30 Thread Martin Gregorie
On Thu, 2014-07-31 at 09:06 +1000, Noel Butler wrote: > Certainly have done it on employers network before (a public ISP), and > would have no problem doing it again if the need arose. > There is no such thing as 'too big' when it comes to handling the shit > storm of spam that gets spewed out of

Re: RBL effectiveness (was Re: Ready to throw in the towel on email providing...)

2014-07-30 Thread Noel Butler
On Wed, 2014-07-30 at 09:12 -0400, David F. Skoll wrote: > On Wed, 30 Jul 2014 09:34:30 +1000 > Noel Butler wrote: > > > This is the exact attitude as to why they wont get off their arses, > > because people think they are too big to block. be damned if I care, > > I have blocked yahoo and gmai

Re: RBL effectiveness (was Re: Ready to throw in the towel on email providing...)

2014-07-30 Thread Dave Warren
On 2014-07-30 06:12, David F. Skoll wrote: On Wed, 30 Jul 2014 09:34:30 +1000 Noel Butler wrote: This is the exact attitude as to why they wont get off their arses, because people think they are too big to block. be damned if I care, I have blocked yahoo and gmail before, and I dare say I'll h

Re: RBL effectiveness (was Re: Ready to throw in the towel on email providing...)

2014-07-30 Thread David F. Skoll
On Wed, 30 Jul 2014 09:34:30 +1000 Noel Butler wrote: > This is the exact attitude as to why they wont get off their arses, > because people think they are too big to block. be damned if I care, > I have blocked yahoo and gmail before, and I dare say I'll have to > again sometime. You don't hav

Re: RBL effectiveness (was Re: Ready to throw in the towel on email providing...)

2014-07-29 Thread Noel Butler
On 30/07/2014 04:29, David F. Skoll wrote: originates from servers that RBLs cannot block for political or practical resons. Think Gmail, Hotmail and Yahoo servers, for This is the exact attitude as to why they wont get off their arses, because people think they are too big to block. be damn

Re: RBL effectiveness (was Re: Ready to throw in the towel on email providing...)

2014-07-29 Thread Philip Prindeville
On Jul 29, 2014, at 12:29 PM, David F. Skoll wrote: > On Tue, 29 Jul 2014 14:21:56 -0400 > Dave Pooser wrote: > > RBLs are a good first line of defense, but unfortunately a lot of spam > originates from servers that RBLs cannot block for political or > practical resons. Think Gmail, Hotmail a

Re: RBL effectiveness (was Re: Ready to throw in the towel on email providing...)

2014-07-29 Thread Dave Pooser
>RBLs are a good first line of defense, but unfortunately a lot of spam >originates from servers that RBLs cannot block for political or >practical resons. Think Gmail, Hotmail and Yahoo servers, for >example. You need something extra to have acceptable catch rates, and >the "something extra" inv

Re: rbl checks not running

2009-11-24 Thread Charles Gregory
On Mon, 23 Nov 2009, Mark Hedges wrote: OMG I am SO DUMB - I had skip_rbl_checks set in my personal userconf. DUH. (nod) Thanks for posting the full logs for both messages. Once the problem is properly defined, the solution is usually not too hard to find (though occasionally embarrassing *gri

Re: rbl checks not running

2009-11-23 Thread Mark Hedges
OMG I am SO DUMB - I had skip_rbl_checks set in my personal userconf. DUH. Thanks everyone for your helpful suggestions - actually it was working fine from the beginning. Mark

Re: rbl checks not running

2009-11-23 Thread Mark Hedges
On Sat, 21 Nov 2009, Mark Hedges wrote: > On Sat, 21 Nov 2009, Charles Gregory wrote: > > > > Did you look at the logs you posted? > > NONE of the DNS tests are being launched on msg 26661 > > Yes, that is the problem. They run with `spamassassin`, but > they do not run from `spamd`. > > Do

Re: rbl checks not running

2009-11-21 Thread Mark Hedges
On Sat, 21 Nov 2009, Charles Gregory wrote: > > Did you look at the logs you posted? > NONE of the DNS tests are being launched on msg 26661 Yes, that is the problem. They run with `spamassassin`, but they do not run from `spamd`. Do other people see this running `spamd --debug`, although

Re: rbl checks not running

2009-11-21 Thread Charles Gregory
Analysis 101: . the rule is correctly loaded, but not run when scanned but run when I put the message through the command line. Did you look at the logs you posted? NONE of the DNS tests are being launched on msg 26661 Also, for that message, there are a suspicious set of entries th

Re: rbl checks not running

2009-11-20 Thread Mark Hedges
On Sat, 21 Nov 2009, Martin Gregorie wrote: > On Fri, 2009-11-20 at 15:20 -0800, Mark Hedges wrote: > > As I've already confirmed by including the debugging log > > attachment in my first message, the test rule is loaded, > > > When run under sendmail and procmail as well? The debug log that I s

  1   2   3   >