Re: RP_MATCHES_RCVD

RH> RP_MATCHES_RCVD removed 1.7 points On 11.05.16 16:29, Reindl Harald wrote: which proves again how badly auto-qa works and why you need to adjust some rules up to remove them eniterily with a zero score Am 11.05.2016 um 16:34 schrieb Matus UHLAR - fantomas: afaik, auto-qa scores _are_ j

Re: RP_MATCHES_RCVD

Am 11.05.2016 um 16:34 schrieb Matus UHLAR - fantomas: Am 11.05.2016 um 16:14 schrieb Niamh Holding: Friday, September 5, 2014, 7:37:18 AM, you wrote: RH> RP_MATCHES_RCVD removed 1.7 points RH> is that not a little too much? Now running at 2.1 :( On 11.05.16 16:29, Reindl Harald wrote: w

Re: RP_MATCHES_RCVD

Am 11.05.2016 um 16:14 schrieb Niamh Holding: Friday, September 5, 2014, 7:37:18 AM, you wrote: RH> RP_MATCHES_RCVD removed 1.7 points RH> is that not a little too much? Now running at 2.1 :( On 11.05.16 16:29, Reindl Harald wrote: which proves again how badly auto-qa works and why you need

Re: RP_MATCHES_RCVD

Am 11.05.2016 um 16:14 schrieb Niamh Holding: Hello Reindl, Friday, September 5, 2014, 7:37:18 AM, you wrote: RH> RP_MATCHES_RCVD removed 1.7 points RH> is that not a little too much? Now running at 2.1 :( which proves again how badly auto-qa works and why you need to adjust some rules u

Re: RP_MATCHES_RCVD

Hello Reindl, Friday, September 5, 2014, 7:37:18 AM, you wrote: RH> RP_MATCHES_RCVD removed 1.7 points RH> is that not a little too much? Now running at 2.1 :( -- Best regards, Niamhmailto:ni...@fullbore.co.uk pgpYFLZS4sAsN.pgp Description: PGP signature

Re: RP_MATCHES_RCVD

On 9/5/2014 2:37 AM, Reindl Harald wrote: > Hi > > i got recently a clear spam message which would have > a score of 6.9 but RP_MATCHES_RCVD removed 1.7 points > > is that not a little too much? > This has been a problem for about 6 months now. I complained about it back in April 2014, and the

Re: RP_MATCHES_RCVD

Am 05.09.2014 um 09:19 schrieb Matus UHLAR - fantomas: >> Am 05.09.2014 um 09:04 schrieb Matus UHLAR - fantomas: >>> and I see more things that are way too much >>> 5.0 BAYES_95 >>> tag-level=4.5 > > On 05.09.14 09:13, Reindl Harald wrote: >> # adjust IADB scoring (way too high defaults) >> score

Re: RP_MATCHES_RCVD

Am 05.09.2014 um 09:04 schrieb Matus UHLAR - fantomas: and I see more things that are way too much 5.0 BAYES_95 tag-level=4.5 On 05.09.14 09:13, Reindl Harald wrote: # adjust IADB scoring (way too high defaults) score RCVD_IN_IADB_VOUCHED -0.5 score RCVD_IN_IADB_DOPTIN -0.8 score RCVD_IN_IADB_

Re: RP_MATCHES_RCVD

Am 05.09.2014 um 09:04 schrieb Matus UHLAR - fantomas: > On 05.09.14 08:37, Reindl Harald wrote: >> i got recently a clear spam message which would have >> a score of 6.9 but RP_MATCHES_RCVD removed 1.7 points >> >> is that not a little too much? > > yes, it is, mentioned multiple times. > >> *

Re: RP_MATCHES_RCVD

On 05.09.14 08:37, Reindl Harald wrote: i got recently a clear spam message which would have a score of 6.9 but RP_MATCHES_RCVD removed 1.7 points is that not a little too much? yes, it is, mentioned multiple times. * X-Spam-Status: Yes, score=5.2, tag-level=4.5, block-level=8 * 5.0 BAYES_9

Re: RP_MATCHES_RCVD

Am 05.09.2014 um 08:40 schrieb Adi: >> i got recently a clear spam message which would have >> a score of 6.9 but RP_MATCHES_RCVD removed 1.7 points >> >> is that not a little too much? > > think so too. I set it into local.cf: > > score RP_MATCHES_RCVD -0.1 thanks for confirmation i give it e

Re: RP_MATCHES_RCVD

Hi > i got recently a clear spam message which would have > a score of 6.9 but RP_MATCHES_RCVD removed 1.7 points > > is that not a little too much? > think so too. I set it into local.cf: score RP_MATCHES_RCVD -0.1 Best Regards

Re: RP_MATCHES_RCVD

Thomas Harold skrev den 2014-04-17 19:01: (Hopefully next month I can help out with the mass-check.) should it not be like meta RP_UNLISTED_HAM (!RP_MATCHES_RCVD) if it should score as spam ? if just scores are changed, then its another problem imho

Re: RP_MATCHES_RCVD

On 4/17/2014 9:14 AM, Kevin A. McGrail wrote: > >> it's not corrected, that's the point... >> > The scoring occurs from automatic corpus checks. The best way to help > the rule score better is to help with masscheck. > It's not really a good indicator of spam/ham here either. A moderate amount

Re: RP_MATCHES_RCVD

On 4/17/2014 10:21 AM, Matus UHLAR - fantomas wrote: it's not corrected, that's the point... On 17.04.14 09:14, Kevin A. McGrail wrote: The scoring occurs from automatic corpus checks. The best way to help the rule score better is to help with masscheck. and still SA people tune some scores

Re: RP_MATCHES_RCVD

it's not corrected, that's the point... On 17.04.14 09:14, Kevin A. McGrail wrote: The scoring occurs from automatic corpus checks. The best way to help the rule score better is to help with masscheck. and still SA people tune some scores manually. Looking at http://ruleqa.spamassassin.org/

Re: RP_MATCHES_RCVD

it's not corrected, that's the point... The scoring occurs from automatic corpus checks. The best way to help the rule score better is to help with masscheck. Looking at http://ruleqa.spamassassin.org/?daterev=20140416-r1587834-n&rule=RP_MATCHES_RCVD&srcpath=&g=Change there does appear to

Re: RP_MATCHES_RCVD

Thomas Harold skrev den 2014-04-15 05:49: Mar 24th - RP_MATCHES_RCVD = -0.535 Mar 27th - RP_MATCHES_RCVD = -0.371 Apr 7th - RP_MATCHES_RCVD = -0.271 Apr 14th - RP_MATCHES_RCVD = -0.989 Running 3.3.1 on CentOS 6 (from the @updates channel). Running "sa-update" daily. On 15.04.14 07:18, Benny P

Re: RP_MATCHES_RCVD

Thomas Harold skrev den 2014-04-15 05:49: (during first few weeks of March it was showing as T_RP_MATCHES_RCVD, -0.01) note rules that begins with T_ is corpus testing rules, also why it score just 0.01 here Mar 24th - RP_MATCHES_RCVD = -0.535 Mar 27th - RP_MATCHES_RCVD = -0.371 Apr 7th -

Re: RP_MATCHES_RCVD

On 11/8/2013 4:38 PM, John Hardin wrote: > On Fri, 8 Nov 2013, Kris Deugau wrote: > >> LuKreme wrote: >>> Some spam has been matching the rule RP_MATCHES_RCVD which is worth >>> -2.8 points. I wanted to look at this rule, so I went to >>> /usr/local/etc/mail/spamassassin and gripped for the name,

Re: RP_MATCHES_RCVD

On 08 Nov 2013, at 13:53 , Kris Deugau wrote: > It's also been scored down in more recent rule updates; as of a few > minutes ago it looks like it's *way* down: > > score RP_MATCHES_RCVD -1.501 -0.001 -1.501 -0.001 I saw that after I ran sa-update, which was shortly afte

Re: RP_MATCHES_RCVD

On 08 Nov 2013, at 13:53 , Kris Deugau wrote: > SA is installed from package, this looks something like > /var/lib/spamassassin. Ah, /var/db/spamassassin I would never have found them. thanks! -- Everything you read on the Internet is false -- Glenn Fleishman

Re: RP_MATCHES_RCVD

On Fri, 8 Nov 2013, Kris Deugau wrote: LuKreme wrote: Some spam has been matching the rule RP_MATCHES_RCVD which is worth -2.8 points. I wanted to look at this rule, so I went to /usr/local/etc/mail/spamassassin and gripped for the name, but no hits. There was a thread on this rule not too l

Re: RP_MATCHES_RCVD

LuKreme wrote: > Some spam has been matching the rule RP_MATCHES_RCVD which is worth -2.8 > points. I wanted to look at this rule, so I went to > /usr/local/etc/mail/spamassassin and gripped for the name, but no hits. There was a thread on this rule not too long ago; check the list archives and

Re: RP_MATCHES_RCVD

On Mon, 21 Oct 2013, Mauricio Tavares wrote: b Trying to figure out why RP_MATCHES_RCVD scored so low. Is it because Return-Path: and the last Received matches that domain? if so, anything I can do to score t as the proper spam it is? On 21.10.13 10:24, John Hardin wrote: RP_MATCHES_RCVD i

Re: RP_MATCHES_RCVD

On Mon, 21 Oct 2013, Mauricio Tavares wrote: b Trying to figure out why RP_MATCHES_RCVD scored so low. Is it because Return-Path: and the last Received matches that domain? if so, anything I can do to score t as the proper spam it is? RP_MATCHES_RCVD is a check that the message metadata i

Re: SA not "honoring" customs in "local.cf" - was Re: RP_MATCHES_RCVD letting in SPAM

Joe Acquisto-j4 wrote: > I'd like to revisit this, now that I have sufficient energy to devote to > some hard sleuthing. Despite the > fact that I was less than sharp (ahem) when first looking at this, I do > feel I have covered all the obvious > suspects. > > Some gentle nudges (or not) might g

Re: SA not "honoring" customs in "local.cf" - was Re: RP_MATCHES_RCVD letting in SPAM

if you need help, the best way is to: - stay *concise* at all times - verbose blah can drive ppl away - post config and then explain issue, *concisely* - don't revive old threads. - help ppl help you - their time is precious and few have unlimited patience. - keep it down to facts - if you have

SA not "honoring" customs in "local.cf" - was Re: RP_MATCHES_RCVD letting in SPAM

I'd like to revisit this, now that I have sufficient energy to devote to some hard sleuthing. Despite the fact that I was less than sharp (ahem) when first looking at this, I do feel I have covered all the obvious suspects. Some gentle nudges (or not) might get me rolling again. I suppose I

Re: RP_MATCHES_RCVD letting in SPAM

On 21 Aug 2013, at 16:33 , Joe Acquisto-j4 wrote: > OK. That's what I thought. However, lint shows it "reading" > /etc/mail/spamassassing/local.cf > near the top of lint output and all the others, "further down", > which suggests it is reading them after. > > Perhaps that is a poor conclusio

Re: RP_MATCHES_RCVD letting in SPAM

. . . >> I find a lot of references, for example, to BAYES_99 in >> /usr/share/spamassassin/blah.cf. I certainly don't know if these would >> override the setting in /etc/mail/spamassassin/local.cf. > > Local settings should override standard settings, so no. OK. That's what I thought. How

Re: RP_MATCHES_RCVD letting in SPAM

On Wed, 21 Aug 2013, Joe Acquisto-j4 wrote: Bear in mind, that will tell you whether those configuration files are syntactically correct; that does not tell you anything about whether or not those are the files the spamd daemon is using. Take a look at the script that starts spamd. It may ha

Re: RP_MATCHES_RCVD letting in SPAM

> > Bear in mind, that will tell you whether those configuration files are > syntactically correct; that does not tell you anything about whether or > not those are the files the spamd daemon is using. > > Take a look at the script that starts spamd. It may have a hardcoded path > to the conf

Re: RP_MATCHES_RCVD letting in SPAM

On Tue, 20 Aug 2013, Joe Acquisto-j4 wrote: On 8/20/2013 at 5:00 AM, Matus UHLAR - fantomas wrote: what happens then you pipe a mail into "spamassassin -D"? Never tried it. What "spamassassin --lint" produce? Quite a lot. You want me to post the entire output? Bear in mind, that wil

Re: RP_MATCHES_RCVD letting in SPAM

>>> What "spamassassin --lint" produce? >> >>Quite a lot. You want me to post the entire output? > > here it produces nothing. Maybe there's really syntax error in your > configuration files? > -- Oh, sorry, it produces nothing here as well. I was thinking (not!) of spamassassin -D --lint

Re: RP_MATCHES_RCVD letting in SPAM

On 8/20/2013 at 5:00 AM, Matus UHLAR - fantomas wrote: On 19.08.13 18:23, Joe Acquisto-j4 wrote: So, I have this in my /etc/mail/spamassassin/local.cf: is that the same as /etc/spamassassin/local.cf? On 20.08.13 08:05, Joe Acquisto-j4 wrote: Don't have one of those. /etc/mail/spamassassin

Re: RP_MATCHES_RCVD letting in SPAM

>>> On 8/20/2013 at 5:00 AM, Matus UHLAR - fantomas wrote: > On 19.08.13 18:23, Joe Acquisto-j4 wrote: >>So, I have this in my /etc/mail/spamassassin/local.cf: > > is that the same as /etc/spamassassin/local.cf? Don't have one of those. /etc/mail/spamassassin is where bayes_db, sa-update-keys

Re: RP_MATCHES_RCVD letting in SPAM

On 19.08.13 18:23, Joe Acquisto-j4 wrote: So, I have this in my /etc/mail/spamassassin/local.cf: is that the same as /etc/spamassassin/local.cf? score RP_MATCHES_RCVD 0 Yet, even after restart of spamd, mail comes thru with a -2.8. What should I look at? I know other stuff is read as I cha

Re: RP_MATCHES_RCVD letting in SPAM

>>> On 8/19/2013 at 6:54 PM, John Hardin wrote: > On Mon, 19 Aug 2013, Joe Acquisto-j4 wrote: > >> So, I have this in my /etc/mail/spamassassin/local.cf: >> >> score RP_MATCHES_RCVD 0 >> >> Yet, even after restart of spamd, mail comes thru with a -2.8. > > I assume you mean by that, RP_MATCHES_R

Re: RP_MATCHES_RCVD letting in SPAM

On Mon, 19 Aug 2013, Joe Acquisto-j4 wrote: So, I have this in my /etc/mail/spamassassin/local.cf: score RP_MATCHES_RCVD 0 Yet, even after restart of spamd, mail comes thru with a -2.8. I assume you mean by that, RP_MATCHES_RCVD is still hitting and scoring points? What should I look at?

Re: RP_MATCHES_RCVD letting in SPAM

So, I have this in my /etc/mail/spamassassin/local.cf: score RP_MATCHES_RCVD 0 Yet, even after restart of spamd, mail comes thru with a -2.8. What should I look at? I know other stuff is read as I changed trusted and local network IP's and had a typo in one. lint called me out on it. joe a

Re: RP_MATCHES_RCVD letting in SPAM

--On Thursday, August 15, 2013 10:07 PM +0200 Benny Pedersen wrote: Quanah Gibson-Mount skrev den 2013-08-15 21:25: Hm, that won't catch our other BR spam though. :( List-Unsubscribe:

Re: RP_MATCHES_RCVD letting in SPAM

Matus UHLAR - fantomas skrev den 2013-08-15 22:33: score RP_MATCHES_RCVD 0 hard scoreing there is __RP_MATCHES_RCVD that has to be used in metas. I don't see any poing in giving positive score to mail just because it's not any kind of forged... On 15.08.13 22:41, Benny Pedersen wrote: __

Re: RP_MATCHES_RCVD letting in SPAM

Matus UHLAR - fantomas skrev den 2013-08-15 22:33: score RP_MATCHES_RCVD 0 hard scoreing there is __RP_MATCHES_RCVD that has to be used in metas. I don't see any poing in giving positive score to mail just because it's not any kind of forged... __foo have no scores, no point in setting i

Re: RP_MATCHES_RCVD letting in SPAM

On 15.08.13 12:05, Quanah Gibson-Mount wrote: Some of our users are getting a ton of SPAM from .br domains. If it weren't for RP_MATCHES_RCVD they would actually end up in their junk folder rather than their Inbox. Is there a general suggested adjustment I can make catch these without tweakin

Re: RP_MATCHES_RCVD letting in SPAM

Quanah Gibson-Mount skrev den 2013-08-15 21:25: Hm, that won't catch our other BR spam though. :( List-Unsubscribe: unsubscribe ? if recipient was not opt-in then block sender dom

Re: RP_MATCHES_RCVD letting in SPAM

John Hardin skrev den 2013-08-15 21:41: the score noticeably. It's intended to be used in metas with other rules that make a mention of a large amount of money suspicious. also why i used soft blacklists, i have not seen the real problem yet, but imho anyone can soft score adjust if needed, o

Re: RP_MATCHES_RCVD letting in SPAM

On Thu, 15 Aug 2013, Benny Pedersen wrote: meta LOTS_OF_MONEY (3) (3) (3) (3) I *do not recommend* doing that. There is a lot of legitimate email that mentions large monetary amounts (e.g. a newsletter discussing the US budget deficit). That rule's score is informational on purpose, so that

Re: RP_MATCHES_RCVD letting in SPAM

--On Thursday, August 15, 2013 12:21 PM -0700 Quanah Gibson-Mount wrote: --On Thursday, August 15, 2013 9:16 PM +0200 Benny Pedersen <> wrote: Quanah Gibson-Mount skrev den 2013-08-15 21:05: Some of our users are getting a ton of SPAM from .br domains. If it weren't for RP_MATCHES_RCVD the

Re: RP_MATCHES_RCVD letting in SPAM

--On Thursday, August 15, 2013 9:16 PM +0200 Benny Pedersen <> wrote: Quanah Gibson-Mount skrev den 2013-08-15 21:05: Some of our users are getting a ton of SPAM from .br domains. If it weren't for RP_MATCHES_RCVD they would actually end up in their junk folder rather than their Inbox. Is the

Re: RP_MATCHES_RCVD letting in SPAM

Quanah Gibson-Mount skrev den 2013-08-15 21:05: Some of our users are getting a ton of SPAM from .br domains. If it weren't for RP_MATCHES_RCVD they would actually end up in their junk folder rather than their Inbox. Is there a general suggested adjustment I can make catch these without tweakin

Re: RP_MATCHES_RCVD

On 07/28, John Hardin wrote: > On Thu, 28 Jul 2011, Daniel McDonald wrote: > >I see a lot of messages hitting RP_MATCHES_RCVD that also hits one of the > >Invaluement rbls. Invaluement primarily targets snowshoe spammers. > http://ruleqa.spamassassin.org/20110727-r1151385-n/RP_MATCHES_RCVD/detail

Re: RP_MATCHES_RCVD

On 7/28/11 11:47 AM, "John Hardin" wrote: > On Thu, 28 Jul 2011, Daniel McDonald wrote: > >> I see a lot of messages hitting RP_MATCHES_RCVD that also hits one of the >> Invaluement rbls. Invaluement primarily targets snowshoe spammers. >> >> $ grep RP_MATCHES_RCVD /var/log/mail/info.log | gr

Re: RP_MATCHES_RCVD

On Thu, 28 Jul 2011, Daniel McDonald wrote: I see a lot of messages hitting RP_MATCHES_RCVD that also hits one of the Invaluement rbls. Invaluement primarily targets snowshoe spammers. $ grep RP_MATCHES_RCVD /var/log/mail/info.log | grep -vc INVL 41618 $ grep RP_MATCHES_RCVD /var/log/mail/info

Re: RP_MATCHES_RCVD

On Thu, 28 Jul 2011 15:28:37 +0100, RW wrote: There seems to be a consensus that SPF and DKIM passes aren't worth significant scores. So how is it that RP_MATCHES_RCVD, scores -1.2 when it just a circumstantial version of what SPF does explicitly. For me it's hitting more spam that ham, and wh

Re: RP_MATCHES_RCVD

On 7/28/11 9:48 AM, "Mike Grau" wrote: > On 07/28/2011 09:28 AM the voices made RW write: >> There seems to be a consensus that SPF and DKIM passes aren't worth >> significant scores. So how is it that RP_MATCHES_RCVD, scores -1.2 when >> it just a circumstantial version of what SPF does expli

Re: RP_MATCHES_RCVD

On 07/28/2011 09:28 AM the voices made RW write: There seems to be a consensus that SPF and DKIM passes aren't worth significant scores. So how is it that RP_MATCHES_RCVD, scores -1.2 when it just a circumstantial version of what SPF does explicitly. For me it's hitting more spam that ham, and w

Re: RP_MATCHES_RCVD

On 28/07/11 15:28, RW wrote: There seems to be a consensus that SPF and DKIM passes aren't worth significant scores. So how is it that RP_MATCHES_RCVD, scores -1.2 when it just a circumstantial version of what SPF does explicitly. For me it's hitting more spam that ham, and what's worse, it's mo