Re: Spoofed Email

2009-06-20 Thread Michelle Konzack
Invalid Message-ID: > Message-ID: I use courierfilter to drop such "Message-ID:" and the message will never see my system. Thanks, Greetings and nice Day/Evening Michelle Konzack Systemadministrator 24V Electronic Engineer Tamay Dogan Network Debian GNU/Linux Consultant --

Re: Spoofed Email

2009-06-20 Thread Michelle Konzack
Am 2009-06-18 11:26:29, schrieb Jeff Drury: > SA is working for the most part beyond expectations, the only problem I¹m > having is filtering spoofed email address (i.e. valid_u...@ourdomain.com). I > am able to filter out non-valid user addresses (i.e. spam...@ourdomain.com). WHY DOES YOU

Re: Spoofed Email

2009-06-19 Thread Brandon Champion
Configuring postfix well is extremely effective. For all the time I've invested trying to minimize the spam that reaches my company's users, that single web page has helped greater than anything else I've done. Postfix should be your first line of defense. SpamAssassin is usually your second and

Re: Spoofed Email

2009-06-19 Thread David B Funk
On Fri, 19 Jun 2009, Benny Pedersen wrote: > On Fri, June 19, 2009 04:09, David B Funk wrote: > > The last 3 you can install using CPAN, Razor2 has to be explcitly fetched > > installed and configured (but is worth it). > > newer use CPAN direct on a host that uses RPM/DEB/PORTAGE/BSD > > make a n

Re: Spoofed Email

2009-06-19 Thread Benny Pedersen
On Fri, June 19, 2009 18:18, Jeff Drury wrote: > I guess many would find this acceptable, but to me no spam is my target no it wont stop users sending html and images to maillists, but it would be nice if it did :) -- xpoint

Re: Spoofed Email

2009-06-19 Thread Jeff Drury
Has this caught spoofed mail? On an average day I successfully filter approx 10k junk mail messages, only about 5-10 make it through for the entire organization, of these our individual mail programs filter these as junk... I guess many would find this acceptable, but to me no spam is my target O

Re: Spoofed Email

2009-06-19 Thread Brandon Champion
I highly recommend using Postfix to prevent some of this from even getting through to SpamAssassin to begin with. This was the most helpful page for me. I've modified things to suit my own needs, of course. The results have been stellar. SpamAssassin barely does any work now. http://jimsun.linxn

Re: Spoofed Email

2009-06-19 Thread Benny Pedersen
On Fri, June 19, 2009 04:09, David B Funk wrote: > The last 3 you can install using CPAN, Razor2 has to be explcitly fetched > installed and configured (but is worth it). newer use CPAN direct on a host that uses RPM/DEB/PORTAGE/BSD make a native RPM/DEP/PORTAGE/BSD from CPAN is the way to go, if

Re: Spoofed Email

2009-06-18 Thread David B Funk
On Thu, 18 Jun 2009, Jeff Drury wrote: http://pastebin.ca/1465504 On 6/18/09 2:00 PM, "Benny Pedersen" wrote: On Thu, June 18, 2009 22:33, Jeff Drury wrote: They don¹t appear to be scored at all (see attached header) test: spamassassin 2>&1 -D --lint any errors here ? spamassassin 2>

Re: Spoofed Email

2009-06-18 Thread Benny Pedersen
On Fri, June 19, 2009 01:22, Jeff Drury wrote: > http://pastebin.ca/1465504 # [49973] dbg: spf: cannot get Envelope-From, cannot use SPF # [49973] dbg: spf: def_spf_whitelist_from: could not find useable envelope sender # [49973] dbg: spf: already checked for Received-SPF headers, proceeding with

Re: Spoofed Email

2009-06-18 Thread Jeff Drury
http://pastebin.ca/1465504 On 6/18/09 2:00 PM, "Benny Pedersen" wrote: > > On Thu, June 18, 2009 22:33, Jeff Drury wrote: >> > They don¹t appear to be scored at all (see attached header) > > test: > > spamassassin 2>&1 -D --lint > > any errors here ? > > spamassassin 2>&1 -D -t msgtotest |

Re: Spoofed Email

2009-06-18 Thread Benny Pedersen
On Thu, June 18, 2009 23:33, Jeff Drury wrote: > No errors... The only error I ever received had to do with rewriting the > subject which was unimportant to me so I commented it out, other then that > no errors stop sending me mail in private for things you ask public about still like to see the

Re: Spoofed Email

2009-06-18 Thread hamann . w
>> >> SA is working for the most part beyond expectations, the only problem I=B9m >> having is filtering spoofed email address (i.e. valid_u...@ourdomain.com). = >> I >> am able to filter out non-valid user addresses (i.e. spam...@ourdomain.com)= >> . >> I run SA-Update daily, have piped well over

Re: Spoofed Email

2009-06-18 Thread Jeff Drury
No errors... The only error I ever received had to do with rewriting the subject which was unimportant to me so I commented it out, other then that no errors On 6/18/09 2:00 PM, "Benny Pedersen" wrote: > > On Thu, June 18, 2009 22:33, Jeff Drury wrote: >> > They don¹t appear to be scored at al

Re: Spoofed Email

2009-06-18 Thread Benny Pedersen
On Thu, June 18, 2009 22:33, Jeff Drury wrote: > They don¹t appear to be scored at all (see attached header) test: spamassassin 2>&1 -D --lint any errors here ? spamassassin 2>&1 -D -t msgtotest | less press s in the less output and post on pastebin i belive you miss envelope_sender_header i

Re: Spoofed Email

2009-06-18 Thread Jeff Drury
They don¹t appear to be scored at all (see attached header) Return-Path: Received: from murder ([unix socket]) by impactps.com (Cyrus v2.3.8-OS X Server 10.5:9C31) with LMTPA; Thu, 18 Jun 2009 12:28:22 -0700 X-Sieve: CMU Sieve 2.3 Received: from localhost (localhost [127.0.0.1])

Re: Spoofed Email

2009-06-18 Thread Rick Macdougall
Benny Pedersen wrote: On Tors, Juni 18, 2009 20:36, Rick Macdougall wrote: I'd recommend upgrading to the latest version (3.2.5) and running and sa-update to get the latest rules. how will this help on spoofed mail problem ? The improved rules should help catch them. Rick

Re: Spoofed Email

2009-06-18 Thread John Hardin
On Thu, 18 Jun 2009, Jeff Drury wrote: SA is working for the most part beyond expectations, the only problem I?m having is filtering spoofed email address (i.e. valid_u...@ourdomain.com). I am able to filter out non-valid user addresses (i.e. spam...@ourdomain.com). I run SA-Update daily, have

Re: Spoofed Email

2009-06-18 Thread Benny Pedersen
On Tors, Juni 18, 2009 20:36, Rick Macdougall wrote: > I'd recommend upgrading to the latest version (3.2.5) and running and > sa-update to get the latest rules. how will this help on spoofed mail problem ? -- xpoint

Re: Spoofed Email

2009-06-18 Thread Rick Macdougall
Jeff Drury wrote: SA is working for the most part beyond expectations, the only problem I’m having is filtering spoofed email address (i.e. valid_u...@ourdomain.com). I am able to filter out non-valid user addresses (i.e. spam...@ourdomain.com). I run SA-Update daily, have piped well over 500

Re: Spoofed Email

2009-06-18 Thread Benny Pedersen
On Tors, Juni 18, 2009 20:26, Jeff Drury wrote: > sa-learn, yet they still come through. I know this is a generic outline of > the problem, but it¹s a start, if you need more info I can send it. http://old.openspf.org/wizard.html?mydomain=impactps.com&submit=Go! next do a spf test in mta level,

Re: Spoofed Email But Different User Name

2008-05-07 Thread mouss
Chris St. Pierre wrote: On Tue, 6 May 2008, mhildebr wrote: Is there a way to have Spamassassin look for spoofed email addresses being used as the sender's address ([EMAIL PROTECTED]) but using a different user name (Viagra instead of myname)? It seems like it would be simple to check the u

Re: Spoofed Email But Different User Name

2008-05-07 Thread Chris St. Pierre
On Tue, 6 May 2008, mhildebr wrote: Is there a way to have Spamassassin look for spoofed email addresses being used as the sender's address ([EMAIL PROTECTED]) but using a different user name (Viagra instead of myname)? It seems like it would be simple to check the user name and filter results

Re: Spoofed Email But Different User Name

2008-05-07 Thread mouss
mhildebr wrote: Is there a way to have Spamassassin look for spoofed email addresses being used as the sender's address ([EMAIL PROTECTED]) but using a different user name (Viagra instead of myname)? It seems like it would be simple to check the user name and filter results from that. Thanks fo

Re: Spoofed Email But Different User Name

2008-05-06 Thread Matt Kettler
mhildebr wrote: Is there a way to have Spamassassin look for spoofed email addresses being used as the sender's address ([EMAIL PROTECTED]) but using a different user name (Viagra instead of myname)? It seems like it would be simple to check the user name and filter results from that. Thanks fo