Re: What rules should be stopping these

2010-09-27 Thread Karsten Bräckelmann
On Mon, 2010-09-27 at 07:21 -0700, njjrdell wrote: > I made the adjustments you recommended and these spams are now getting > caught. I was always apprehensive about using public generated corpuses or > lists due to possible poisoning. Use sa-upate, and maybe lurk here for news. If there's any DN

Re: What rules should be stopping these

2010-09-27 Thread njjrdell
I made the adjustments you recommended and these spams are now getting caught. I was always apprehensive about using public generated corpuses or lists due to possible poisoning. I will give this a shot and see how it turns out. all your help is truly appreciated Regards Matus UHLAR - fantoma

Re: What rules should be stopping these

2010-09-26 Thread Matus UHLAR - fantomas
On 24.09.10 13:03, njjrdell wrote: > we have setup on our mailservers. > sbl-xbl.spamhaus.org this is obsolete, you should use zen.spamhaus.org instead > dnsbl.njable.org should be dnsbl.njabl.org, is this a mistype in your mail or in your server configuration? > bl.spamcop.net > b.barracudacen

Re: What rules should be stopping these

2010-09-24 Thread Karsten Bräckelmann
On Fri, 2010-09-24 at 17:14 -0500, Chuck Campbell wrote: > Where is the user's user_prefs file supposed to live? What does your question have to do with this Subject? You just hi-jacked a thread. Well, granted, you actually just hi-jacked the Subject, abandoning your own thread -- the threading y

Re: What rules should be stopping these

2010-09-24 Thread Chuck Campbell
Where is the user's user_prefs file supposed to live? Mine is in ~/.spamassassin/user_prefs, but it is ignored (presently full of whitelist_rcvd entries that never fire). This is where it has been since spamassassin 2.6.xxx If I put all of those into /etc/mail/spamassassin/local.cf they actually

Re: What rules should be stopping these

2010-09-24 Thread Karsten Bräckelmann
On Fri, 2010-09-24 at 22:43 +0200, Karsten Bräckelmann wrote: > > > > Hello sorry for the newbie question, one of our users is getting > > > > slammed > > > > by these. I'm wondering which rules should be stopping these. > > Your sample is missing the rules actually triggered, which usually woul

Re: What rules should be stopping these

2010-09-24 Thread Karsten Bräckelmann
On Fri, 2010-09-24 at 13:03 -0700, njjrdell wrote: > we have setup on our mailservers. > sbl-xbl.spamhaus.org > dnsbl.njable.org > bl.spamcop.net > b.barracudacentral.org Hmm, that seems to hint checking at SMTP time and outright rejecting based on the sender's IP. While that certainly is a good

Re: What rules should be stopping these

2010-09-24 Thread Benny Pedersen
On fre 24 sep 2010 21:28:53 CEST, njjrdell wrote http://pastebin.com/zAvghCQJ Content analysis details: (15.0 points, 5.0 required) pts rule name description -- -- 2.5 RCVD_IN_PSBL RBL: Receive

Re: What rules should be stopping these

2010-09-24 Thread njjrdell
I actually take that back in our local.cf we have urirhssub URIBL_BLACK multi.uribl.com.A 2 bodyURIBL_BLACK eval:check_uridnsbl('URIBL_BLACK') describeURIBL_BLACK Contains an URL listed in the URIBL blacklist tflags URIBL_BLACK net score

Re: What rules should be stopping these

2010-09-24 Thread njjrdell
we have setup on our mailservers. sbl-xbl.spamhaus.org dnsbl.njable.org bl.spamcop.net b.barracudacentral.org We are not doing any other network tests. I will look into it. can you please recommend specifics Regards John Hardin wrote: > > On Fri, 24 Sep 2010, njjrdell wrote: > >> http://pa

Re: What rules should be stopping these

2010-09-24 Thread John Hardin
On Fri, 24 Sep 2010, njjrdell wrote: http://pastebin.com/zAvghCQJ Hello sorry for the newbie question, one of our users is getting slammed by these. I'm wondering which rules should be stopping these. That hits URIBL. Do you have network tests and URIBL lookups enabled? -- John Hardin KA7O