Re: Catch subtly-different Reply-To domain

2021-02-23 Thread Dominic Raferd
My idea is to compare the domain part of the 'From' and 'Reply-To' addresses, scoring for a close but not exact match (maybe Damerau–Levenshtein between 1 and 3). The same logic could also be used to compare the domain part of the 'From' to a list of domains that are pron

Re: Catch subtly-different Reply-To domain

2021-02-22 Thread Dominic Raferd
ather than 2. That sounds better, but I don't know how to employ it to make a rule for SA. My idea is to compare the domain part of the 'From' and 'Reply-To' addresses, scoring for a close but not exact match (maybe Damerau–Levenshtein between 1 and 3). The same logic cou

Re: Catch subtly-different Reply-To domain

2021-02-22 Thread John Hardin
On Mon, 22 Feb 2021, RW wrote: On Sun, 21 Feb 2021 16:32:01 -0800 (PST) John Hardin wrote: On Sun, 21 Feb 2021, John Hardin wrote: On Sun, 21 Feb 2021, Dominic Raferd wrote: Michael's suggestion is interesting. There is a github project allowing Levenshtein numbers to be calculated and us

Re: Catch subtly-different Reply-To domain

2021-02-22 Thread RW
On Sun, 21 Feb 2021 16:32:01 -0800 (PST) John Hardin wrote: > On Sun, 21 Feb 2021, John Hardin wrote: > > > On Sun, 21 Feb 2021, Dominic Raferd wrote: > >> Michael's suggestion is interesting. There is a github project > >> allowing Levenshtein numbers to be calculated and used in SA, I > >> wil

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread John Hardin
On Sun, 21 Feb 2021, John Hardin wrote: On Sun, 21 Feb 2021, Dominic Raferd wrote: On 21/02/2021 20:09, Benny Pedersen wrote: On 2021-02-21 19:44, Dominic Raferd wrote: Presumably interfacefm.com has been hacked, but not to the extent that they can intercept incoming replies. I stand corr

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread John Hardin
On Sun, 21 Feb 2021, Dominic Raferd wrote: On 21/02/2021 20:09, Benny Pedersen wrote: On 2021-02-21 19:44, Dominic Raferd wrote: Presumably interfacefm.com has been hacked, but not to the extent that they can intercept incoming replies. I stand corrected; but as they specify p=none, the mai

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread Benny Pedersen
On 2021-02-21 23:00, Dominic Raferd wrote: p=none is an instruction from the domain controller *not* to reject emails from their domain even when they fail DMARC testing. So the end result is that this mail should pass through DMARC testing. remember dmarc can pass on spf pass only, even if dk

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread Dominic Raferd
On 21/02/2021 20:09, Benny Pedersen wrote: On 2021-02-21 19:44, Dominic Raferd wrote: Presumably interfacefm.com has been hacked, but not to the extent that they can intercept incoming replies. I stand corrected; but as they specify p=none, the mail must still pass. in what way should it pa

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread Benny Pedersen
On 2021-02-21 19:44, Dominic Raferd wrote: Presumably interfacefm.com has been hacked, but not to the extent that they can intercept incoming replies. I stand corrected; but as they specify p=none, the mail must still pass. in what way should it pass ? dmarc tests spf, dkim, and opendmarc

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread Dominic Raferd
On 21/02/2021 17:37, RW wrote: On Sun, 21 Feb 2021 17:00:32 + Dominic Raferd wrote: On 21/02/2021 16:20, Benny Pedersen wrote: On 2021-02-21 17:00, RW wrote: On Sun, 21 Feb 2021 14:04:20 + Dominic Raferd wrote: On 21/02/2021 13:56, RW wrote: From: "Karen Howard"

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread RW
RW wrote: > >> > >>> >>> From: "Karen Howard" > >>> >>> Reply-To: "Karen Howard" > >> > >>> Yes this mail passed DMARC > >> > >> How did it pass DMARC when it has the domain

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread Dominic Raferd
On 21/02/2021 16:20, Benny Pedersen wrote: On 2021-02-21 17:00, RW wrote: On Sun, 21 Feb 2021 14:04:20 + Dominic Raferd wrote: On 21/02/2021 13:56, RW wrote: >>> From: "Karen Howard" >>> Reply-To: "Karen Howard" Yes this mail passed DMARC

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread Benny Pedersen
On 2021-02-21 17:00, RW wrote: On Sun, 21 Feb 2021 14:04:20 + Dominic Raferd wrote: On 21/02/2021 13:56, RW wrote: >>> From: "Karen Howard" >>> Reply-To: "Karen Howard" Yes this mail passed DMARC How did it pass DMARC when it has the d

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread RW
On Sun, 21 Feb 2021 14:04:20 + Dominic Raferd wrote: > On 21/02/2021 13:56, RW wrote: > >>> From: "Karen Howard" > >>> Reply-To: "Karen Howard" > Yes this mail passed DMARC How did it pass DMARC when it has the domain being spoofed in the from header?

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread Dominic Raferd
On 21/02/2021 13:56, RW wrote: On Sun, 21 Feb 2021 11:28:51 +0100 Michael Storz wrote: Am 2021-02-20 08:58, schrieb Dominic Raferd: Is there a rule to catch cases where the domain of the Reply-To header is a subtle variant on that in the To header. Take this (real) example from a phishing

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread RW
On Sun, 21 Feb 2021 11:28:51 +0100 Michael Storz wrote: > Am 2021-02-20 08:58, schrieb Dominic Raferd: > > Is there a rule to catch cases where the domain of the Reply-To > > header is a subtle variant on that in the To header. Take this > > (real) example from a phishing

Re: Catch subtly-different Reply-To domain

2021-02-21 Thread Michael Storz
Am 2021-02-20 08:58, schrieb Dominic Raferd: Is there a rule to catch cases where the domain of the Reply-To header is a subtle variant on that in the To header. Take this (real) example from a phishing email sent yesterday: From: "Karen Howard" Reply-To: "Karen Howard"

Catch subtly-different Reply-To domain

2021-02-19 Thread Dominic Raferd
Is there a rule to catch cases where the domain of the Reply-To header is a subtle variant on that in the To header. Take this (real) example from a phishing email sent yesterday: From: "Karen Howard" Reply-To: "Karen Howard" I realise that other elements of the addr

Re: v3.4.3 RBL lookups on the domain in Reply-to

2019-12-12 Thread Kevin A. McGrail
lookups on the domain in Reply-to address. > > > > How do we take advantage of this new capability? > > "perldoc Mail::SpamAssassin::Plugin::DNSEval" (on a system with 3.4.3 > installed) provides the details. > > In short: there is a new config parameter rbl_hea

Re: v3.4.3 RBL lookups on the domain in Reply-to

2019-12-12 Thread Bill Cole
On 12 Dec 2019, at 12:44, John Schmerold wrote: On the Postfix listserv, KAM informed the Postfix community that 3.4.3 has the ability to do RBL lookups on the domain in Reply-to address. How do we take advantage of this new capability? "perldoc Mail::SpamAssassin::Plugin::DNSEval&q

Re: v3.4.3 RBL lookups on the domain in Reply-to

2019-12-12 Thread Riccardo Alfieri
On 12/12/19 18:44, John Schmerold wrote: On the Postfix listserv, KAM informed the Postfix community that 3.4.3 has the ability to do RBL lookups on the domain in Reply-to address. How do we take advantage of this new capability? If I interpret the documentation correctly (still didn'

v3.4.3 RBL lookups on the domain in Reply-to

2019-12-12 Thread John Schmerold
On the Postfix listserv, KAM informed the Postfix community that 3.4.3 has the ability to do RBL lookups on the domain in Reply-to address. How do we take advantage of this new capability? -- John Schmerold Katy Computer Systems, Inc https://katycomputer.com St Louis

Re: List From and Reply-To

2018-06-01 Thread Luis E. Muñoz
On 1 Jun 2018, at 5:12, @lbutlr wrote: On 30 May 2018, at 15:34, Luis E. Muñoz wrote: To further the point, one of the mailboxes I manage on this box has 95K+ messages. Apple Mail would choke to dead on this one. Not at all. I have folders in mail.app with more than twice that number of mes

Re: List From and Reply-To

2018-06-01 Thread Rupert Gallagher
In the example at hand, the article you linked to does not grant to Apache the right to oppose to your right to oblivion. Sent from ProtonMail Mobile On Fri, Jun 1, 2018 at 14:45, Anthony Cartmell wrote: >> Ok we both subscribed to the list, but > the GDPR gives us the right to be >> forgotte

Re: List From and Reply-To

2018-06-01 Thread Anthony Cartmell
> Ok we both subscribed to the list, but > the GDPR gives us the right to be forgotten, for example. Now suppose > you unsubscribe. You find out that your e-mails are archived on various > sites other than SA. You send an e-mail to SA's or Apache's postmaster > exerting your rights and demanding yo

Re: List From and Reply-To

2018-06-01 Thread Rupert Gallagher
I lost track of your reasoning. Let us start again. From the standpont of the GDPR, there is you, me, and someone in between who is responsible for our personal data. Infact, if you send to users@spamassassin.apache.org, I receive a copy of it *because* apache.org used our addresses. Ok we both

Re: List From and Reply-To

2018-06-01 Thread @lbutlr
On 30 May 2018, at 15:34, Luis E. Muñoz wrote: > To further the point, one of the mailboxes I manage on this box has 95K+ > messages. Apple Mail would choke to dead on this one. Not at all. I have folders in mail.app with more than twice that number of messages. -- "Two years from now, spam w

Re: List From and Reply-To

2018-06-01 Thread Matus UHLAR - fantomas
On Thu, May 31, 2018 at 17:39, Antony Stone wrote: PS: I notice you choose to take the opposite approach with your own Reply-To header, deliberately making it more difficult for people to reply to the list :) On 31.05.18 17:00, Rupert Gallagher wrote: I just use the official ios client

Re: List From and Reply-To

2018-05-31 Thread @lbutlr
On 30 May 2018, at 08:25, Bill Cole wrote: > I can't speak to it as a MUA for mailing lists. It is, as it always has been and by design, a very bad mail client for mailing lists. (I use Apple Mail. But I use procmail to fix some of its stupidity, which is why this message goes to the list by

Re: List From and Reply-To

2018-05-31 Thread Rupert Gallagher
On Thu, May 31, 2018 at 17:39, Antony Stone wrote: >PS: I notice you choose to take the opposite approach with your own Reply-To >header, deliberately making it more difficult for people to reply to the list >:) I just use the official ios client, where such regulations are not

Re: List From and Reply-To

2018-05-31 Thread John Hardin
On Thu, 31 May 2018, Antony Stone wrote: On Thursday 31 May 2018 at 17:35:11, Rupert Gallagher wrote: Beware of the GDPR. If a current or former subscriber wants their address deleted, you are in hell. The mailing-list server can cleanup before itself with a reply-to the list only, and

Re: List From and Reply-To

2018-05-31 Thread Antony Stone
On Thursday 31 May 2018 at 17:35:11, Rupert Gallagher wrote: > Beware of the GDPR. If a current or former subscriber wants their address > deleted, you are in hell. The mailing-list server can cleanup before > itself with a reply-to the list only, and obfuscating the addresses, and &

Re: List From and Reply-To

2018-05-31 Thread Rupert Gallagher
Beware of the GDPR. If a current or former subscriber wants their address deleted, you are in hell. The mailing-list server can cleanup before itself with a reply-to the list only, and obfuscating the addresses, and deleting people's own banners and signatures. Sent from ProtonMail Mobil

Re: List From and Reply-To

2018-05-31 Thread Ian Zimmerman
On 2018-05-31 12:25, Antony Stone wrote: > Anyone is free to set a Reply-To header in the emails they send. This > will be preserved by the list server. > > I believe both Ian and Bill are doing this, yes. Correct. But Reply-To doesn't mean "follow up with list post

Re: List From and Reply-To

2018-05-31 Thread Palvelin Postmaster
> On 31 May 2018, at 16:46, Reindl Harald wrote: > > Am 31.05.2018 um 12:16 schrieb Palvelin Postmaster: >>> Begin forwarded message: >>> >>> *From: *Ian Zimmerman mailto:i...@very.loosely.org>> >>> *Subject: **Re: List From and Reply-

Re: Fwd: List From and Reply-To

2018-05-31 Thread Antony Stone
On Thursday 31 May 2018 at 12:16:04, Palvelin Postmaster wrote: > > Begin forwarded message: > > > > From: Ian Zimmerman > Are you and Bill Cole doing something different from other list members > because your emails appear to have a Reply-To header? Anyone is free to

Fwd: List From and Reply-To

2018-05-31 Thread Palvelin Postmaster
> Begin forwarded message: > > From: Ian Zimmerman > Subject: Re: List From and Reply-To > Date: 31 May 2018 at 8:24:11 EEST > To: users@spamassassin.apache.org > Reply-To: users@spamassassin.apache.org > > On 2018-05-30 15:49, Palvelin Postmaster wrote: > >&g

Re: List From and Reply-To

2018-05-30 Thread Ian Zimmerman
On 2018-05-30 15:49, Palvelin Postmaster wrote: > Why does this list apparently use the original From header of the > poster’s message and doesn't set a Reply-To header at all? Because that is the only right way. A list manager has no business modifying the contents of posted me

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread Grant Taylor
On 05/30/2018 04:02 PM, RW wrote: OK, but when you said "The failure seems to be a result of how DMARC amalgamates the two with published policies" I thought you were claiming some kind of anomalous behaviour. Ah. Sorry for the confusion. It's surely obvious that rewriting the envelope sende

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread RW
On Wed, 30 May 2018 12:47:42 -0600 Grant Taylor wrote: > On 05/30/2018 12:08 PM, RW wrote: > > SPF passes on the rewritten envelope address, so it's not aligned > > and it's just a matter of whether there's an aligned dkim pass. > > It depends on what the Forensic Report ("fo") option is set to

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread Bill Cole
On 30 May 2018, at 17:19 (-0400), Luis E. Muñoz wrote: On 30 May 2018, at 13:54, Bill Cole wrote: On 30 May 2018, at 14:51 (-0400), Grant Taylor wrote: Since Qualcom transferred the Eudora IP to the Computer History Museum and open sourced the source code, I expect that we will be seeing mo

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread Luis E. Muñoz
On 30 May 2018, at 14:30, Bill Cole wrote: And if you can imagine this, both Thunderbird and MailMate choke on large mailboxes *even more* than Mail.app does. I haven't had MM "choke" on large mailboxes in recent years. I wish Benny would just declare a 2.0 release to make it clear that MM t

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread Bill Cole
On 30 May 2018, at 14:47 (-0400), Charles Sprickman wrote: All email clients “generally suck”. Thunderbird is not even actively developed anymore last I checked, Check again. That's not been true for quite a while. I just dusted off TBird for the first time in 2 years and was treated to an u

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread Luis E. Muñoz
On 30 May 2018, at 13:54, Bill Cole wrote: On 30 May 2018, at 14:51 (-0400), Grant Taylor wrote: Since Qualcom transferred the Eudora IP to the Computer History Museum and open sourced the source code, I expect that we will be seeing movement there in. I think I've seen some references to p

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread Bill Cole
On 30 May 2018, at 14:51 (-0400), Grant Taylor wrote: > Since Qualcom transferred the Eudora IP to the Computer History Museum and > open sourced the source code, I expect that we will be seeing movement there > in. I think I've seen some references to projects to resurrect the code base > wit

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread Grant Taylor
On 05/30/2018 12:47 PM, Charles Sprickman wrote: If I had a better option than some old command-line mess, I’d use it. Every 3-4 years I go on a hunt for a new Mac mail client and I always come up empty. I’ve tried MailMate, Thunderbird, Postbox and just keep coming back to the (neglected) Mai

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread Grant Taylor
On 05/30/2018 12:08 PM, RW wrote: SPF passes on the rewritten envelope address, so it's not aligned and it's just a matter of whether there's an aligned dkim pass. It depends on what the Forensic Report ("fo") option is set to in the published DMARC policy. Domain owners / record publishers c

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread Charles Sprickman
lMate, Thunderbird, Postbox and just keep coming back to the (neglected) Mail.app. I’m all ears if there’s something out there that can deal with 5 or 6 really large accounts well, AND does the right thing with mailing lists, I’m all ears. I’ve not tried Outlook for Mac yet, maybe that’s the t

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread RW
On Wed, 30 May 2018 11:45:12 -0600 Grant Taylor wrote: > On 05/30/2018 09:34 AM, Grant Taylor wrote: > > Now to see what sort of DMARC notifications (if any) I get for this > > reply. > > I have received four DMARC auth-failure notifications (thus far) in > response to my message to the SpamAs

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread Grant Taylor
On 05/30/2018 09:34 AM, Grant Taylor wrote: Now to see what sort of DMARC notifications (if any) I get for this reply. I have received four DMARC auth-failure notifications (thus far) in response to my message to the SpamAssassin Users mailing list. It looks like the reports are indicating t

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread Grant Taylor
On 05/30/2018 08:43 AM, Bill Cole wrote: Note that changing the From header would break all DKIM signatures and forcing a Reply-To would break many. That's where validating & striping DKIM signatures as the message enters the list comes into play. Preferably followed up with DKIM s

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread Bill Cole
On 30 May 2018, at 10:25, Bill Cole wrote: On 30 May 2018, at 10:00, Palvelin Postmaster wrote: On 30 May 2018, at 16:48, Antony Stone wrote: On Wednesday 30 May 2018 at 15:33:13, Palvelin Postmaster wrote: On 30 May 2018, at 16:06, Matus UHLAR - fantomas wrote: On 30.05.18 15:49, Palv

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread Bill Cole
On 30 May 2018, at 8:49, Palvelin Postmaster wrote: Why does this list apparently use the original From header of the poster’s message and doesn't set a Reply-To header at all? 1. Traditional standard practice. Doing otherwise in either case would offend more people than sticking wit

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread Bill Cole
ozilla and MailMate. For iOS not so much, sadly. Any mail client that does not have an easy way to view messages in raw RFC5322, to create messages that follow RFC3676, and to set Reply-To and From headers arbitrarily is unfit for use in the modern world no matter how many people use it because sw

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread Palvelin Postmaster
> On 30 May 2018, at 16:48, Antony Stone > wrote: > > On Wednesday 30 May 2018 at 15:33:13, Palvelin Postmaster wrote: > >>> On 30 May 2018, at 16:06, Matus UHLAR - fantomas >>> wrote: >>> >>> On 30.05.18 15:49, Palvelin Postmaster wrote: Hitting reply sends the response to poster dir

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread Antony Stone
ist-Post: <mailto:users@spamassassin.apache.org> There is no Reply-To header. When I click on "Reply" my MUA automatically offers me users@spamassassin.apache.org Regards, Antony. -- Police have found a cartoonist dead in his house. They say that details are currently ske

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread Palvelin Postmaster
Date: Wed, 30 May 2018 15:41:07 +0300 References: <257e510f-ab68-4e22-8a6b-552f59af3...@palvelin.fi> <20180530122146.gb24...@fantomas.sk> To: users@spamassassin.apache.org In-Reply-To: <20180530122146.gb24...@fantomas.sk> Message-Id:

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread Alex Woick
Palvelin Postmaster schrieb am 30.05.2018 um 14:49: Why does this list apparently use the original From header of the poster’s message and doesn't set a Reply-To header at all? Hitting reply sends the response to poster directly and DMARC failures occur when posting to list. Not very el

Re: [Offtopic] List From and Reply-To

2018-05-30 Thread Matus UHLAR - fantomas
On 30.05.18 15:49, Palvelin Postmaster wrote: Why does this list apparently use the original From header of the poster’s message and doesn't set a Reply-To header at all? because it's the standard behaviour. Hitting reply sends the response to poster directly get a mail c

[Offtopic] List From and Reply-To

2018-05-30 Thread Palvelin Postmaster
Why does this list apparently use the original From header of the poster’s message and doesn't set a Reply-To header at all? Hitting reply sends the response to poster directly and DMARC failures occur when posting to list. Not very elegant.

Re: Blacklist for reply-to?

2018-02-21 Thread @lbutlr
On 2018-02-21 (00:20 MST), Rupert Gallagher wrote: > > Beware that companies use a legal note in their signature as advised by their > lawyers, and many individuals do the same, to inform the reader about laws > that apply regardless of where or when you are reading their note. Mostly they lie

Re: Blacklist for reply-to?

2018-02-20 Thread Rupert Gallagher
You are wrong. Sent from ProtonMail Mobile On Wed, Feb 21, 2018 at 00:07, @lbutlr wrote: > On 2018-02-20 (06:02 MST), Rupert Gallagher wrote: > > Do you have the legal > right to do so? Absolutely. No one gets to inflict a contract on me. > Especially not a entirely stupid nonsense thing that

Re: Blacklist for reply-to?

2018-02-20 Thread Rupert Gallagher
Beware that companies use a legal note in their signature as advised by their lawyers, and many individuals do the same, to inform the reader about laws that apply regardless of where or when you are reading their note. A mail from Europe is subject to data protection. It does not matter if you

Re: Blacklist for reply-to?

2018-02-20 Thread @lbutlr
On 2018-02-20 (06:02 MST), Rupert Gallagher wrote: > > Do you have the legal right to do so? Absolutely. No one gets to inflict a contract on me. Especially not a entirely stupid nonsense thing that like that piece of crap that has no legal weight whatsoever. -- We are born naked, wet and hu

Re: Blacklist for reply-to?

2018-02-20 Thread Rupert Gallagher
The matter is controversial. Lists have own defaults, who often abuse their original aim of mere forwarding, especially when they redistribute from a long-term archive. On the other hand, people have own default banners for all outgoing correspondence, some with explicit reference to the applic

Re: Blacklist for reply-to?

2018-02-20 Thread Kevin A. McGrail
On 2/19/2018 7:15 PM, John Hardin wrote: Kevin, can that be set to advisory rather than completely killed? Agreed.  I'll comment out the setting of the score to zero in nonKAMrules.cf.

Re: Blacklist for reply-to?

2018-02-20 Thread Rupert Gallagher
Do you have the legal right to do so? On Tue, Feb 20, 2018 at 00:23, @lbutlr wrote: > On 2018-02-19 (09:57 MST), Paul Stead wrote: > ...@zeninternet.co.uk> > I reject your terms. @zeninternet.co.uk>

Re: Blacklist for reply-to?

2018-02-20 Thread Daniele Duca
On 18/02/2018 21:06, Kenneth Porter wrote: Is there a blacklist for domains in the reply-to header? I've noticed a lot of spam with no URL and mutating From but the reply-to domain is always aliyun dot com. I want to add a site-wide blacklist for that. If you are willing to write a litt

Re: Blacklist for reply-to?

2018-02-19 Thread John Hardin
On Mon, 19 Feb 2018, Alex wrote: Hi, On Mon, Feb 19, 2018 at 3:20 PM, John Hardin wrote: On Mon, 19 Feb 2018, Rupert Gallagher wrote: Whatever you do, just do not ask others to blacklist Alibaba Are those getting hits on SPOOFED_FREEM_REPTO_CHN? Perhaps just bump the score for that loca

Re: Blacklist for reply-to?

2018-02-19 Thread Alex
Hi, On Mon, Feb 19, 2018 at 3:20 PM, John Hardin wrote: > On Mon, 19 Feb 2018, Rupert Gallagher wrote: > >> Whatever you do, just do not ask others to blacklist Alibaba > > > Are those getting hits on SPOOFED_FREEM_REPTO_CHN? > > Perhaps just bump the score for that locally? KAM's rules are stil

Re: Blacklist for reply-to?

2018-02-19 Thread @lbutlr
On 2018-02-19 (09:57 MST), Paul Stead wrote: > > This message is private and confidential. If you have received this message > in error, please notify us and remove it from your system. > > Zen Internet Limited may monitor email traffic data to manage billing, to > handle customer enquiries an

Re: Blacklist for reply-to?

2018-02-19 Thread Benny Pedersen
David Jones skrev den 2018-02-19 22:35: https://bz.apache.org/SpamAssassin I have added a few domains over the past few months but my mail flow isn't going to see many of the problem domains outside of the US like those listed above. https://www.google.dk/search?q=github+freemail seems all i

Re: Blacklist for reply-to?

2018-02-19 Thread David Jones
On 02/19/2018 03:19 PM, John Hardin wrote: On Mon, 19 Feb 2018, Kenneth Porter wrote: On 2/19/2018 12:20 PM, John Hardin wrote: Are those getting hits on SPOOFED_FREEM_REPTO_CHN? No, not seeing that one. After enough training I eventually see it land in Bayes. The RBLs are starting to flag

Re: Blacklist for reply-to?

2018-02-19 Thread John Hardin
On Mon, 19 Feb 2018, Kenneth Porter wrote: On 2/19/2018 12:20 PM, John Hardin wrote: Are those getting hits on SPOOFED_FREEM_REPTO_CHN? No, not seeing that one. After enough training I eventually see it land in Bayes. The RBLs are starting to flag it. X-Spam-Status: Yes, score=5.7 required

Re: Blacklist for reply-to?

2018-02-19 Thread Kenneth Porter
,     FREEMAIL_FROM,RCVD_IN_BRBL_LASTEXT autolearn=no version=3.3.1 The subject and body are offering "image editing". The From is forged. But the Reply-to is consistent.

Re: Blacklist for reply-to?

2018-02-19 Thread John Hardin
On Mon, 19 Feb 2018, Rupert Gallagher wrote: Whatever you do, just do not ask others to blacklist Alibaba Are those getting hits on SPOOFED_FREEM_REPTO_CHN? Perhaps just bump the score for that locally? -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec

Re: Blacklist for reply-to?

2018-02-19 Thread Rupert Gallagher
Mobile On Mon, Feb 19, 2018 at 10:00, Kenneth Porter wrote: > On 2/18/2018 5:09 PM, Antony Stone wrote: > >> On Monday 19 February 2018 at 01:55:45, Rupert Gallagher wrote: >> >>> Question time! You receive spam with a reply-to your own address. What do >>>

Re: Blacklist for reply-to?

2018-02-19 Thread Paul Stead
I have a BZ raised for reply-to blacklist checking: https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7354 On 19/02/2018, 15:05, "Kevin A. McGrail" wrote: On 2/18/2018 3:06 PM, Kenneth Porter wrote: > Is there a blacklist for domains in the reply-to header? >

Re: Blacklist for reply-to?

2018-02-19 Thread Kevin A. McGrail
On 2/18/2018 3:06 PM, Kenneth Porter wrote: Is there a blacklist for domains in the reply-to header? I've noticed a lot of spam with no URL and mutating From but the reply-to domain is always aliyun dot com. I want to add a site-wide blacklist for that. To my knowledge it doesn't

Re: Blacklist for reply-to?

2018-02-19 Thread Daniele Duca
On 19/02/2018 10:00, Kenneth Porter wrote: I have no clue what Rupert is on about. I just want something like blacklist_from that uses the reply-to header. I thought it was a simple technical question about how the config file directives map onto the actual headers. I'm not asking for

Re: Blacklist for reply-to?

2018-02-19 Thread Kenneth Porter
On 2/18/2018 5:09 PM, Antony Stone wrote: On Monday 19 February 2018 at 01:55:45, Rupert Gallagher wrote: Question time! You receive spam with a reply-to your own address. What do you do? I take it that this is now a rather different question that the one you originally asked in this thread

Re: Blacklist for reply-to?

2018-02-18 Thread Rupert Gallagher
You need coffee... Sent from ProtonMail Mobile On Mon, Feb 19, 2018 at 02:09, Antony Stone wrote: > On Monday 19 February 2018 at 01:55:45, Rupert Gallagher wrote: > Question > time! You receive spam with a reply-to your own address. What do > you do? I > take it that this

Re: Blacklist for reply-to?

2018-02-18 Thread Benny Pedersen
Antony Stone skrev den 2018-02-19 02:09: C: you ask for advice Good idea; let's see what other replies you get. i hate mondays :=)

Re: Blacklist for reply-to?

2018-02-18 Thread Antony Stone
On Monday 19 February 2018 at 01:55:45, Rupert Gallagher wrote: > Question time! You receive spam with a reply-to your own address. What do > you do? I take it that this is now a rather different question that the one you originally asked in this thread, where the reply-to address was c

Re: Blacklist for reply-to?

2018-02-18 Thread Rupert Gallagher
Question time! You receive spam with a reply-to your own address. What do you do? A: you blacklist your own address B: you ask around to do A for you C: you ask for advice Sent from ProtonMail Mobile On Sun, Feb 18, 2018 at 22:39, Kenneth Porter wrote: > --On Sunday, February 18, 2018 4

Re: Blacklist for reply-to?

2018-02-18 Thread Benny Pedersen
Kenneth Porter skrev den 2018-02-18 22:39: These emails are addressed to many of my web-page-only addresses that I've never used to sign up for anything. They're clearly unsolicited. blacklist_to *@spamtrap.example.org in replyto force bayes learn on user in blacklist maybe use blacklist_fro

Re: Blacklist for reply-to?

2018-02-18 Thread Kenneth Porter
--On Sunday, February 18, 2018 4:21 PM -0500 Rupert Gallagher wrote: It is not spam. You get it if you have an account with alibaba. Just configure it. These emails are addressed to many of my web-page-only addresses that I've never used to sign up for anything. They're clearly unsolicited.

Re: Blacklist for reply-to?

2018-02-18 Thread Rupert Gallagher
It is not spam. You get it if you have an account with alibaba. Just configure it. Sent from ProtonMail Mobile On Sun, Feb 18, 2018 at 21:06, Kenneth Porter wrote: > Is there a blacklist for domains in the reply-to header? I've noticed a lot > of spam with no URL and mutating F

Re: Blacklist for reply-to?

2018-02-18 Thread Rob McEwen
On 2/18/2018 3:06 PM, Kenneth Porter wrote: Is there a blacklist for domains in the reply-to header? I've noticed a lot of spam with no URL and mutating From but the reply-to domain is always aliyun dot com. I want to add a site-wide blacklist for that. http://msbl.org (I'm not

Blacklist for reply-to?

2018-02-18 Thread Kenneth Porter
Is there a blacklist for domains in the reply-to header? I've noticed a lot of spam with no URL and mutating From but the reply-to domain is always aliyun dot com. I want to add a site-wide blacklist for that.

Re: Reply-To Munging Considered Harmful (was Re: Childish actions of Harald Reindl)

2016-08-05 Thread Benny Pedersen
On 2016-08-05 15:13, Dianne Skoll wrote: It'll be a cold day in Hell before MSFT acknowledges that header, I suppose. ironical ios devices is not better

Re: Reply-To Munging Considered Harmful (was Re: Childish actions of Harald Reindl)

2016-08-05 Thread Dianne Skoll
On Fri, 05 Aug 2016 11:44:16 +0200 Bernd Petrovitsch wrote: > Somewhat current "evolution" can do this without > installing/configuring anything. Claws Mail also. It seems to respect the List-Post: header. It'll be a cold day in Hell before MSFT acknowledges that header, I suppose. Regards,

Reply-To Munging Considered Harmful (was Re: Childish actions of Harald Reindl)

2016-08-05 Thread Bernd Petrovitsch
On Fri, 2016-08-05 at 10:52 +0200, Benny Pedersen wrote: > On 2016-08-05 10:46, Martin wrote: > > > reply it replies to the poster not the list, this has always been a > > The biggest reason is the way this mailing list is set up, when you > > click Which is a good thing. [...] > roundcube here

Re: List Policy Question: Why no reply-to: header?

2011-02-07 Thread Matus UHLAR - fantomas
On 31.01.11 09:28, Adam Moffett wrote: > Yes I have a "reply list" button, but this is the only list I'm on where > I have to use it. I have gotten into the habit of just hitting "reply". > So I sometimes accidentally reply to the poster instead of the lis

Re: List Policy Question: Why no reply-to: header?

2011-01-31 Thread Benny Pedersen
On Mon, 31 Jan 2011 09:28:27 -0500, Adam Moffett wrote: > People can believe I'm dumb for thinking that adding/modifying the > reply-to: header is a simpler and cleaner solution, and I can believe > people are dumb for thinking there should be multiple reply buttons in >

Re: List Policy Question: Why no reply-to: header?

2011-01-31 Thread Martin Gregorie
On Mon, 2011-01-31 at 15:22 +, Anthony Cartmell wrote: > > Yes I have a "reply list" button, but this is the only list I'm on where > > I have to use it. I have gotten into the habit of just hitting > > "reply". So I sometimes accidentally re

Re: List Policy Question: Why no reply-to: header?

2011-01-31 Thread Anthony Cartmell
Yes I have a "reply list" button, but this is the only list I'm on where I have to use it. I have gotten into the habit of just hitting "reply". So I sometimes accidentally reply to the poster instead of the list. FWIW, Opera's excellent mail client sets

Re: List Policy Question: Why no reply-to: header?

2011-01-31 Thread Adam Moffett
of just hitting "reply". So I sometimes accidentally reply to the poster instead of the list. It's annoying to me, but it sounds like it's an issue like abortion where everyone's made up their mind already and there isn't much point arguing about it. People

Re: List Policy Question: Why no reply-to: header?

2011-01-31 Thread Matus UHLAR - fantomas
> >> On Fri, 28 Jan 2011 17:00:02 -0500, Adam Moffett > >> > >> wrote: > >> > >>> Is there any particular reason there can't be a reply-to: header added > >>> by the listserv? > > On 1/28/2011 5:28 PM, Benny Pedersen wrote

Re: List Policy Question: Why no reply-to: header?

2011-01-31 Thread Benny Pedersen
On Mon, 31 Jan 2011 02:51:56 -0500, Matt Kettler wrote: > On 1/28/2011 5:28 PM, Benny Pedersen wrote: >> On Fri, 28 Jan 2011 17:00:02 -0500, Adam Moffett >> >> wrote: >> >>> Is there any particular reason there can't be a reply-to: header added >&g

  1   2   >