Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-21 Thread Nix
On 20 Nov 2024, Andy Smith uttered the following: > Hi, > > On Wed, Nov 20, 2024 at 05:07:09PM +, Nix wrote: >> > From >> > https://knowledge.validity.com/s/articles/Accessing-Validity-reputation-data-through-DNS >> > : >> >> Tried registering here. I can register a v4 address, but every fo

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-21 Thread Greg Troxel
Nick Howitt writes: >> ... the account is free and then they hit you with an EULA that says >> >>> The Services are available at the then-current rate. Customer shall >>> pay all applicable fees when due as invoiced and, if fees are being >>> paid via credit card or other electronic means, Custo

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-20 Thread Andy Smith
Hi, On Wed, Nov 20, 2024 at 05:07:09PM +, Nix wrote: > > From > > https://knowledge.validity.com/s/articles/Accessing-Validity-reputation-data-through-DNS > > : > > Tried registering here. I can register a v4 address, but every format of > v6 CIDR I've tried reports "Invalid V6_CIDR" with (

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-20 Thread Kris Deugau
Nix wrote: On 19 Nov 2024, Matija Nalis stated: On Mon, Nov 18, 2024 at 05:21:12PM +, Nix wrote: I'm not a high-volume site, a few thousand mails a day. If I'm blocked, probably more or less everyone is being blocked. (Are the DNSBLs above Yes, pretty much every non-paying customer is bl

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-20 Thread Nix
On 19 Nov 2024, Matija Nalis stated: > On Mon, Nov 18, 2024 at 05:21:12PM +, Nix wrote: >> I'm not a high-volume site, a few thousand mails a day. If I'm blocked, >> probably more or less everyone is being blocked. (Are the DNSBLs above > > Yes, pretty much every non-paying customer is blocked

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-20 Thread Nick Howitt
On 20/11/2024 17:07, Nix wrote: On 19 Nov 2024, Matija Nalis stated: On Mon, Nov 18, 2024 at 05:21:12PM +, Nix wrote: I'm not a high-volume site, a few thousand mails a day. If I'm blocked, probably more or less everyone is being blocked. (Are the DNSBLs above Yes, pretty much every n

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-20 Thread Nick Howitt
On 20/11/2024 16:39, Nix wrote: On 20 Nov 2024, Nick Howitt uttered the following: On 20/11/2024 12:55, Nix wrote: On 19 Nov 2024, Greg Troxel told this: Matija Nalis writes: From https://knowledge.validity.com/s/articles/Accessing-Validity-reputation-data-through-DNS : Star

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-20 Thread Nix
On 20 Nov 2024, Nick Howitt uttered the following: > > > On 20/11/2024 12:55, Nix wrote: >> On 19 Nov 2024, Greg Troxel told this: >> >>> Matija Nalis writes: >>> From https://knowledge.validity.com/s/articles/Accessing-Validity-reputation-data-through-DNS : > Starti

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-20 Thread Nix
On 19 Nov 2024, Greg Troxel told this: > Matija Nalis writes: > >> From >> https://knowledge.validity.com/s/articles/Accessing-Validity-reputation-data-through-DNS >> : >> >>> Starting March 1, 2024, Validity will allow up to 10,000 requests to >>> anonymous users over a 30-day period. >> >>

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-20 Thread Nick Howitt
On 20/11/2024 12:55, Nix wrote: On 19 Nov 2024, Greg Troxel told this: Matija Nalis writes: From https://knowledge.validity.com/s/articles/Accessing-Validity-reputation-data-through-DNS : Starting March 1, 2024, Validity will allow up to 10,000 requests to anonymous users over a 3

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-20 Thread Nix
On 19 Nov 2024, Matus UHLAR stated: >>On 18 Nov 2024, Bill Cole spake thusly: >>> If you forward DNS queries instead of running your own *fully >>> recursive* DNS resolver locally, you *look* like you are part of a >>> high-volume leech. This almost certainly does not mean you should run >>> dnsma

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-20 Thread Anne P. Mitchell, Esq.
> 10k requests per 30-day period is about 333 queries/day. Or less than 14 > queries per hour. > Not very much at all (and certainly at least order of magnitude less than > your stated traffic). > No amount of local DNS caching is going to fix limits *that low*. Just a reminder that there is n

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-19 Thread Greg Troxel
feature, having default rules that are >> blocked for many reasonable personal use systems is less problematic. >> > So what happens to the limit when you register with them? A good question, but I have never perceived it being ok to have to register for default ruleset RBLs. (What

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-19 Thread Nick Howitt
messages processed by SA. I didn't However a bunch of them hit shortcircuit rules (e.g. DKIM welcomelist) and thus I suspect some of those don't query RBLs (but logs show some do). So perhaps I am just squeaking by. And yes, I am running my own resolver. This is a personal server. W

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-19 Thread Greg Troxel
me shows just over 10K messages processed by SA. I didn't However a bunch of them hit shortcircuit rules (e.g. DKIM welcomelist) and thus I suspect some of those don't query RBLs (but logs show some do). So perhaps I am just squeaking by. And yes, I am running my own resolver. T

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-19 Thread Nick Howitt
On 19/11/2024 10:27, Matus UHLAR - fantomas wrote: The point of the big ugly error message is to have a big ugly error message. MOST people who report problems with SA accuracy here have misconfigured their resolvers, apparently because they don't trust documentation or don't read it. Not

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-19 Thread Matus UHLAR - fantomas
On 18 Nov 2024, Bill Cole spake thusly: If you forward DNS queries instead of running your own *fully recursive* DNS resolver locally, you *look* like you are part of a high-volume leech. This almost certainly does not mean you should run dnsmasq locally, it means you need a REAL resolver. Unboun

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-18 Thread Matija Nalis
n in that message? > > Nov 14 00:00:03 loom warning: check: dns_block_rule > RCVD_IN_VALIDITY_RPBL_BLOCKED hit, creating > /etc/mail/spamassassin/helpers/.spamassassin/dnsblock_bl.score.senderscore.com > (This means DNSBL blocked you due to too many queries. Set all affected > rules s

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-18 Thread Nix
t on earth is going on in that message? >> >> Nov 14 00:00:03 loom warning: check: dns_block_rule >> RCVD_IN_VALIDITY_RPBL_BLOCKED hit, creating >> /etc/mail/spamassassin/helpers/.spamassassin/dnsblock_bl.score.senderscore.com >> (This means DNSBL blocked you due to too many queries. S

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-18 Thread Nix
On 18 Nov 2024, Nick Howitt stated: > The RBL's check the referring DNS Server. if you use someone like OpenDNS or > GoogleDNS, as many others do then, as far as the RBL > list is concernet it is receiving too many queries via those DNS servers. > > If you want to use these RBL's, it is recommend

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-18 Thread Bill Cole
_block_rule > RCVD_IN_VALIDITY_RPBL_BLOCKED hit, creating > /etc/mail/spamassassin/helpers/.spamassassin/dnsblock_bl.score.senderscore.com > (This means DNSBL blocked you due to too many queries. Set all affected > rules score to 0, or use "dns_query_restriction deny > bl.score.sendersco

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-18 Thread Nick Howitt
elpers/.spamassassin/dnsblock_bl.score.senderscore.com (This means DNSBL blocked you due to too many queries. Set all affected rules score to 0, or use "dns_query_restriction deny bl.score.senderscore.com" to disable queries) Nov 14 00:00:03 loom warning: check: dns_block_rule RCVD_IN_VALIDITY_SAFE_BL

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-18 Thread Nix
ed you due to too many queries. Set all affected rules score to 0, or use "dns_query_restriction deny bl.score.senderscore.com" to disable queries) Nov 14 00:00:03 loom warning: check: dns_block_rule RCVD_IN_VALIDITY_SAFE_BLOCKED hit, creating /etc/mail/spamassassin/helpers/.spamassassin

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-15 Thread Mark London
r.  I disabled all of them.  Strange. - Mark Do you have trustpath configured properly? https://cwiki.apache.org/confluence/display/SPAMASSASSIN/TrustPath - if you use backup MX server which is listed here, it may cause this   problem. do you update your rules? those three rules use different d

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-14 Thread Matus UHLAR - fantomas
On 14.11.24 15:31, Matija Nalis wrote: I'm not using VALIDITY for SA, but I do periodic checks with Icinga check_rbl if my mailservers did get on any blacklist, and about 2 days ago I've got alerts that ALL of mailservers were suddenly on Validity Senderscore blacklist: CHECK_RBL CRITICAL - x.x.

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-14 Thread Matija Nalis
They probably tightened up their AUP / enforcement... I'm not using VALIDITY for SA, but I do periodic checks with Icinga check_rbl if my mailservers did get on any blacklist, and about 2 days ago I've got alerts that ALL of mailservers were suddenly on Validity Senderscore blacklist: CHECK_RBL C

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-14 Thread Matus UHLAR - fantomas
have trustpath configured properly? https://cwiki.apache.org/confluence/display/SPAMASSASSIN/TrustPath - if you use backup MX server which is listed here, it may cause this problem. do you update your rules? those three rules use different dnswls: header RCVD_IN_VALIDITY_CERTIFIED

Re: All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-13 Thread Jared Hall via users
On 11/13/2024 10:15 PM, Mark London wrote: FWIW, Today I discovered that RCVD_IN_VALIDITY_CERTIFIED, RCVD_IN_VALIDITY_RPBL, and RCVD_IN_VALIDITY_SAFE, were being triggered for every email that our server received.  I do not use a public DNS server.  I disabled all of them.  Strange. - Mark

All RCVD_IN_VALIDITY rules being applied to every email.

2024-11-13 Thread Mark London
FWIW, Today I discovered that RCVD_IN_VALIDITY_CERTIFIED, RCVD_IN_VALIDITY_RPBL, and RCVD_IN_VALIDITY_SAFE, were being triggered for every email that our server received.  I do not use a public DNS server.  I disabled all of them.  Strange. - Mark

Re: Disable validity rules

2024-09-23 Thread Bill Cole
On 2024-09-23 at 09:15:25 UTC-0400 (Mon, 23 Sep 2024 13:15:25 +) Grega via users is rumored to have said: Hi. Where can one disable this? One can disable any rule by adding a score line in local.cf for the rule with a score of 0, e,g,: score RCVD_IN_VALIDITY_CERTIFIED_BLOCKED

Re: Disable validity rules

2024-09-23 Thread Grega via users
True. I have added it and will report back in few days... Regards,G From: Reindl Harald (privat) Sent: Monday, 23 September 2024 15:31 To: Grega; users@spamassassin.apache.org Subject: Re: Disable validity rules Am 23.09.24 um 15:23 schrieb Grega via

Re: Disable validity rules

2024-09-23 Thread Grega via users
: Re: Disable validity rules Am 23.09.24 um 15:15 schrieb Grega via users: > Where can one disable this? > > RCVD_IN_VALIDITY_CERTIFIED_BLOCKED ADMINISTRATOR NOTICE: The query to > Validity was blocked. See > https://knowledge.validity.com/hc/en-us/articles/20961730681243 for mor

Disable validity rules

2024-09-23 Thread Grega via users
Hi. Where can one disable this? RCVD_IN_VALIDITY_CERTIFIED_BLOCKED ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED ADMINISTRATOR NOTICE: The query to Validit

Re: Lots of FN because of VALIDITY* rules

2024-06-14 Thread Anne P. Mitchell, Esq.
> On Jun 3, 2024, at 4:09 AM, Matus UHLAR - fantomas wrote: > > I forgot to add that I have "lowered" (increased to small negative number) > scores for RCVD_IN_VALIDITY_*, RCVD_IN_DNSWL_* and RCVD_IN_IADB_* > because I has similar bad experience with them. Matus, if you EVER have a bad exper

Re: Lots of FN because of VALIDITY* rules

2024-06-05 Thread postgarage Graz IT
On 6/5/24 13:14, Matus UHLAR - fantomas wrote: On 2024-06-03 at 08:35:32 UTC-0400 (Mon, 3 Jun 2024 14:35:32 +0200) postgarage Graz IT is rumored to have said: I think that the active.list file should be updated, when there are new rules, shouldn't it? On 03.06.24 08:52, Bill Cole

Re: Lots of FN because of VALIDITY* rules

2024-06-05 Thread Matus UHLAR - fantomas
On 2024-06-03 at 08:35:32 UTC-0400 (Mon, 3 Jun 2024 14:35:32 +0200) postgarage Graz IT is rumored to have said: I think that the active.list file should be updated, when there are new rules, shouldn't it? On 03.06.24 08:52, Bill Cole wrote: It is updated where it is actually used, on th

Re: Lots of FN because of VALIDITY* rules

2024-06-05 Thread postgarage Graz IT
On 6/5/24 11:14, postgarage Graz IT wrote: On 6/5/24 09:17, Matus UHLAR - fantomas wrote: On 2024-06-03 at 08:35:32 UTC-0400 (Mon, 3 Jun 2024 14:35:32 +0200) postgarage Graz IT is rumored to have said: I think that the active.list file should be updated, when there are new rules

Re: Lots of FN because of VALIDITY* rules

2024-06-05 Thread postgarage Graz IT
On 6/5/24 09:17, Matus UHLAR - fantomas wrote: On 2024-06-03 at 08:35:32 UTC-0400 (Mon, 3 Jun 2024 14:35:32 +0200) postgarage Graz IT is rumored to have said: I think that the active.list file should be updated, when there are new rules, shouldn't it? On 03.06.24 08:52, Bill Cole

Re: Lots of FN because of VALIDITY* rules

2024-06-05 Thread Matus UHLAR - fantomas
On 2024-06-03 at 08:35:32 UTC-0400 (Mon, 3 Jun 2024 14:35:32 +0200) postgarage Graz IT is rumored to have said: I think that the active.list file should be updated, when there are new rules, shouldn't it? On 03.06.24 08:52, Bill Cole wrote: It is updated where it is actually used, on th

Re: Lots of FN because of VALIDITY* rules

2024-06-04 Thread postgarage Graz IT
t; it by coincidence… Anyway, thank you all. On 6/3/24 14:52, Bill Cole wrote: On 2024-06-03 at 08:35:32 UTC-0400 (Mon, 3 Jun 2024 14:35:32 +0200) postgarage Graz IT is rumored to have said: I think that the active.list file should be updated, when there are new rules, shouldn't it?

Re: Lots of FN because of VALIDITY* rules

2024-06-03 Thread Bill Cole
On 2024-06-03 at 08:35:32 UTC-0400 (Mon, 3 Jun 2024 14:35:32 +0200) postgarage Graz IT is rumored to have said: I think that the active.list file should be updated, when there are new rules, shouldn't it? It is updated where it is actually used, on the ASF rule maintenance system.

Re: Lots of FN because of VALIDITY* rules

2024-06-03 Thread Bill Cole
On 2024-06-03 at 01:26:31 UTC-0400 (Mon, 3 Jun 2024 07:26:31 +0200) postgarage Graz IT is rumored to have said: Now for my questions: *) as is stated in active.list it should not be edited. What's the correct place to add the new rules to activate them? local.cf? Yes. In your local ve

Re: Lots of FN because of VALIDITY* rules

2024-06-03 Thread postgarage Graz IT
On 6/3/24 12:02, Matus UHLAR - fantomas wrote: > On 03.06.24 07:26, postgarage Graz IT wrote: >> A few days ago a lot of false negatives landed in our inboxes. As it >> turned out the reason was that the for nearly all mails the >> RCVD_IN_VALIDITY_CERTIFIED and RCVD_I

Re: Lots of FN because of VALIDITY* rules

2024-06-03 Thread Matus UHLAR - fantomas
On 03.06.24 12:02, Matus UHLAR - fantomas wrote: On 03.06.24 07:26, postgarage Graz IT wrote: A few days ago a lot of false negatives landed in our inboxes. As it turned out the reason was that the for nearly all mails the RCVD_IN_VALIDITY_CERTIFIED and RCVD_IN_VALIDITY_SAFE rules matched. I

Re: Lots of FN because of VALIDITY* rules

2024-06-03 Thread Matus UHLAR - fantomas
On 03.06.24 07:26, postgarage Graz IT wrote: A few days ago a lot of false negatives landed in our inboxes. As it turned out the reason was that the for nearly all mails the RCVD_IN_VALIDITY_CERTIFIED and RCVD_IN_VALIDITY_SAFE rules matched. I now know that validity introduced a query limit

Lots of FN because of VALIDITY* rules

2024-06-02 Thread postgarage Graz IT
rules matched. I now know that validity introduced a query limit which we hit, because I have to admit, I wasn't aware that I shouldn't use public DNS resolvers for blacklists and therefore we got "Excessive Number of Queries" answers. I also found this patch https://bz.apa

[HEADS-UP] Changes to Validity SpamAssassin rules

2024-05-21 Thread Giovanni Bechis
Hi, if you are using rules that query Validity rbl (RCVD_IN_VALIDITY_* rules), make sure you have updated rules (at least dated 2024-04-23), otherwise you may encounter in FPs instead of hitting an overlimit response. Giovanni OpenPGP_signature.asc Description: OpenPGP digital signature

Re: Whitelist rules should never pass on SPF fail

2024-05-11 Thread Noel Butler
them) to legally protect you, and your professional indemnity insurance (or your countries version of it) is current... I do not work for the domain owners of the world and I am not obligated to enforce their usage rules on their users. Obligated no, its your network, your rules, but hono

Re: Whitelist rules should never pass on SPF fail

2024-05-10 Thread Bill Cole
ating the mail is not generating that desire fraudulently, I don't care much about what the domain owner says. I do not work for the domain owners of the world and I am not obligated to enforce their usage rules on their users. Obviously I take their input seriously when trying to detect f

Re: Whitelist rules should never pass on SPF fail

2024-05-09 Thread Noel Butler
On 09/05/2024 22:47, Bill Cole wrote: On 2024-05-09 at 08:37:06 UTC-0400 (Thu, 09 May 2024 14:37:06 +0200) Benny Pedersen is rumored to have said: Bill Cole skrev den 2024-05-09 14:22: In fact, I can't think of any whitelist test that should pass if SPF fails. If you operate on the theory th

Re: Whitelist rules should never pass on SPF fail

2024-05-09 Thread Bill Cole
On 2024-05-09 at 08:37:06 UTC-0400 (Thu, 09 May 2024 14:37:06 +0200) Benny Pedersen is rumored to have said: Bill Cole skrev den 2024-05-09 14:22: In fact, I can't think of any whitelist test that should pass if SPF fails. If you operate on the theory that a SPF failure is always a sign of

Re: Whitelist rules should never pass on SPF fail

2024-05-09 Thread Benny Pedersen
Bill Cole skrev den 2024-05-09 14:22: In fact, I can't think of any whitelist test that should pass if SPF fails. If you operate on the theory that a SPF failure is always a sign of spam, you can make your SpamAssassin always trust SPF failures absolutely. I would not recommend that. Some pe

Re: Whitelist rules should never pass on SPF fail

2024-05-09 Thread Bill Cole
of one test on the passing of another. A simple logical problem: score RULE_A 3 score RULE_B -2 meta CANCEL_B_IF_A RULE_A && RULE_B score CANCEL_B_IF_A 2 You can also use 'priority' directives to make rules execute in a defined order and a 'shortcircuit' direct

Re: Whitelist rules should never pass on SPF fail

2024-05-08 Thread Benny Pedersen
kurt.va1der.ca via users skrev den 2024-05-08 21:53: I received a (relatively) well crafted Phishing email today. It was clearly a well planned campaign. The Spamassassin score was as follows: X-Spam-Status: No, score=-0.4 required=5.0 tests=GOOG_REDIR_NORDNS=0.001, HTML_FONT_LOW_CONTRAST=

Re: Whitelist rules should never pass on SPF fail

2024-05-08 Thread Noel Butler
On 09/05/2024 05:57, Jarland Donnell wrote: That's easy though at least. Set the DNSWL rule to 0. I appreciate their effort but it's simply not an accurate way to determine the value of an email in 2024. It's never been the deciding factor between whether or not an email was spam, in any email

Re: Whitelist rules should never pass on SPF fail

2024-05-08 Thread Loren Wilton
Obviously the right way is for the master rules to be adjusted. But if you want a local fix, try something like this: score RCVD_IN_DNSWL_HI -0.001 metaMY_RCVD_IN_DNSWL_HIRCVD_IN_DNSWL_HI && !SPF_FAIL score MY_RCVD_IN_DNSWL_HI-5 describeMY_RCVD_IN_

Re: Whitelist rules should never pass on SPF fail

2024-05-08 Thread Jarland Donnell
That’s easy though at least. Set the DNSWL rule to 0. I appreciate their effort but it’s simply not an accurate way to determine the value of an email in 2024. It’s never been the deciding factor between whether or not an email was spam, in any email I’ve audited in the last decade. > On Wednes

Whitelist rules should never pass on SPF fail

2024-05-08 Thread kurt.va1der.ca via users
I received a (relatively) well crafted Phishing email today. It was clearly a well planned campaign. The Spamassassin score was as follows: X-Spam-Status: No, score=-0.4 required=5.0 tests=GOOG_REDIR_NORDNS=0.001, HTML_FONT_LOW_CONTRAST=0.001,HTML_MESSAGE=0.001, NORDNS_LOW_CONTRAST=0

Re: long delay with the new rules from 8 dec

2023-12-08 Thread Bill Cole
On 2023-12-08 at 05:43:28 UTC-0500 (Fri, 8 Dec 2023 11:43:28 +0100) Mickaël Maillot is rumored to have said: forget what i say, it was a DNS issue unrelated to the updated rules. An example of the Basic Axiom of System Administration: It is *ALWAYS* DNS. Le ven. 8 déc. 2023 à 11

Re: long delay with the new rules from 8 dec

2023-12-08 Thread Mickaël Maillot
forget what i say, it was a DNS issue unrelated to the updated rules. Le ven. 8 déc. 2023 à 11:00, Mickaël Maillot a écrit : > Hi, > > I just want to notify you that the new rules take lots more times, > i updated my rules from 5/12 to 8/12 and now in my maillog, i see

long delay with the new rules from 8 dec

2023-12-08 Thread Mickaël Maillot
Hi, I just want to notify you that the new rules take lots more times, i updated my rules from 5/12 to 8/12 and now in my maillog, i see a lot's of: tests_pri_-100: 21005 tests_pri_-100: 14165 tests_pri_-100: 17684 tests_pri_-100: 23094 reverted the ruleset back to 5/12 and it's b

Re: AuthRes plugin test rules

2023-03-18 Thread Matus UHLAR - fantomas
2023 at 11:41 AM Matus UHLAR - fantomas wrote: >>>Matus UHLAR - fantomas skrev den 2023-03-12 10:15: >>>>I have also commited patch to bug 6918 to handle "arc.chain=" >>>>results. >>>>Let's see how these will go. >>On 12.03.23 14:20, Be

Re: AuthRes plugin test rules

2023-03-18 Thread Alex
"arc.chain=" > >>>>results. > >>>>Let's see how these will go. > > >>On 12.03.23 14:20, Benny Pedersen wrote: > >>>miss ARC rules imho > > >Matus UHLAR - fantomas skrev den 2023-03-12 14:38: > >>Or, so you mean som

Re: AuthRes plugin test rules

2023-03-14 Thread Benny Pedersen
Matus UHLAR - fantomas skrev den 2023-03-12 16:41: I set SA only to trust authentication server on my machine and I'm watching the results. okay, i have now added ARC (Seal/Sign) to fuglu, its not perfekt imho, but works as designed in fuglu with this i got iprev working with can be seen in

Re: AuthRes plugin test rules

2023-03-12 Thread Matus UHLAR - fantomas
Matus UHLAR - fantomas skrev den 2023-03-12 10:15: I have also commited patch to bug 6918 to handle "arc.chain=" results. Let's see how these will go. On 12.03.23 14:20, Benny Pedersen wrote: miss ARC rules imho Matus UHLAR - fantomas skrev den 2023-03-12 14:38:

Re: AuthRes plugin test rules

2023-03-12 Thread Benny Pedersen
Matus UHLAR - fantomas skrev den 2023-03-12 14:38: On 12.03.23 14:20, Benny Pedersen wrote: Matus UHLAR - fantomas skrev den 2023-03-12 10:15: I have also commited patch to bug 6918 to handle "arc.chain=" results. Let's see how these will go. miss ARC rules imho there

Re: AuthRes plugin test rules

2023-03-12 Thread Matus UHLAR - fantomas
On 12.03.23 14:20, Benny Pedersen wrote: Matus UHLAR - fantomas skrev den 2023-03-12 10:15: I have also commited patch to bug 6918 to handle "arc.chain=" results. Let's see how these will go. miss ARC rules imho there are no rules in arc.chain. Or, so you mean something els

Re: AuthRes plugin test rules

2023-03-12 Thread Benny Pedersen
Matus UHLAR - fantomas skrev den 2023-03-12 10:15: I have also commited patch to bug 6918 to handle "arc.chain=" results. Let's see how these will go. miss ARC rules imho

AuthRes plugin test rules

2023-03-12 Thread Matus UHLAR - fantomas
Hello, I'm further playing with AuthRes plugin, I have modified test rules so each AUTHRES_ rule is equivalent to corresponding rule in SA. I set scores to only produce small positive scores, usually to even SA scores - valid spf/dkim/dmarc/arc is NOT a ham sign! I have also commited

Re: spamhaus abuse free usage rules

2023-01-11 Thread Henrik K
On Thu, Jan 12, 2023 at 04:01:02AM +0100, Benny Pedersen wrote: > > my changes does nothing to datafeed users, but it > makes big diffrenses to free usage Makes zero difference how the rules are called, SA never sends duplicate physical queries, they are cached and reused.

spamhaus abuse free usage rules

2023-01-11 Thread Benny Pedersen
header RCVD_IN_XBL eval:check_rbl('zen-lastexternal', 'zen.spamhaus.org.', '^127\.0\.0\.[4567]$') header RCVD_IN_PBL eval:check_rbl('zen-lastexternal', 'zen.spamhaus.org.', '^127\.0\.0\.1[01]$') header RCVD_IN_ZEN_BLOCKED_OPENDNS eval:check_rbl('zen-lastexter

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Benny Pedersen
Riccardo Alfieri skrev den 2022-12-28 11:44: Hello everyone, just FYI, I published the updated rules to have DQS working on SA 4.0.0+ (https://github.com/spamhaus/spamassassin-dqs) https://github.com/spamhaus/spamassassin-dqs/blob/master/4.0.0%2B/sh.cf dated Spamhaus's SpamAssassin

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Riccardo Alfieri
On 28/12/22 15:15, Henrik K wrote: Maybe would be even good idea to use something like this: ifplugin Mail::SpamAssassin::Plugin::HashBL else error: Please activate HashBL plugin in v342.pre endif I think I'll just add the ifplugin condition in the two .cf files and add a note in t

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Henrik K
And it is even mentioned in the UPGRADE notes: - The HashBL plugin in 342.pre is now enabled by default. (sad typo in the filename) On Wed, Dec 28, 2022 at 04:21:45PM +0200, Henrik K wrote: > > This was discussed and approved in some of the 4.0.0 bugs. There should be > no need to revisit i

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Kevin A. McGrail
As I say, such is life.  It's a minor thing.  Any objections to a comment if it doesn't exist that documents it was enabled by default in 4.0.0 in the 3.4.2 pre file? On 12/28/2022 9:21 AM, Henrik K wrote: This was discussed and approved in some of the 4.0.0 bugs. There should be no need to r

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Henrik K
This was discussed and approved in some of the 4.0.0 bugs. There should be no need to revisit it. It still wouldn't make sense to have loadplugin HashBL in two *.pre files. On Wed, Dec 28, 2022 at 09:18:51AM -0500, Kevin A. McGrail wrote: > Wow, as it's enabled in v342.pre, that would imply it

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Kevin A. McGrail
Wow, as it's enabled in v342.pre, that would imply it was enabled in 3.4.2.  We should not have changed a past pre file for the 4.0.0 release IMO but added it to the 4.0.0.pre file.  Such is life.  Should we fix it for 4.0.1? On 12/28/2022 9:07 AM, Henrik K wrote: Just keep in mind that HashB

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Benny Pedersen
Henrik K skrev den 2022-12-28 15:06: Of course it's a bit of a double-edged sword, since with ifplugin the rules might silently be ignored. Especially for Gentoo users. ;-) gentoo users does not use precompiled problems

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Henrik K
pamAssassin::Plugin::URIDNSBL > > > > to the .cf files where check_rbl , urirhssub etc are used? > > It would be standard to use it yes. > > Of course it's a bit of a double-edged sword, since with ifplugin the rules > might silently be ignored. Especially for Gentoo

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Benny Pedersen
. irrelevant for rule maintainers that some plugins is enabled by default, all rules must be tested with plugins disabled and still no warn in --lint

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Henrik K
On Wed, Dec 28, 2022 at 09:04:09AM -0500, Kevin A. McGrail wrote: > > However, both URIDNSBL and HashBL are enabled by default from checking the > source code. Just keep in mind that HashBL is only enabled for fresh 4.0.0 installs, it wasn't default previously.

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Henrik K
s. Of course it's a bit of a double-edged sword, since with ifplugin the rules might silently be ignored. Especially for Gentoo users. ;-)

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Kevin A. McGrail
Going further, you might just encapsulate your entire cf file in to ifplugin checks, one for URIDNSBL and one for HashBL and any other plugins you need. However, both URIDNSBL and HashBL are enabled by default from checking the source code. Regards, KAM On 12/28/2022 8:58 AM, Riccardo Alfi

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Riccardo Alfieri
On 28/12/22 14:44, Henrik K wrote: It is enabled by default for new installs in v342.pre (old users must enable it manually). But like with any other loadable plugin, one MUST check use "ifplugin" to check that it's loaded. Ok, thanks for the clarification. Would you then suggest to add also

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Benny Pedersen
Kevin A. McGrail skrev den 2022-12-28 14:48: And posters should do their homework as well and post information that shows what is the problem, how to recreate it, and the expected outcome. Your posts on this thread are borderline nonsensical. i did, but you did not understand me, sorry for th

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Benny Pedersen
Kevin A. McGrail skrev den 2022-12-28 14:44: On 12/28/2022 8:35 AM, Riccardo Alfieri wrote: Do you have hashbl plugin enabled? Ah, I thought it was enabled by default in SA 4.0. You are correct.  HashBL is by default enabled in a stock distribution with v342.pre.  That doesn't mean the trouble

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Kevin A. McGrail
On 12/28/2022 8:33 AM, Benny Pedersen wrote: I have no idea what the check plugin is.  Read your quoted line again. don't read the source ?, https://github.com/apache/spamassassin/blob/trunk/rules/v320.pre#L21 My question was: Do you have the Plugin HashBL enabled. i have in my test

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Benny Pedersen
Riccardo Alfieri skrev den 2022-12-28 14:35: On 28/12/22 14:20, Kevin A. McGrail wrote: Do you have hashbl plugin enabled? Ah, I thought it was enabled by default in SA 4.0. only check is on --lint testing, if all plugins is default enabled multiple errors is hidded hopefully developper

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Kevin A. McGrail
On 12/28/2022 8:35 AM, Riccardo Alfieri wrote: Do you have hashbl plugin enabled? Ah, I thought it was enabled by default in SA 4.0. You are correct.  HashBL is by default enabled in a stock distribution with v342.pre.  That doesn't mean the trouble reporter has it enabled. -- Kevin A. McGrai

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Henrik K
On Wed, Dec 28, 2022 at 01:35:22PM +, Riccardo Alfieri wrote: > On 28/12/22 14:20, Kevin A. McGrail wrote: > > > Do you have hashbl plugin enabled? > > > > > Ah, I thought it was enabled by default in SA 4.0. It is enabled by default for new installs in v342.pre (old users must enable it ma

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Benny Pedersen
Riccardo Alfieri skrev den 2022-12-28 14:34: Looks like you didn't replace the DQS key in the template, as it's outlined in the README. i will not share my key here You also have a lot of parsing errors that are not normal (\t should be a , don't know why your system renders that badly) sh.

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Riccardo Alfieri
On 28/12/22 14:20, Kevin A. McGrail wrote: Do you have hashbl plugin enabled? Ah, I thought it was enabled by default in SA 4.0. -- Best regards, Riccardo Alfieri Spamhaus Technology https://www.spamhaus.com/

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Riccardo Alfieri
Looks like you didn't replace the DQS key in the template, as it's outlined in the README. You also have a lot of parsing errors that are not normal (\t should be a , don't know why your system renders that badly) On 28/12/22 14:17, Benny Pedersen wrote: Dec 28 14:12:09.837 [1461] warn: confi

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Benny Pedersen
Kevin A. McGrail skrev den 2022-12-28 14:24: I have no idea what the check plugin is.  Read your quoted line again. don't read the source ?, https://github.com/apache/spamassassin/blob/trunk/rules/v320.pre#L21 i have in my test only this plugin enabled, rest is disabled rule mainta

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Kevin A. McGrail
I have no idea what the check plugin is.  Read your quoted line again. On 12/28/2022 8:22 AM, Benny Pedersen wrote: Kevin A. McGrail skrev den 2022-12-28 14:20: Do you have hashbl plugin enabled? read your quoted line again ? On 12/28/2022 8:17 AM, Benny Pedersen wrote: above is with onl

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Benny Pedersen
Kevin A. McGrail skrev den 2022-12-28 14:20: Do you have hashbl plugin enabled? read your quoted line again ? On 12/28/2022 8:17 AM, Benny Pedersen wrote: above is with only check plugin enabled, this should lint without warnings

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Kevin A. McGrail
Do you have hashbl plugin enabled? On 12/28/2022 8:17 AM, Benny Pedersen wrote: above is with only check plugin enabled, this should lint without warnings -- Kevin A. McGrail kmcgr...@apache.org Member, Apache Software Foundation Chair Emeritus Apache SpamAssassin Project https://www.linked

Re: DQS rules for SA 4.0.0+

2022-12-28 Thread Benny Pedersen
Riccardo Alfieri skrev den 2022-12-28 11:44: Hello everyone, just FYI, I published the updated rules to have DQS working on SA 4.0.0+ (https://github.com/spamhaus/spamassassin-dqs) Thanks to the effort of all SA developers there is no need anymore to install a dedicated plugin, as all of our

DQS rules for SA 4.0.0+

2022-12-28 Thread Riccardo Alfieri
Hello everyone, just FYI, I published the updated rules to have DQS working on SA 4.0.0+ (https://github.com/spamhaus/spamassassin-dqs) Thanks to the effort of all SA developers there is no need anymore to install a dedicated plugin, as all of our functions have been backported in SA's

RedHat Rules in RPM discussion was Re: [ANNOUNCE] Apache SpamAssassin 4.0.0 available

2022-12-20 Thread Kevin A. McGrail
The SpamAssassin has published a rules file for eons along with releases, e.g. the bolded part of the release: Released version, 4.0.0     SpamAssassin in tar.gz format. (signatures: GPG SHA-256 SHA-512)     SpamAssassin in tar.bz2 format. (signatures: GPG SHA-256 SHA-512)     SpamAssassin in

  1   2   3   4   5   6   7   8   9   10   >