Re: Single dot PTR

2010-12-29 Thread mouss
Le 29/12/2010 16:54, Jason Bertoch a écrit : > > I'm starting to see a (new to me) pattern of spam, and only spam, with > PTR records consisting of a single dot, such as: > > Received: from ejru38.pindmosel.info (. [184.154.78.38] (may be forged)) I used to block these and others in postfix: pc

Re: Single dot PTR

2010-12-29 Thread Jason Bertoch
On 2010/12/29 11:55 AM, Benny Pedersen wrote: On ons 29 dec 2010 17:29:05 CET, Jason Bertoch wrote In the sited example, yes, the PTR is set by the ISP and not delegated to the spammer, but a pattern is a pattern and that's what we're here for. Plus, for all we know, the ISP has a web interface

Re: Single dot PTR

2010-12-29 Thread Jason Bertoch
On 2010/12/29 11:42 AM, Adam Moffett wrote: In the sited example, yes, the PTR is set by the ISP and not delegated to the spammer, but a pattern is a pattern and that's what we're here for. Plus, for all we know, the ISP has a web interface for setting PTR records rather than using delegation.

Re: Single dot PTR

2010-12-29 Thread Benny Pedersen
On ons 29 dec 2010 17:29:05 CET, Jason Bertoch wrote In the sited example, yes, the PTR is set by the ISP and not delegated to the spammer, but a pattern is a pattern and that's what we're here for. Plus, for all we know, the ISP has a web interface for setting PTR records rather than using

Re: Single dot PTR

2010-12-29 Thread Jason Bertoch
On 2010/12/29 11:24 AM, Adam Moffett wrote: The PTR is set by the ISP, not the spammer. My guess would be that the period for a PTR would be a policy of a particular network operator or group of operators. So matching it in spam assassin would be scoring messages on the ISP they came from rathe

Re: Single dot PTR

2010-12-29 Thread Adam Moffett
The PTR is set by the ISP, not the spammer. My guess would be that the period for a PTR would be a policy of a particular network operator or group of operators. So matching it in spam assassin would be scoring messages on the ISP they came from rather than their spaminess. I'm starting

Single dot PTR

2010-12-29 Thread Jason Bertoch
I'm starting to see a (new to me) pattern of spam, and only spam, with PTR records consisting of a single dot, such as: Received: from ejru38.pindmosel.info (. [184.154.78.38] (may be forged)) It doesn't appear that there is a stock rule yet to identify this particular case. RDNS_NONE match