Re: SpamAssassin Suddenly Not Catching Spam

2005-04-13 Thread Marisabel Rodríguez
Thanks a lot! M. [EMAIL PROTECTED] wrote: In an older episode (Wednesday 13 April 2005 20:47), Marisabel Rodríguez wrote: Hello, how can I do for unsubscribe me? the headers of each mail that i receive from this list contain the line: list-unsubscribe:

Re: SpamAssassin Suddenly Not Catching Spam

2005-04-13 Thread Matt Kettler
Marisabel Rodríguez wrote: > Hello, > how can I do for unsubscribe me? > I searched in the site but I didn´t find anything. > Best regards, > M. Try reading the message headers for any message on the list: list-unsubscribe: This is the RFC complaint way to advertise

Re: SpamAssassin Suddenly Not Catching Spam

2005-04-13 Thread mewolf1
In an older episode (Wednesday 13 April 2005 20:47), Marisabel Rodríguez wrote: > Hello, > how can I do for unsubscribe me? the headers of each mail that i receive from this list contain the line: list-unsubscribe:

Re: SpamAssassin Suddenly Not Catching Spam

2005-04-13 Thread Marisabel Rodríguez
Hello, how can I do for unsubscribe me? I searched in the site but I didn´t find anything. Best regards, M. Vivek Khera wrote: On Apr 13, 2005, at 2:25 PM, Matt Kettler wrote: Besides, it's also easy for spam to get a "real" SPF_PASS. Just export a record for spammerdomain.com which passes everythi

Re: SpamAssassin Suddenly Not Catching Spam

2005-04-13 Thread Vivek Khera
On Apr 13, 2005, at 2:25 PM, Matt Kettler wrote: Besides, it's also easy for spam to get a "real" SPF_PASS. Just export a record for spammerdomain.com which passes everything. Funny thing is that I *literally* could do that if I wanted to... But I don't... we don't accept mail for spammerdomain.

Re: SpamAssassin Suddenly Not Catching Spam

2005-04-13 Thread Matt Kettler
Loren Wilton wrote: > >SPF_HELO_PASS, > >This might well be a negative scoring rule. Spam usually shouldn't be able >to get an SPF_PASS rating. > Dude... SPF_HELO_PASS is an informational rule ONLY. It's there to act as a debugging aid to an admin using SPF for the first time. This rule based o

Re: SpamAssassin Suddenly Not Catching Spam

2005-04-13 Thread Kelson
Loren Wilton wrote: SPF_HELO_PASS, This might well be a negative scoring rule. Spam usually shouldn't be able to get an SPF_PASS rating. It can easily get one if it's sent *from the spammer's own domain* and they set up SPF records for it. Remember, SPF and Domain Keys are *anti-forgery* technol

Re: SpamAssassin Suddenly Not Catching Spam

2005-04-13 Thread Kevin Peuhkurinen
Loren Wilton wrote: 1. Why did it get SPF_PASS if it is spam? Nice analysis, Loren. The only nit-pick I would make is that many spammers have valid SPF records set up, usually I believe "v=spf1 +all". A quick grep through my last 4000 spams shows 345 with SPF_PASS hits. That is actually

Re: SpamAssassin Suddenly Not Catching Spam

2005-04-13 Thread Loren Wilton
> I assume that "negatively-scored" means that it is less likely to be spam, > correct? Yes. Specifically it means a rule with a negative score value. High positive scores (over some threshold value, usually 5.0) indicate spam. This score is usually an accumulation of smaller score values from va

Re: SpamAssassin Suddenly Not Catching Spam

2005-04-13 Thread Loren Wilton
> A few days ago I suddenly started having spam get through just like the bad > days prior to my upgrade. Is there some way for me to figure out why SA is > not doing its thing for me? Always ask: what changed? Probably the rules because you are using RDJ, in this case. HOW OFTEN are you callin

Re: SpamAssassin Suddenly Not Catching Spam

2005-04-12 Thread Jake Colman
> "MK" == Matt Kettler <[EMAIL PROTECTED]> writes: MK> Yes, that's exactly what he wants you to look at. You can match up all MK> those tests names with scores by greping in 50_scores.cf. Since you have MK> bayes and network checks in use, it will be using the last score in each MK

Re: SpamAssassin Suddenly Not Catching Spam

2005-04-12 Thread Matt Kettler
Jake Colman wrote: >Forgive my ignorance... > >I assume that "negatively-scored" means that it is less likely to be spam, >correct? > >Here is an example of a message that should have been flagged: > >X-Spam-Status: No, score=4.7 required=5.0 tests=BAYES_50,HTML_10_20, >HTML_MESSAGE,MIME_HTML_ONLY

Re: SpamAssassin Suddenly Not Catching Spam

2005-04-12 Thread Jake Colman
Forgive my ignorance... I assume that "negatively-scored" means that it is less likely to be spam, correct? Here is an example of a message that should have been flagged: X-Spam-Status: No, score=4.7 required=5.0 tests=BAYES_50,HTML_10_20, HTML_MESSAGE,MIME_HTML_ONLY,RAZOR2_CF_RANGE_51_100,RAZO

Re: SpamAssassin Suddenly Not Catching Spam

2005-04-12 Thread Kevin Peuhkurinen
You can begin by looking at the headers of false negatives and see what rules they are hitting. Are they hitting any negatively-scored rules? Jake Colman wrote: I upgraded from SA 2.x to 3.x a few weeks ago. I also installed the Rules Du Jour script for maintaining SARE files. After doing a

SpamAssassin Suddenly Not Catching Spam

2005-04-12 Thread Jake Colman
I upgraded from SA 2.x to 3.x a few weeks ago. I also installed the Rules Du Jour script for maintaining SARE files. After doing all this the amount of spam caught by SA increased dramatically. All was well. A few days ago I suddenly started having spam get through just like the bad days prior