On Wed, 28 Nov 2018 at 10:36, Brent Clark wrote:
> Sorry if I can just add, maybe the documentation can be updated?
>
> https://wiki.apache.org/spamassassin/RelayCountryPlugin
I think the documentation is fine, the example with the hat/circumflex has
describe text 'First untrusted relay is...'.
d. Maybe this is the problem? Try using:
header RELAYCOUNTRY_BAD X-Relay-Countries =~ /(CN|RU|SU|IN|BR|UA|KR)/
I use a similar header match string (but with GeoIP2 database, not the
old GeoIP) and it seems to work fine.
://pastebin.com/sh8S10ph
You use a hat ^ so that only the first (or ?last) relay server's country
is matched. Maybe this is the problem? Try using:
header RELAYCOUNTRY_BAD X-Relay-Countries =~ /(CN|RU|SU|IN|BR|UA|KR)/
I use a similar header match string (but with GeoIP2 database, not the
old GeoIP) and it seems to work fine.
ast' version ...")
>
> It looks like KR is getting found but if you look at the pastebin below,
> it does not display RELAYCOUNTRY
>
> https://pastebin.com/sh8S10ph
You use a hat ^ so that only the first (or ?last) relay server's country is
matched. Maybe this is
:RelayCountry', is not picking up Korea.
>>>
>>> https://pastebin.com/i45KsgVk
>> Try running it through
>> spamassassin -D metadata 1>/dev/null
>> and look for debug about what database type is being used. I've found
>> that the plugin will
that the plugin will fallback to the 'fast' version if anything is
wrong and it only shows up in detailed debug.
header RELAYCOUNTRY_BAD X-Relay-Countries
=~ /^(CN|RU|SU|IN|BR|UA|KR)/ describe RELAYCOUNTRY_BAD Relayed
through foreign countries scoreRELAYCOUNTRY_BAD 1.0
add_header all
t through
spamassassin -D metadata 1>/dev/null
and look for debug about what database type is being used. I've found
that the plugin will fallback to the 'fast' version if anything is
wrong and it only shows up in detailed debug.
>
> header RELAYCOUNTRY_BAD X-Rel
On 27.11.18 12:51, Brent Clark wrote:
I have the following spam email, and I picked up that the plugin
'Mail::SpamAssassin::Plugin::RelayCountry', is not picking up Korea.
https://pastebin.com/i45KsgVk
header RELAYCOUNTRY_BAD X-Relay-Countries =~ /^(CN|RU|SU|IN|BR|UA|KR)
Good day Guys
I have the following spam email, and I picked up that the plugin
'Mail::SpamAssassin::Plugin::RelayCountry', is not picking up Korea.
https://pastebin.com/i45KsgVk
header RELAYCOUNTRY_BAD X-Relay-Countries =~ /^(CN|RU|SU|IN|BR|UA|KR)/
describe RELAYCOUNTRY_BAD Relay
On Wednesday March 6 2013 01:06:22 Scott Ostrander wrote:
> cd /usr/share/GeoIP
> wget -N
http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz
> gunzip GeoIP.dat.gz
Not to forget to download its IPv6 counterpart:
http://geolite.maxmind.com/download/geoip/database/Ge
> -Original Message-
> Sent: Tuesday, March 05, 2013 3:13 PM
> To: Scott Ostrander; Benny Pedersen; spamassassin
> Subject: Re: X-Relay-Countries on 3.3.2 vs 3.4
> >
> >
> > Is there a way to upgrade GeoIP ?
> I think you have to grab files from htt
On 3/5/13 2:15 PM, "Scott Ostrander" wrote:
>
>> From: Benny Pedersen [mailto:m...@junc.eu]
>>
>> Scott Ostrander skrev den 2013-03-05 20:22:
>>> On system A (SA 3.4) I am getting RELAY_COUNTRY_XX Same email on
>>> system B (SA 3.2.2) I get RELAY_COUNTRY_ES correctly resolved.
>>
>> ip2cc 2.1
Lutz Petersen skrev den 2013-03-05 21:44:
Simple question: If there is a need for locate the ip - why not use
the
well maintained countries.nerd.dk ?
one dns lookup pr sender recieved ip ?
i like to keep this trafic local, and nerd.dk have rsync shareing last
time i did it, but did not like
Scott Ostrander skrev den 2013-03-05 21:40:
On system A (SA 3.4) I removed Geo::IP and it now correctly resolves
the Relay-Country as ES
Looks like I will have to keep manually updating IP::Country::Fast
;(
[I] dev-libs/geoip
Available versions: 1.4.8-r1 1.4.8-r2 ~1.4.8-r3 {{city ipv6
> > ip::country::fast is depricated alone since its not update with new ips, it
> > still
> > works if your still have ipv4 mailserver and self do updates with dbmscript
>
> On system A (SA 3.4) I removed Geo::IP and it now correctly resolves the
> Relay-Country as ES
> Looks like I will have t
> -Original Message-
> Sent: Tuesday, March 05, 2013 12:37 PM
> To: users@spamassassin.apache.org
> Subject: RE: X-Relay-Countries on 3.3.2 vs 3.4
>
> Scott Ostrander skrev den 2013-03-05 21:15:
>
> plase fix your reply template, replyed sender email should
Scott Ostrander skrev den 2013-03-05 21:15:
From: Benny Pedersen [mailto:m...@junc.eu]
plase fix your reply template, replyed sender email should not be in
body content
However system A (3.4) also has GeoIP installed as suggested at
http://wiki.apache.org/spamassassin/RelayCountryPlugin
Is
> From: Benny Pedersen [mailto:m...@junc.eu]
>
> Scott Ostrander skrev den 2013-03-05 20:22:
> > On system A (SA 3.4) I am getting RELAY_COUNTRY_XX Same email on
> > system B (SA 3.2.2) I get RELAY_COUNTRY_ES correctly resolved.
>
> ip2cc 2.104.223.10
>
> if not found you need updates
>
> X
Scott Ostrander skrev den 2013-03-05 20:22:
On system A (SA 3.4) I am getting RELAY_COUNTRY_XX
Same email on system B (SA 3.2.2) I get RELAY_COUNTRY_ES correctly
resolved.
ip2cc 2.104.223.10
if not found you need updates
XX is imho ip is not in use
On system A (SA 3.4) I am getting RELAY_COUNTRY_XX
Same email on system B (SA 3.2.2) I get RELAY_COUNTRY_ES correctly resolved.
System A is
Centos6
SA 3.4.0-r1435395
perl-Geo-IP-1.38-6
perl-IP-Country-2.27-1 With updated cc.gif and ip.gif from
http://mailfud.org/ip-country-fast/
System A is wo
On Mon, Feb 18, 2013 at 07:18:17AM -0600, Daniel McDonald wrote:
> On 2/16/13 8:10 AM, "Henrik K" wrote:
>
> > Well I updated http://mailfud.org/ip-country-fast/ for the last time..
> > (no, you don't need the authorities gifs)
> >
> > There is no excuse not using SpamAssassin 3.4 with Geo::IP s
On 2/16/13 8:10 AM, "Henrik K" wrote:
> Well I updated http://mailfud.org/ip-country-fast/ for the last time..
> (no, you don't need the authorities gifs)
>
> There is no excuse not using SpamAssassin 3.4 with Geo::IP support (also
> ipv6 works). Like the wiki says.
45 open bugs targeted for t
On Sat, Feb 16, 2013 at 12:21:55PM +0100, Benny Pedersen wrote:
> Walter Hurry skrev den 2013-02-15 19:59:
>
> >So I have up-to-date ip.gif and cc.gif. If anyone wants them, post
> >here
> >and I'll put them on an ftp site somewhere.
>
> nope its faster to get 4GB ram and build localy, and its cr
Walter Hurry skrev den 2013-02-15 19:59:
So I have up-to-date ip.gif and cc.gif. If anyone wants them, post
here
and I'll put them on an ftp site somewhere.
nope its faster to get 4GB ram and build localy, and its creates 4 gif
files not just 2 as in the wiki says, this plugin is ok for ipv4
On Thu, 14 Feb 2013 13:26:33 +0100, Benny Pedersen wrote:
> Steve Freegard skrev den 2013-02-12 21:19:
>
>> header RELAY_NOT_US X-Relay-Countries =~ /\b(?!US)[A-Z]{2}\b/
>
> and what date is the database from ?, ip2cc ipv4-addr, to show it when
> its build, to upd
On Thu, 14 Feb 2013 12:21:33 +
Ned Slider wrote:
> Nice idea, but why not just use SPF for fedex.com as they bother to
> publish an SPF record? Surely that has to be a far more reliable
> indicator it wasn't sent from fedex?
That works if the envelope sender is someth...@fedex.com, but if
On 2/14/13 6:21 AM, "Ned Slider" wrote:
> On 12/02/13 20:33, Daniel McDonald wrote:
>>
>> On 2/12/13 1:15 PM, "David F. Skoll" wrote:
>>
>>>
>>> PS: Beware of penalizing other countries too much. My mail originates
>>> from Canada and the PostgreSQL mailing list is (or used to be?) hosted
>>
Steve Freegard skrev den 2013-02-12 21:19:
header RELAY_NOT_US X-Relay-Countries =~ /\b(?!US)[A-Z]{2}\b/
and what date is the database from ?, ip2cc ipv4-addr, to show it when
its build, to update it either use the new relay_country plugin or
update ip2cc database, if its over 6
On 12/02/13 20:33, Daniel McDonald wrote:
On 2/12/13 1:15 PM, "David F. Skoll" wrote:
PS: Beware of penalizing other countries too much. My mail originates
from Canada and the PostgreSQL mailing list is (or used to be?) hosted
in Panama. Furthermore, by far the lion's share of spam origina
From: Mike Grau
Date: Tue, 12 Feb 2013 14:18:33 -0600
> Hmm I would do something like this (untested):
>
> header RELAY_NOT_US X-Relay-Countries =~ /\b(?!US)[A-Z]{2}\b/
I've had to use, IIRC.
X-Relay-Countries =~ /\b(?!US|XX)([A-Z]{2})\b/
XX
On 2/12/13 1:15 PM, "David F. Skoll" wrote:
> On Tue, 12 Feb 2013 14:14:46 -0500
> "David F. Skoll" wrote:
>
>> header RELAY_NOT_US X-Relay-Countries =~
>> /\b(?:[A-TW-Z][A-Z]|[A-Z][A-RT-Z])\b/
>
> Emm... should be
>
> header RELAY_NO
On 12/02/13 18:47, Daniel McDonald wrote:
I’ve had a simple rule I use to see if mail is forwarded through a
“foreign country”:
header RELAY_NOT_USX-Relay-Countries =~
/\b(?:[ABCDEFGHIJKLMNOPQRTVWXYZ]{2}|\b/
describeRELAY_NOT_USRelayed though any country other than the
>
> Hmm I would do something like this (untested):
>
> header RELAY_NOT_US X-Relay-Countries =~ /\b(?!US)[A-Z]{2}\b/
>
I've had to use, IIRC.
X-Relay-Countries =~ /\b(?!US|XX)([A-Z]{2})\b/
On 2/12/2013 3:00 PM, David F. Skoll wrote:
On Tue, 12 Feb 2013 19:57:28 +
Martin Gregorie wrote:
header RELAY_NOT_US X-Relay-Countries=~ /\b(?:[A-TV-Z][A-RT-Z])\b/
No. We leave it as an exercise to the reader to find out why that
solution is wrong.
Hmm I would do something like
On Tue, 12 Feb 2013 19:57:28 +
Martin Gregorie wrote:
> header RELAY_NOT_US X-Relay-Countries=~ /\b(?:[A-TV-Z][A-RT-Z])\b/
No. We leave it as an exercise to the reader to find out why that
solution is wrong.
Regards,
David.
On Tue, 2013-02-12 at 14:15 -0500, David F. Skoll wrote:
> header RELAY_NOT_US X-Relay-Countries =~ /\b(?:[A-TV-Z][A-Z]|[A-Z][A-RT-Z])\b/
>
Shouldn't that be:
header RELAY_NOT_US X-Relay-Countries=~ /\b(?:[A-TV-Z][A-RT-Z])\b/
> of course. Sorry!
>
BTW, its no wonder so muc
On Tue, 12 Feb 2013 14:14:46 -0500
"David F. Skoll" wrote:
> header RELAY_NOT_US X-Relay-Countries =~ /\b(?:[A-TW-Z][A-Z]|[A-Z][A-RT-Z])\b/
Emm... should be
header RELAY_NOT_US X-Relay-Countries =~ /\b(?:[A-TV-Z][A-Z]|[A-Z][A-RT-Z])\b/
of course. Sorry!
Regards,
David.
On Tue, 12 Feb 2013 12:58:40 -0600
Daniel McDonald wrote:
> header RELAY_NOT_US X-Relay-Countries =~ /\b[ABCDEFGHIJKLMNOPQRTVWXYZ]{2}\b/
How about:
header RELAY_NOT_US X-Relay-Countries =~ /\b(?:[A-TW-Z][A-Z]|[A-Z][A-RT-Z])\b/
Untested; use at your own risk. :)
Regards,
David.
PS: Bew
On 2/12/13 12:47 PM, "Daniel McDonald"
wrote:
> I¹ve had a simple rule I use to see if mail is forwarded through a ³foreign
> country²:
>
> header RELAY_NOT_USX-Relay-Countries =~
> /\b(?:[ABCDEFGHIJKLMNOPQRTVWXYZ]{2}|\b/
Oops. I was fiddling with th
I¹ve had a simple rule I use to see if mail is forwarded through a ³foreign
country²:
header RELAY_NOT_USX-Relay-Countries =~
/\b(?:[ABCDEFGHIJKLMNOPQRTVWXYZ]{2}|\b/
describeRELAY_NOT_USRelayed though any country other than the US
score RELAY_NOT_US0.01
I
On Fri, 12 Feb 2010 19:32:00 -0600
Robert Nicholson wrote:
> Perhaps my confusion lies in the fact that it looks like headers !=
> metadata?
>
> Is there a way or setting that allows metadata to result in headers
> in the message?
>
add_header all Relay-Countries _RELAYCOUNTRY
From: Robert Nicholson
Date: Fri, 12 Feb 2010 19:32:00 -0600
Perhaps my confusion lies in the fact that it looks like headers != metadata?
Is there a way or setting that allows metadata to result in headers in the
message?
Did you try add_header?
ifplugin Mail::SpamAssassin:
Perhaps my confusion lies in the fact that it looks like headers != metadata?
Is there a way or setting that allows metadata to result in headers in the
message?
On Feb 12, 2010, at 7:24 PM, Robert Nicholson wrote:
> Is there anyway to get his header to stick rather than one looks like now
> w
For instance when I run my test I see
Feb 12 17:20:38.634 [16073] dbg: metadata: X-Relay-Countries: RU
Feb 12 17:20:38.634 [16073] dbg: message: MIME PARSER START
Feb 12 17:20:38.635 [16073] dbg: message: parsing normal part
Feb 12 17:20:38.635 [16073] dbg: message: MIME PARSER END
Is there anyway to get his header to stick rather than one looks like now where
it is removed during check presumably after Bayes has been able to do it's
thing?
I have no problem with the header staying on my Spam messages.
45 matches
Mail list logo
