Re: dealing with mail not yet listed in network tests

2014-12-20 Thread listsb-spamassassin
> On Nov 14, 2014, at 11.41, Reindl Harald wrote: > > Am 14.11.2014 um 17:11 schrieb listsb-spamassas...@bitrate.net: >> one characteristic that appears to be pretty consistent is the age of the >> domain name that a given message references [from header, envelope sender, >> ptr record for rem

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread Matus UHLAR - fantomas
On Fri, 14 Nov 2014, Miles Fidelman wrote: Actually, the OPs notion is an interesting one. From the point of view of someone who administers a lot of systems and mailing lists, I end up getting multiple copies of lots of messages. I've been thinking for a while about how to implement anti-s

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread David F. Skoll
On Fri, 14 Nov 2014 18:24:05 +0100 Matus UHLAR - fantomas wrote: > >I have an experimental botnet detector that looks for multiple > >messages with similar subjects that come from many different > >countries (as determined by geolocating the relay IP.) > isn't this what DCC is about? Similar id

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread John Hardin
On Fri, 14 Nov 2014, listsb-spamassas...@bitrate.net wrote: one characteristic that appears to be pretty consistent is the age of the domain name that a given message references [from header, envelope sender, ptr record for remote mailservers referenced in received headers, etc]. quite often,

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread John Hardin
On Fri, 14 Nov 2014, Miles Fidelman wrote: Actually, the OPs notion is an interesting one. From the point of view of someone who administers a lot of systems and mailing lists, I end up getting multiple copies of lots of messages. I've been thinking for a while about how to implement anti-sp

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread John Hardin
On Fri, 14 Nov 2014, Reindl Harald wrote: if they would have that much ressources postscreen even without RBL's would not be that effective because they don't wait until their turn to speak most of the time and so have no chance for delivery - the 13407 pregreets this month are "hurry up i hav

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread Matus UHLAR - fantomas
On Fri, 14 Nov 2014 07:45:49 -0500 Miles Fidelman wrote: From the point of view of someone who administers a lot of systems and mailing lists, I end up getting multiple copies of lots of messages. I've been thinking for a while about how to implement anti-spam rules based on receiving multiple

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread Reindl Harald
Am 14.11.2014 um 17:11 schrieb listsb-spamassas...@bitrate.net: one characteristic that appears to be pretty consistent is the age of the domain name that a given message references [from header, envelope sender, ptr record for remote mailservers referenced in received headers, etc]. quite

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread listsb-spamassassin
> On Nov 14, 2014, at 00.35, John Hardin wrote: > > On Thu, 13 Nov 2014, listsb-spamassas...@bitrate.net wrote: > >> all of the emotional postulative opining aside, one possibility i have been >> considering is having postfix delay relay of messages to the content filter >> for a few minutes,

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread David F. Skoll
On Fri, 14 Nov 2014 14:58:46 +0100 Reindl Harald wrote: [David] > > I don't agree with that contention. Botnet operators have so many > > resources at their disposal that I doubt they care about or even > > notice any sort of delaying or tarpitting. [Harald] > they don't because they have not m

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread Reindl Harald
Am 14.11.2014 um 14:43 schrieb David F. Skoll: On Fri, 14 Nov 2014 13:35:34 +0100 Reindl Harald wrote: *but* it makes a ton of troubles for large *legit* sending clusters which often after a 4xx reject handover that mail to a different node and so get again a 4xx With very little loss of e

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread David F. Skoll
On Fri, 14 Nov 2014 13:35:34 +0100 Reindl Harald wrote: > *but* it makes a ton of troubles for large *legit* sending clusters > which often after a 4xx reject handover that mail to a different node > and so get again a 4xx With very little loss of effectiveness, you can modify the algorithm so

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread David F. Skoll
On Fri, 14 Nov 2014 07:45:49 -0500 Miles Fidelman wrote: > From the point of view of someone who administers a lot of systems > and mailing lists, I end up getting multiple copies of lots of > messages. I've been thinking for a while about how to implement > anti-spam rules based on receiving mu

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread Miles Fidelman
Actually, the OPs notion is an interesting one. From the point of view of someone who administers a lot of systems and mailing lists, I end up getting multiple copies of lots of messages. I've been thinking for a while about how to implement anti-spam rules based on receiving multiple copies

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread Reindl Harald
Am 14.11.2014 um 13:04 schrieb David F. Skoll: On Fri, 14 Nov 2014 08:39:13 +0100 Matthias Leisi wrote: On Fri, Nov 14, 2014 at 6:35 AM, John Hardin wrote: if you're in a business environment you may have an uphill battle with managing expectations, to wit: email is *not* intended to be i

Re: dealing with mail not yet listed in network tests

2014-11-14 Thread David F. Skoll
On Fri, 14 Nov 2014 08:39:13 +0100 Matthias Leisi wrote: > On Fri, Nov 14, 2014 at 6:35 AM, John Hardin > wrote: > > if you're in a business environment you may have an uphill battle > > with managing expectations, to wit: email is *not* intended to be > > instant messaging - and may run up aga

Re: dealing with mail not yet listed in network tests

2014-11-13 Thread Matthias Leisi
On Fri, Nov 14, 2014 at 6:35 AM, John Hardin wrote: > if you're in a business environment you may have an uphill battle with > managing expectations, to wit: email is *not* intended to be instant > messaging - and may run up against the brick wall of management not being > willing to delay email

Re: dealing with mail not yet listed in network tests

2014-11-13 Thread John Hardin
On Thu, 13 Nov 2014, listsb-spamassas...@bitrate.net wrote: all of the emotional postulative opining aside, one possibility i have been considering is having postfix delay relay of messages to the content filter for a few minutes, as it seems that when these messages reach us, they're only min

dealing with mail not yet listed in network tests

2014-11-13 Thread listsb-spamassassin
hi- i've recently asked about essentially this same topic on the postfix-users mailing list, so apologies to those subjected to the repetition. the topic came up for me a couple of weeks ago when i asked about duplicate spam that was scoring low the first time it was received: https://mail-arc