Re: dkim-test valid but spamassassin scores DKIM_INVALID

2023-10-25 Thread Niels Kobschätzki
> Matus UHLAR - fantomas hat am 25.10.2023 16:11 CEST > geschrieben: > > > >Matus UHLAR - fantomas skrev den 2023-10-25 09:36: > >>I have: > >>50_scores.cf:score DKIM_VALID -0.1 > >> > >>check if you really haven't set score for DKIM_VALID anywhere, since > >>SA complains about it being zero.

Re: dkim-test valid but spamassassin scores DKIM_INVALID

2023-10-25 Thread Matus UHLAR - fantomas
Matus UHLAR - fantomas skrev den 2023-10-25 09:36: I have: 50_scores.cf:score DKIM_VALID -0.1 check if you really haven't set score for DKIM_VALID anywhere, since SA complains about it being zero. I guess this may cause DKIM_INVALID misfiring On 25.10.23 13:08, Benny Pedersen wrote: imho n

Re: dkim-test valid but spamassassin scores DKIM_INVALID

2023-10-25 Thread Benny Pedersen
Matus UHLAR - fantomas skrev den 2023-10-25 09:36: I have: 50_scores.cf:score DKIM_VALID -0.1 check if you really haven't set score for DKIM_VALID anywhere, since SA complains about it being zero. I guess this may cause DKIM_INVALID misfiring imho no, DKIM_INVALID have 0.1 in score, both s

Re: dkim-test valid but spamassassin scores DKIM_INVALID

2023-10-25 Thread Benny Pedersen
jdow skrev den 2023-10-25 09:07: Methinks you have here a very good clue to set a non-zero value, perhaps (most likely), a modest negative score. change of that score is a fail on its own use welcomelist_from_dkim instaed

Re: dkim-test valid but spamassassin scores DKIM_INVALID

2023-10-25 Thread Benny Pedersen
Niels Kobschätzki skrev den 2023-10-25 08:46: did you set score of DKIM_VALID do 0 ? DKIM_VALID is not overwritten by any of my local rules. So I would expect that this is the case. But even if I set for example score DKIM_VALID 0 in local.cf there is no change rules is loaded in sequence

Re: dkim-test valid but spamassassin scores DKIM_INVALID

2023-10-25 Thread Matus UHLAR - fantomas
On 25.10.23 07:21, Niels Kobschätzki wrote: >I'm having here a mail that scores as DKIM_INVALID. I tried sending the > same mail to gmail for example and it tells me that DKIM is valid. Now I > put it through "spamassassin -D" and I am even more baffled because the &

Re: dkim-test valid but spamassassin scores DKIM_INVALID

2023-10-25 Thread jdow
On 20231024 23:46:18, Niels Kobschätzki wrote: Matus UHLAR - fantomas hat am 25.10.2023 08:16 CEST geschrieben: On 25.10.23 07:21, Niels Kobschätzki wrote: I'm having here a mail that scores as DKIM_INVALID. I tried sending the same mail to gmail for example and it tells me that DK

Re: dkim-test valid but spamassassin scores DKIM_INVALID

2023-10-24 Thread Niels Kobschätzki
> Matus UHLAR - fantomas hat am 25.10.2023 08:16 CEST > geschrieben: > > > On 25.10.23 07:21, Niels Kobschätzki wrote: > >I'm having here a mail that scores as DKIM_INVALID. I tried sending the > > same mail to gmail for example and it tells me that DKIM is v

Re: dkim-test valid but spamassassin scores DKIM_INVALID

2023-10-24 Thread Matus UHLAR - fantomas
On 25.10.23 07:21, Niels Kobschätzki wrote: I'm having here a mail that scores as DKIM_INVALID. I tried sending the same mail to gmail for example and it tells me that DKIM is valid. Now I put it through "spamassassin -D" and I am even more baffled because the debug seems to s

dkim-test valid but spamassassin scores DKIM_INVALID

2023-10-24 Thread Niels Kobschätzki
Hi, I'm having here a mail that scores as DKIM_INVALID. I tried sending the same mail to gmail for example and it tells me that DKIM is valid. Now I put it through "spamassassin -D" and I am even more baffled because the debug seems to say that DKIM is valid but then scores

Re: BAYES scores

2023-03-01 Thread Benny Pedersen
joe a skrev den 2023-02-28 17:37: Curious as to why these scores, apparently "stock" are what they are. I'd expect BAYES_999 BODY to count more than BAYES_99 BODY. Noted in a header this morning: * 3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100% * [score: 1.] *

Re: BAYES scores

2023-02-28 Thread Loren Wilton
From: "Bill Cole" It is my understanding that an automated rescoring job was run quite some time ago (before I was on the PMC) to generate the Bayes scores, which determined that to be the best supplemental score to give to the greater certainty. I was around in those days. My me

Re: BAYES scores

2023-02-28 Thread Benny Pedersen
joe a skrev den 2023-02-28 17:37: Curious as to why these scores, apparently "stock" are what they are. I'd expect BAYES_999 BODY to count more than BAYES_99 BODY. Noted in a header this morning: * 3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100% * [score: 1.] *

Re: BAYES scores

2023-02-28 Thread Bill Cole
On 2023-02-28 at 13:38:35 UTC-0500 (Tue, 28 Feb 2023 13:38:35 -0500) joe a is rumored to have said: On 2/28/2023 12:05 PM, Jeff Mincy wrote: > From: joe a > Date: Tue, 28 Feb 2023 11:37:34 -0500 > > Curious as to why these scores, apparently "stock" are wh

Re: BAYES scores

2023-02-28 Thread hg user
> > > Date: Tue, 28 Feb 2023 11:37:34 -0500 > > > > > > Curious as to why these scores, apparently "stock" are what they are. > > > I'd expect BAYES_999 BODY to count more than BAYES_99 BODY. > > > > > > Noted in a

Re: BAYES scores

2023-02-28 Thread joe a
On 2/28/2023 12:05 PM, Jeff Mincy wrote: > From: joe a > Date: Tue, 28 Feb 2023 11:37:34 -0500 > > Curious as to why these scores, apparently "stock" are what they are. > I'd expect BAYES_999 BODY to count more than BAYES_99 BODY. > > Noted in a

Re: BAYES scores

2023-02-28 Thread Jeff Mincy
> From: joe a > Date: Tue, 28 Feb 2023 11:37:34 -0500 > > Curious as to why these scores, apparently "stock" are what they are. > I'd expect BAYES_999 BODY to count more than BAYES_99 BODY. > > Noted in a header this morning: > > * 3.5 BAYE

BAYES scores

2023-02-28 Thread joe a
Curious as to why these scores, apparently "stock" are what they are. I'd expect BAYES_999 BODY to count more than BAYES_99 BODY. Noted in a header this morning: * 3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100% * [score: 1.] * 0.2 BAYES_999 BODY: Bayes spam

Re: Spam with Pyzor and DCC scores

2022-07-11 Thread Benny Pedersen
On 2022-07-12 00:09, Bert Van de Poel wrote: We have Bayes running on the main server, but my own local server doesn't have it so hence why it's missing. I did however take all spam I received myself in 2022 that wasn't caught and fed it to sa-learn (for the amavis user), thx for that suggestion

Re: Spam with Pyzor and DCC scores

2022-07-11 Thread Bert Van de Poel
On 11/07/2022 15:44, Matus UHLAR - fantomas wrote: On 11.07.22 12:57, Bert Van de Poel wrote: A few times a month we have spam messages getting through, often in German, that have some spam score but not enough to be marked/discarded. Always these messages are marked by DCC, since they're of c

Re: Spam with Pyzor and DCC scores

2022-07-11 Thread Matus UHLAR - fantomas
On 11.07.22 12:57, Bert Van de Poel wrote: A few times a month we have spam messages getting through, often in German, that have some spam score but not enough to be marked/discarded. Always these messages are marked by DCC, since they're of course bulk spam, but it's also not uncommon to see P

Spam with Pyzor and DCC scores

2022-07-11 Thread Bert Van de Poel
Hi everyone, A few times a month we have spam messages getting through, often in German, that have some spam score but not enough to be marked/discarded. Always these messages are marked by DCC, since they're of course bulk spam, but it's also not uncommon to see Pyzor as well. I've been wond

Re: DKIM_* scores

2021-07-27 Thread John Hardin
On Mon, 26 Jul 2021, RW wrote: On Mon, 26 Jul 2021 18:05:35 +0100 RW wrote: "&& !DKIM_SIGNED " means the rule can only be true if there's no signature, so none of the terms with __DKIM_DEPENDABLE, DKIM_VALID, and DKIM_VALID_AU make any difference. Actually it's worse than that __DKIM_DEPEND

Re: DKIM_* scores

2021-07-27 Thread Matus UHLAR - fantomas
On Mon, 26 Jul 2021 08:08:10 -0400 Greg Troxel wrote: So -0.2 means that there are two dkim signatures, one for each, and they are both valid. On 26.07.21 18:05, RW wrote: It could do, but usually it just means that the sender and author domains are the same. > BTW, looking at metas in 72_a

Re: DKIM_* scores

2021-07-27 Thread Matus UHLAR - fantomas
On 26.07.21 08:40, Kevin A. McGrail wrote: Correct. The fact that there are some scores that add up to approximately -0.2 is negligible when compared to a standard threshold of 5.0. Do you have false positives being caused by these emails? Do you have false negatives? That's more importa

Re: DKIM_* scores

2021-07-26 Thread RW
On Mon, 26 Jul 2021 18:05:35 +0100 RW wrote: > "&& !DKIM_SIGNED " means the rule can only be true if there's no > signature, so none of the terms with __DKIM_DEPENDABLE, DKIM_VALID, > and DKIM_VALID_AU make any difference. Actually it's worse than that __DKIM_DEPENDABLE is always true if there

Re: DKIM_* scores

2021-07-26 Thread RW
On Mon, 26 Jul 2021 08:08:10 -0400 Greg Troxel wrote: > So -0.2 means that there are two dkim signatures, one for each, and > they are both valid. It could do, but usually it just means that the sender and author domains are the same. > > > BTW, looking at metas in 72_active.cf: > > > > m

Re: DKIM_* scores

2021-07-26 Thread Benny Pedersen
On 2021-07-26 14:40, Kevin A. McGrail wrote: Correct. The fact that there are some scores that add up to approximately -0.2 is negligible when compared to a standard threshold of 5.0. Do you have false positives being caused by these emails? Do you have false negatives? That's more importa

Re: DKIM_* scores

2021-07-26 Thread Kevin A. McGrail
Correct. The fact that there are some scores that add up to approximately -0.2 is negligible when compared to a standard threshold of 5.0. Do you have false positives being caused by these emails? Do you have false negatives? That's more important to look at then just focusing on one set of

Re: DKIM_* scores

2021-07-26 Thread Greg Troxel
Matus UHLAR - fantomas writes: > I noticed that pure existence of DKIM signature can push score under zero: > > DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, > > ...so the cumulative score is -0.2. > > I'm aware that we don't have many

DKIM_* scores

2021-07-26 Thread Matus UHLAR - fantomas
Hello, I noticed that pure existence of DKIM signature can push score under zero: DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ...so the cumulative score is -0.2. I'm aware that we don't have many rules with negative scores, but multiple scores for si

Re: Two different machines running same versoin of SA giving different scores for scores that are commented out

2021-04-25 Thread John Hardin
. The date is Jan 30, 2020. I'm running SA 3.4.4 (the version supplied by backports on my debian machine). Then sa-update is not running. Those scores are more than a year old. Fix that first. ...which you did. Ah, the hazards of answering as you read... The installs might be giving diff

Re: Two different machines running same versoin of SA giving different scores for scores that are commented out

2021-04-25 Thread John Hardin
ng SA 3.4.4 (the version supplied by backports on my debian machine). Then sa-update is not running. Those scores are more than a year old. Fix that first. The installs might be giving different scores for the same rule due to configuration differences - for example, one might have Bayes en

Re: Two different machines running same versoin of SA giving different scores for scores that are commented out

2021-04-25 Thread Steve Dondley
On 2021-04-25 10:19 AM, RW wrote: On Sun, 25 Apr 2021 00:40:59 -0400 Steve Dondley wrote: On both machines, /usr/share/spasmassassin/72_active.cf has this rule which is commented out: This is the legacy rule directory from before sa-update existed. Have you not got another directory popu

Re: Two different machines running same versoin of SA giving different scores for scores that are commented out

2021-04-25 Thread Steve Dondley
On 2021-04-25 05:57 AM, Reindl Harald wrote: Am 25.04.21 um 07:09 schrieb Steve Dondley: That rule has this line in the 72_active.cf file: Look in 72_scores.cf and compare the modification dates on that file. Their scores as of today (saturday): 72_scores.cf:score FSL_BULK_SIG

Re: Two different machines running same versoin of SA giving different scores for scores that are commented out

2021-04-25 Thread RW
On Sun, 25 Apr 2021 00:40:59 -0400 Steve Dondley wrote: > > On both machines, /usr/share/spasmassassin/72_active.cf has this rule > which is commented out: > This is the legacy rule directory from before sa-update existed. Have you not got another directory populated by sa-update?

Re: Two different machines running same versoin of SA giving different scores for scores that are commented out

2021-04-24 Thread Steve Dondley
On 2021-04-25 01:00 AM, John Hardin wrote: On Sun, 25 Apr 2021, Steve Dondley wrote: I'm running the same version of SA on the same email on two different machines and getting different scores in for some rules in the report: Machine A gives: 0.0 FSL_BULK_SIG Bulk signature wi

Re: Two different machines running same versoin of SA giving different scores for scores that are commented out

2021-04-24 Thread John Hardin
On Sun, 25 Apr 2021, Steve Dondley wrote: I'm running the same version of SA on the same email on two different machines and getting different scores in for some rules in the report: Machine A gives: 0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe Machine B gives

Two different machines running same versoin of SA giving different scores for scores that are commented out

2021-04-24 Thread Steve Dondley
I'm running the same version of SA on the same email on two different machines and getting different scores in for some rules in the report: Machine A gives: 0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe Machine B gives: 1.0 FSL_BULK_SIG Bulk signature wi

Re: Getting different SA scores when using -R argument with spamc

2021-04-06 Thread Steve Dondley
It can only do so if report_safe is set to 0. With non-zero report_safe settings, the original mail is encapsulated as an attachment inside a wrapper message also including the report. That wrapper message containing the SA report is "safe" because it is fully local, the text/plain part won't look

Re: Getting different SA scores when using -R argument with spamc

2021-04-06 Thread Bill Cole
's 1 now, by default. I use '0' because I overtly reject mail that SA scores over my threshold, while stashing a pristine copy in a 3-day message dumpster. The best choice depends on how you handle messages that SA scores as spam after that determination, and who your users are. The def

Re: Getting different SA scores when using -R argument with spamc

2021-04-06 Thread Steve Dondley
On 2021-04-06 04:19 PM, Steve Dondley wrote: It seems to have done so. Thank you. Some MUAs have a "Reply to List" function that uses the List-Post header (and sometimes heuristics when that header is missing) to send replies only to a list itself. I've recently switched to Roundcube from gmai

Re: Getting different SA scores when using -R argument with spamc

2021-04-06 Thread Steve Dondley
Some MUAs have a "Reply to List" function that uses the List-Post header (and sometimes heuristics when that header is missing) to send replies only to a list itself. Ah! I see that option now under the little down arrow next to "Reply all". My day is made. Thanks!

Re: Getting different SA scores when using -R argument with spamc

2021-04-06 Thread Steve Dondley
It seems to have done so. Thank you. Some MUAs have a "Reply to List" function that uses the List-Post header (and sometimes heuristics when that header is missing) to send replies only to a list itself. I've recently switched to Roundcube from gmail. I didn't see that option but I think I'

Re: Getting different SA scores when using -R argument with spamc

2021-04-06 Thread Bill Cole
u. Some MUAs have a "Reply to List" function that uses the List-Post header (and sometimes heuristics when that header is missing) to send replies only to a list itself. Since the scores being added during delivery are much richer, detecting enough info to do SPF and DKIM analysis

Re: Getting different SA scores when using -R argument with spamc

2021-04-06 Thread Steve Dondley
hen I hi "reply all" it cc's the list and sends to you. When I hit just "reply" it only sends to you. I've manually deleted you from the "To" box and sending it directly to the list here. Hopefully that fixes things up. Since the scores being added during de

Re: Getting different SA scores when using -R argument with spamc

2021-04-06 Thread Steve Dondley
he list and sends to you. When I hit just "reply" it only sends to you. I've manually deleted you from the "To" box and sending it directly to the list here. Hopefully that fixes things up. Since the scores being added during delivery are much richer, detecting enoug

Re: Getting different SA scores when using -R argument with spamc

2021-04-06 Thread Bill Cole
finally dawned on me that the SA scores that appeared above the message body and below the headers when spamc was run without the -R option were SA scores embedded in the message by the postfix software and were not getting generated by spamc. But that doesn't change the fact tha

Re: Getting different SA scores when using -R argument with spamc

2021-04-06 Thread Steve Dondley
Can you provide a working example message AND the operative user prefs? OK, I was being very stupid. It finally dawned on me that the SA scores that appeared above the message body and below the headers when spamc was run without the -R option were SA scores embedded in the message by the

Re: Getting different SA scores when using -R argument with spamc

2021-04-06 Thread Bill Cole
On 6 Apr 2021, at 12:54, Steve Dondley wrote: When I run spamc without -R option like this: spamc -u some_user < some_email I get the following output: [...] However, when I run this command on the same email with the -R command to get the SA scores only like this: spamc -R

Getting different SA scores when using -R argument with spamc

2021-04-06 Thread Steve Dondley
t the SA scores only like this: spamc -R -u some_user < some_email I get this output: === 2.6/5.0 Spam detection software, running on the system "email.dondley.com", has NOT identified this incomin

Re: sa 3.4.4 'spamassassin' scores test message using local.cf; 'spamd' finds/reads local.cg, but 'spamc' of test msg fails to hit/score?

2020-06-10 Thread RW
On Tue, 9 Jun 2020 19:55:24 -0700 PGNet Dev wrote: > sorry, that's unclear > > spamc --help | egrep "config|socket|fallback|size|username|log-to" > -U, --socket path Connect to spamd via UNIX domain sockets. > -F, --config path Use this configuration file. > Try conn

Re: sa 3.4.4 'spamassassin' scores test message using local.cf; 'spamd' finds/reads local.cg, but 'spamc' of test msg fails to hit/score?

2020-06-09 Thread PGNet Dev
On 6/9/20 7:45 PM, PGNet Dev wrote: > RW Tue, 09 Jun 2020 17:15:49 -0700 > If you need this line you are doing something strange. always happy to simplify. rm'ing --configpath=/usr/local/etc/spamassassin \ from spamd launch, I still see ... Jun 09 19:44:41 dev.loc spamd

Re: sa 3.4.4 'spamassassin' scores test message using local.cf; 'spamd' finds/reads local.cg, but 'spamc' of test msg fails to hit/score?

2020-06-09 Thread RW
On Tue, 9 Jun 2020 16:27:01 -0700 PGNet Dev wrote: > next, launching 'spamd', > >--configpath=/usr/local/etc/spamassassin \ If you need this line you are doing something strange. You are overriding the default config location with the default site config location. There's not much th

sa 3.4.4 'spamassassin' scores test message using local.cf; 'spamd' finds/reads local.cg, but 'spamc' of test msg fails to hit/score?

2020-06-09 Thread PGNet Dev
I'm setting up a local/standalone instance spamd on linux lsb_release -rd Description:openSUSE Leap 15.1 Release:15.1 uname -rm 5.7.1-25.gc4df4ce-default x86_64 perl -v This is perl 5, version 2

Rules without scores

2020-03-06 Thread RW
There are some rules (listed below) that have no explicit scores and fall back on the default 1 point. ADMAIL ADVANCE_FEE_3_NEW_FORM ADVANCE_FEE_4_NEW ADVANCE_FEE_4_NEW_FRM_MNY CN_B2B_SPAMMER CTYPE_NULL DOS_DEREK_AUG08 DX_TEXT_02 EXCUSE_24 FORGED_GMAIL_RCVD FORGED_SPF_HELO FROM_IN_TO_AND_SUBJ

Re: Extreme scores from FRNAME rules.

2018-10-25 Thread Reio Remma
atch short subject now. This could fix your problem, can you rescan the mail? current scores: score FRNAME_IN_MSG_NO_SUBJ 0.001 2.499 0.001 2.499 score FRNAME_IN_MSG_XPRIO   0.001 2.499 0.001 2.499 score FRNAME_IN_MSG_XPRIO_NO_SUB    2.499 0.001 2.499 0

Re: Extreme scores from FRNAME rules.

2018-10-25 Thread Matus UHLAR - fantomas
m, can you rescan the mail? current scores: score FRNAME_IN_MSG_NO_SUBJ 0.001 2.499 0.001 2.499 score FRNAME_IN_MSG_XPRIO 0.001 2.499 0.001 2.499 score FRNAME_IN_MSG_XPRIO_NO_SUB2.499 0.001 2.499 0.001 score XPRIO_SHORT_SUBJ 2.499 2

Re: Extreme scores from FRNAME rules.

2018-10-25 Thread Reio Remma
On 25/10/2018 11:43, Matus UHLAR - fantomas wrote: On 25/10/2018 10:33, Matus UHLAR - fantomas wrote: bug number would help more... On 25.10.18 10:58, Reio Remma wrote: The bug contains no additional info. :) I was simply asked to post to the list. and this is exactly why it would be better

Re: Extreme scores from FRNAME rules.

2018-10-25 Thread Matus UHLAR - fantomas
On 22.10.18 21:34, Reio Remma wrote: I have this perfectly legit mail that has a +7.5 score from these three rules. *  2.5 FRNAME_IN_MSG_XPRIO From name in message + X-Priority *  2.5 XPRIO_SHORT_SUBJ Has X-Priority header + short subject *  2.5 FRNAME_IN_MSG_NO_SUBJ From name in message + shor

Re: Extreme scores from FRNAME rules.

2018-10-25 Thread Reio Remma
On 25/10/2018 10:33, Matus UHLAR - fantomas wrote: On 22.10.18 21:34, Reio Remma wrote: I have this perfectly legit mail that has a +7.5 score from these three rules. *  2.5 FRNAME_IN_MSG_XPRIO From name in message + X-Priority *  2.5 XPRIO_SHORT_SUBJ Has X-Priority header + short subject *  2

Re: Extreme scores from FRNAME rules.

2018-10-25 Thread Matus UHLAR - fantomas
On 22.10.18 21:34, Reio Remma wrote: I have this perfectly legit mail that has a +7.5 score from these three rules. * 2.5 FRNAME_IN_MSG_XPRIO From name in message + X-Priority * 2.5 XPRIO_SHORT_SUBJ Has X-Priority header + short subject * 2.5 FRNAME_IN_MSG_NO_SUBJ From name in message + short

Re: Extreme scores from FRNAME rules.

2018-10-22 Thread John Hardin
On Mon, 22 Oct 2018, Reio Remma wrote: Hello! I have this perfectly legit mail that has a +7.5 score from these three rules. * 2.5 FRNAME_IN_MSG_XPRIO From name in message + X-Priority * 2.5 XPRIO_SHORT_SUBJ Has X-Priority header + short subject * 2.5 FRNAME_IN_MSG_NO_SUBJ From name in me

Extreme scores from FRNAME rules.

2018-10-22 Thread Reio Remma
Hello! I have this perfectly legit mail that has a +7.5 score from these three rules. * 2.5 FRNAME_IN_MSG_XPRIO From name in message + X-Priority * 2.5 XPRIO_SHORT_SUBJ Has X-Priority header + short subject * 2.5 FRNAME_IN_MSG_NO_SUBJ From name in message + short or no subject If it wasn't f

Re: Increase scores based on lewd body text

2018-05-03 Thread RW
On Thu, 3 May 2018 10:38:14 -0300 Steve Mallett wrote: > Didn't cc users@ > > How do I add a non sa-compile ruleset to spamassassin? The googles > are not helping. > If you mean non sa-update, you put them in the directory that contains the global configuration file local.cf. In Linux this is

Re: Fwd: Increase scores based on lewd body text

2018-05-03 Thread Benny Pedersen
Steve Mallett skrev den 2018-05-03 15:38: Didn't cc users@ How do I add a non sa-compile ruleset to spamassassin? The googles are not helping. non sa-compile ? show what you have tryed would help us to help you more all rules must support sa-compile else spamassassin --lint will fail i don

Fwd: Increase scores based on lewd body text

2018-05-03 Thread Steve Mallett
ote: > >> >> Hi, >> >> I have mboxs I'm running spamassassin against & many emails with very >> lewd body text have the same scores as other emails without. >> >> I'm invoking via: formail -s procmail ~/procmail.rc < mbox >> >> S

Re: Increase scores based on lewd body text

2018-05-01 Thread Benny Pedersen
Steve Mallett skrev den 2018-05-02 00:42: How can increase the scores on bad words in body text and/or is there a recipe specifically for that type of thing? # add to local.cf body FOO /foo/i describe FOO foo found in body score FOO 0.01 0.01 0.01 0.01 aditional can be tflags FOO learn

Re: Increase scores based on lewd body text

2018-05-01 Thread Kevin A. McGrail
rail - 703.798.0171 On Tue, May 1, 2018 at 6:42 PM, Steve Mallett wrote: > > Hi, > > I have mboxs I'm running spamassassin against & many emails with very lewd > body text have the same scores as other emails without. > > I'm invoking via: formail -s procmail ~/procmail.r

Increase scores based on lewd body text

2018-05-01 Thread Steve Mallett
Hi, I have mboxs I'm running spamassassin against & many emails with very lewd body text have the same scores as other emails without. I'm invoking via: formail -s procmail ~/procmail.rc < mbox SA V: 3.4.1 Running on Ubuntu 16.04LTS How can increase the scores on bad words in

Re: Differing scores on spamassassin checks

2018-04-17 Thread John Hardin
On Tue, 17 Apr 2018, John Hardin wrote: On Tue, 17 Apr 2018, Computer Bob wrote: In this way, any user can move a mail to their .SpamLearn folder and it will get learned. It is a very bad idea to do that without review unless you *strongly* trust the judgement and responsibility of your use

Re: Differing scores on spamassassin checks

2018-04-17 Thread RW
On Tue, 17 Apr 2018 11:19:57 -0500 Computer Bob wrote: > The problem I immediately see is that I get one big bayes of everyone > and a 'one for all, all for one' bayes config. > I would like to configure SA to be able to deal with the virtual > users individually somehow but don't know if it can

Re: Differing scores on spamassassin checks

2018-04-17 Thread John Hardin
On Tue, 17 Apr 2018, Computer Bob wrote: In this way, any user can move a mail to their .SpamLearn folder and it will get learned. It is a very bad idea to do that without review unless you *strongly* trust the judgement and responsibility of your users. Allowing training without review may

Re: Differing scores on spamassassin checks

2018-04-17 Thread Computer Bob
I would like to thank everyone for your responses, they have been great. This maillist has not failed to help me improve things everytime I use it. So this particular server has virtual domains and virtual users in a folder hierarchy there under all owned by 'vmail' user. I have done the follow

Re: Differing scores on spamassassin checks

2018-04-17 Thread RW
On Tue, 17 Apr 2018 15:44:25 +0200 Matus UHLAR - fantomas wrote: > >> On 15.04.18 20:04, RW wrote: > >> >All setting bayes_path buys you here is the ability to run > >> >sa-learn and spamassassin as root, something you should *never* > >> >do anyway. > > >On Tue, 17 Apr 2018 13:55:13 +0200 >

Re: Differing scores on spamassassin checks

2018-04-17 Thread Matus UHLAR - fantomas
On 15.04.18 20:04, RW wrote: >All setting bayes_path buys you here is the ability to run sa-learn >and spamassassin as root, something you should *never* do anyway. On Tue, 17 Apr 2018 13:55:13 +0200 Matus UHLAR - fantomas wrote: it's the only way to use per-user settings and bayes DB on syste

Re: Differing scores on spamassassin checks

2018-04-17 Thread RW
On Tue, 17 Apr 2018 13:55:13 +0200 Matus UHLAR - fantomas wrote: > On 15.04.18 20:04, RW wrote: > >All setting bayes_path buys you here is the ability to run sa-learn > >and spamassassin as root, something you should *never* do anyway. > > it's the only way to use per-user settings and bayes

Re: Differing scores on spamassassin checks

2018-04-17 Thread Matus UHLAR - fantomas
On Sun, 15 Apr 2018 13:39:31 -0500 Computer Bob wrote: Update: For this location, it is ok to have a central bayes database, so I turned off AWL, adjusted local.cf to contain: bayes_path /Central_Path/bayes_db/bayes bayes_file_mode 0777 On 15.04.18 20:04, RW wrote: Don't set 0777. If that's s

Re: Differing scores on spamassassin checks

2018-04-16 Thread Bill Cole
On 16 Apr 2018, at 19:01 (-0400), John Hardin wrote: On Mon, 16 Apr 2018, Computer Bob wrote: Why should sa-learn not be run as root ? That's a general safe practice. Do as little as root as you possibly can. Why risk a root crack from an unknown bug in sa-learn that somebody has discovere

Re: Differing scores on spamassassin checks

2018-04-16 Thread John Hardin
On Mon, 16 Apr 2018, Computer Bob wrote: Why should sa-learn not be run as root ? That's a general safe practice. Do as little as root as you possibly can. Why risk a root crack from an unknown bug in sa-learn that somebody has discovered and figured out how to exploit via email? -- John

Re: Differing scores on spamassassin checks

2018-04-16 Thread Computer Bob
Well, now I am more thoroughly confused than usual. #:) On 4/15/18 2:04 PM, RW wrote: On Sun, 15 Apr 2018 13:39:31 -0500 Computer Bob wrote: Update: For this location, it is ok to have a central bayes database, so I turned off AWL, adjusted local.cf to contain: bayes_path /Central_Path/bayes_db

Re: Differing scores on spamassassin checks

2018-04-16 Thread Amir Caspi
On Apr 16, 2018, at 11:15 AM, RW wrote: > > You seem to be confusing unix and virtual users. Sorry, I was confusing "virtual hosting" with "virtual users." Oops. Ignore me! --- Amir

Re: Differing scores on spamassassin checks

2018-04-16 Thread RW
On Mon, 16 Apr 2018 10:34:41 -0600 Amir Caspi wrote: > > On Apr 15, 2018, at 12:39 PM, Computer Bob > > wrote: > > > > I still am a bit puzzled how bayes db gets handled when using > > virtual users and domains. I see no trace of bayes or .spamassassin > > files in any of the virtual locations o

Re: Differing scores on spamassassin checks

2018-04-16 Thread Amir Caspi
> On Apr 15, 2018, at 12:39 PM, Computer Bob wrote: > > I still am a bit puzzled how bayes db gets handled when using virtual users > and domains. I see no trace of bayes or .spamassassin files in any of the > virtual locations or in the sql databases. If you want Bayes to run per-user with vi

Re: Differing scores on spamassassin checks

2018-04-15 Thread RW
On Sun, 15 Apr 2018 13:39:31 -0500 Computer Bob wrote: > Update: > For this location, it is ok to have a central bayes database, so I > turned off AWL, adjusted local.cf to contain: > bayes_path /Central_Path/bayes_db/bayes > bayes_file_mode 0777 Don't set 0777. If that's still in the wiki someo

Re: Differing scores on spamassassin checks

2018-04-15 Thread RW
On Sun, 15 Apr 2018 11:08:35 -0700 (PDT) John Hardin wrote: > On Sun, 15 Apr 2018, Matus UHLAR - fantomas wrote: > > > On 15.04.18 11:55, Computer Bob wrote: > >> Here is a root scan:  https://pastebin.com/qdXMRzKb > > > > X-Spam-Status: Yes, score=10.2 required=4.0 tests=HTML_MESSAGE, > >

Re: Differing scores on spamassassin checks

2018-04-15 Thread Matus UHLAR - fantomas
On 15.04.18 11:55, Computer Bob wrote: Here is a root scan:  https://pastebin.com/qdXMRzKb On Sun, 15 Apr 2018, Matus UHLAR - fantomas wrote: X-Spam-Status: Yes, score=10.2 required=4.0 tests=HTML_MESSAGE, RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,RCVD_IN_SBL_CSS,SPF_HELO_PASS, URIBL_DB

Re: Differing scores on spamassassin checks

2018-04-15 Thread John Hardin
On Sun, 15 Apr 2018, John Hardin wrote: On Sun, 15 Apr 2018, Matus UHLAR - fantomas wrote: On 15.04.18 11:55, Computer Bob wrote: Here is a root scan:  https://pastebin.com/qdXMRzKb X-Spam-Status: Yes, score=10.2 required=4.0 tests=HTML_MESSAGE, RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,RC

Re: Differing scores on spamassassin checks

2018-04-15 Thread John Hardin
On Sun, 15 Apr 2018, Matus UHLAR - fantomas wrote: On 15.04.18 11:55, Computer Bob wrote: Here is a root scan:  https://pastebin.com/qdXMRzKb X-Spam-Status: Yes, score=10.2 required=4.0 tests=HTML_MESSAGE, RAZOR2_CF_RANGE_51_100,RAZOR2_CHECK,RCVD_IN_SBL_CSS,SPF_HELO_PASS, URIBL_

Re: Differing scores on spamassassin checks

2018-04-15 Thread Matus UHLAR - fantomas
differences are AWL and BAYES_00 which means 1. your spamd' bayes database is mistrained 2. you apparently should disable AWL at least until you train bayes properly. On 4/15/18 11:34 AM, Computer Bob wrote: Greeting all, * *I have had some issues with spam getting low scores and in troubleshoot

Re: Differing scores on spamassassin checks

2018-04-15 Thread Computer Bob
Here is a root scan:  https://pastebin.com/qdXMRzKb Here is the same run under spamd: https://pastebin.com/SvvYptYv On 4/15/18 11:34 AM, Computer Bob wrote: Greeting all, * *I have had some issues with spam getting low scores and in troubleshooting I have found that if I run a command line

Differing scores on spamassassin checks

2018-04-15 Thread Computer Bob
Greeting all, * *I have had some issues with spam getting low scores and in troubleshooting I have found that if I run a command line check with "spamassassin -D -x  < test" on a mail in question, I get a very high score when run under user root. When run under user spamd

Re: spamasssassin vs mimedefang scores

2018-02-22 Thread Bill Cole
[score: 0.] 0.8 RDNS_NONE Delivered to internal network by a host with no rDNS 0.3 TO_EQ_FM_DOM_SPF_FAIL To domain == From domain and external SPF failed However, the SA check which was done trough mimedefang, seems like giving other

Re: spamasssassin vs mimedefang scores

2018-02-22 Thread Kevin A. McGrail
e: 0.]  0.8 RDNS_NONE  Delivered to internal network by a host with no rDNS  0.3 TO_EQ_FM_DOM_SPF_FAIL  To domain == From domain and external SPF     failed However, the SA check which was done trough mimedefang, seems like giving other scores, how can i t

spamasssassin vs mimedefang scores

2018-02-22 Thread saqariden
Delivered to internal network by a host with no rDNS 0.3 TO_EQ_FM_DOM_SPF_FAIL To domain == From domain and external SPF failed However, the SA check which was done trough mimedefang, seems like giving other scores, how can i test an email to get t

Re: Mailspike scores

2017-05-02 Thread John Hardin
On Tue, 2 May 2017, RW wrote: On Tue, 2 May 2017 09:20:49 -0700 (PDT) John Hardin wrote: On Tue, 2 May 2017, Bowie Bailey wrote: On 5/2/2017 11:53 AM, John Hardin wrote: On Tue, 2 May 2017, Bowie Bailey wrote: I was checking to see what the scores for mailspike were on my server and I

Re: Mailspike scores

2017-05-02 Thread RW
On Tue, 2 May 2017 09:20:49 -0700 (PDT) John Hardin wrote: > On Tue, 2 May 2017, Bowie Bailey wrote: > > > On 5/2/2017 11:53 AM, John Hardin wrote: > >> On Tue, 2 May 2017, Bowie Bailey wrote: > >> > >> > I was checking to see what the scores fo

Re: Mailspike scores

2017-05-02 Thread John Hardin
On Tue, 2 May 2017, Bowie Bailey wrote: On 5/2/2017 11:53 AM, John Hardin wrote: On Tue, 2 May 2017, Bowie Bailey wrote: > I was checking to see what the scores for mailspike were on my server > and I noticed that there are two sets of scores. > > Is this expected?

Re: Mailspike scores

2017-05-02 Thread Bowie Bailey
On 5/2/2017 11:53 AM, John Hardin wrote: On Tue, 2 May 2017, Bowie Bailey wrote: I was checking to see what the scores for mailspike were on my server and I noticed that there are two sets of scores. 50_scores.cf: score RCVD_IN_MSPIKE_ZBI 2.7 50_scores.cf: score RCVD_IN_MSPIKE_L5

Re: Mailspike scores

2017-05-02 Thread John Hardin
On Tue, 2 May 2017, Bowie Bailey wrote: I was checking to see what the scores for mailspike were on my server and I noticed that there are two sets of scores. 50_scores.cf: score RCVD_IN_MSPIKE_ZBI 2.7 50_scores.cf: score RCVD_IN_MSPIKE_L5 2.5 50_scores.cf: score RCVD_IN_MSPIKE_L4

  1   2   3   4   5   6   7   8   9   10   >