Re: shortcircuit internal mail

Delivered-To =~ /\@lists\.example\.com/ shortcircuit __LOCAL_OUR_LISTS on of course someone can forge the Delivered-To, there are some other list specific headers that could also be found as well. > Configure the second internal MTA to entirely skip passing the message to &g

Re: shortcircuit internal mail

On Tue, 19 May 2020, micah anderson wrote: The final stage I thought would be short-circuited, because it was relayed through our internal network, and we already do spam filtering at the list server stage, we don't want to do it again. Nope. SA scans whatever you give it to scan, and that is

shortcircuit internal mail

uit this? This is what I have configured for short-circuit: ifplugin Mail::SpamAssassin::Plugin::Shortcircuit # # default: strongly-whitelisted mails are *really* whitelisted now, if the # shortcircuiting plugin is active, causing early exit to save CPU load. # Uncomment to turn this on

Re: shortcircuit on alread x-spam-flag: yes

SA sees it. i thought shortcircuit will test before any other tests but header was remove before shortcircuit :( I have a lot to learn... Thanks for help maybe i try this again... later :-) The proper place to bypass SpamAssassin processing for any reason is in your glue layer. How is SA h

Re: shortcircuit on alread x-spam-flag: yes

OFH Rules from this site ;-) ) > > i check headers and if "X-SPam-Flag: YES" is set, i write a custom Header > from postfix. > > and in Spamassassin i search this custom header in shortcircuit. > > It works! > X-Spam-Status: Yes, score=98.7 tagged_above=-

Re: shortcircuit on alread x-spam-flag: yes

Hi Benny, thanks for your link! ( i did not follow any BOFH Rules from this site ;-) ) i check headers and if "X-SPam-Flag: YES" is set, i write a custom Header from postfix. and in Spamassassin i search this custom header in shortcircuit. It works! X-Spam-Status: Yes,

Re: shortcircuit on alread x-spam-flag: yes

Hi Benny yeah your links definitely show massive abuse of mta header/body checks :-) But nonetheless mta header checks are way more performant and efficient than such checks in a filter software. As long as the header you check is used for a kill-shot its best place still is the mta header checks

Re: shortcircuit on alread x-spam-flag: yes

On 2019-11-27 17:56, Philipp Ewald wrote: we only want to trust "X-Spam-Flag: YES" or why should someone (spammer, other mailserver with outgoing spamfilter) set this Flag to Yes? trustness https://www.techiepark.com/tutorials/blocking-spam-using-postfix-header_checks-and-spamassassin/ bad e

Re: shortcircuit on alread x-spam-flag: yes

to >> match on such a header you need to rewrite it before SA sees it. > > i thought shortcircuit will test before any other tests but header was > remove before shortcircuit :( > I have a lot to learn... > > Thanks for help maybe i try this again... later :-) > > Am 2

Re: shortcircuit on alread x-spam-flag: yes

On 2019-11-27 17:15, Tobi wrote: Philipp, Think you should ask yourself the following question: do I trust the spam result from a remote server? If yes then why using a spamassassin rule and not straight-out reject such mails on mta (header check)? And if you do not trust the remote server then

Re: shortcircuit on alread x-spam-flag: yes

Hi Tobi, we only want to trust "X-Spam-Flag: YES" or why should someone (spammer, other mailserver with outgoing spamfilter) set this Flag to Yes? but like RW wrote: If you want to match on such a header you need to rewrite it before SA sees it. i thought shortcircuit will test

Re: shortcircuit on alread x-spam-flag: yes

Philipp, Think you should ask yourself the following question: do I trust the spam result from a remote server? If yes then why using a spamassassin rule and not straight-out reject such mails on mta (header check)? And if you do not trust the remote server then why using its spam decission at all

Re: shortcircuit on alread x-spam-flag: yes

On 26 Nov 2019, at 08:11, Philipp Ewald wrote: we have "old customer" (with historical terms) there have forwarding rules for any mail and we are not allowed to set SPAM Filter rule or to change the forwarding rules. On 26.11.19 13:22, @lbutlr wrote: Forwarding spam is a good way to be black

Re: shortcircuit on alread x-spam-flag: yes

On Tue, 26 Nov 2019 14:06:15 +0100 Philipp Ewald wrote: > Hi guys, > > i want to bypas scanning mail if mail has already X-Spam-Flag: YES > set. I found "clear_headers" in > "/usr/share/spamassassin/10_default_prefs.cf". > > how can i override this setting? (include next update) clear_headers

Re: shortcircuit on alread x-spam-flag: yes

Oops. Sorry about that. > On 26 Nov 2019, at 13:22, @lbutlr wrote: > > You know a thorn can main / But a lover does the same / A gem will > reflect light / And a Fool will marvel at the sight / A fool such > as me, > /Who sees not the gold, but the beauty of the shine > /% > 'You kno

Re: shortcircuit on alread x-spam-flag: yes

On 26 Nov 2019, at 08:11, Philipp Ewald wrote: > we have "old customer" (with historical terms) there have forwarding rules > for any mail and we are not allowed to set SPAM Filter rule or to change the > forwarding rules. Forwarding spam is a good way to be blacklisted as a spam source. This i

Re: shortcircuit on alread x-spam-flag: yes

Am 26.11.19 um 15:43 schrieb Matus UHLAR - fantomas: On 26.11.19 15:08, Philipp Ewald wrote: Not really... or why should some one set this header on non-spam? FP means false positive. Mail that was evaluated as spam but is not. On 26.11.19 16:30, Philipp Ewald wrote: i know ;-) X-Spam-Flag:

Re: shortcircuit on alread x-spam-flag: yes

Am 26.11.19 um 15:43 schrieb Matus UHLAR - fantomas: On 26.11.19 15:08, Philipp Ewald wrote: Not really... or why should some one set this header on non-spam? FP means false positive. Mail that was evaluated as spam but is not. i know ;-) X-Spam-Flag: yes on non spam is false positiv :)

Re: shortcircuit on alread x-spam-flag: yes

it into a whatever called file with the extension .cf in /etc/mail/spamassassin Okay maybe forgot to activate shortcircuit(?) my rule: /etc/spamassassin/09_X_SPAM_FLAG.cf header SpamFlag X-Spam-Flag =~ /YES/ score SpamFlag 99 was loaded before "/usr/share/spamassassin/10_default_prefs.c

Re: shortcircuit on alread x-spam-flag: yes

On 26.11.19 15:08, Philipp Ewald wrote: Not really... or why should some one set this header on non-spam? FP means false positive. Mail that was evaluated as spam but is not. On 26.11.19 14:06, Philipp Ewald wrote: i want to bypas scanning mail if mail has already X-Spam-Flag: YES set. I fou

Re: shortcircuit on alread x-spam-flag: yes

Not really... or why should some one set this header on non-spam? Am 26.11.19 um 14:44 schrieb Matus UHLAR - fantomas: On 26.11.19 14:06, Philipp Ewald wrote: i want to bypas scanning mail if mail has already X-Spam-Flag: YES set. I found "clear_headers" in "/usr/share/spamassassin/10_default_

Re: shortcircuit on alread x-spam-flag: yes

On 26.11.19 14:06, Philipp Ewald wrote: i want to bypas scanning mail if mail has already X-Spam-Flag: YES set. I found "clear_headers" in "/usr/share/spamassassin/10_default_prefs.cf". how can i override this setting? (include next update) don't you care about incoming FPs? -- Matus UHLAR - f

shortcircuit on alread x-spam-flag: yes

Hi guys, i want to bypas scanning mail if mail has already X-Spam-Flag: YES set. I found "clear_headers" in "/usr/share/spamassassin/10_default_prefs.cf". how can i override this setting? (include next update) Kind regards Philipp -- Philipp Ewald Administrator DigiOnline GmbH, Probsteigass

Re: SA shortcircuit

Good day Guys >>> >>> Would anyone be willing to share their shortcircuiting list. >>> >>> Currently I am just shortcircuiting CLAMAV, Im looking to improve SA. >>> >>> Many thanks. >>> >>> Regards >>> Brent &g

Re: SA shortcircuit

. Currently I am just shortcircuiting CLAMAV, Im looking to improve SA. Many thanks. Regards Brent shortcircuit ALL_TRUSTED off shortcircuit USER_IN_WHITELIST on shortcircuit USER_IN_DEF_WHITELIST on shortcircuit USER_IN_BLACKLIST on shortcircuit USER_IN_DKIM_WHITELIST on shortcircuit

Re: SA shortcircuit

On 4/18/19 1:55 AM, Brent Clark wrote: > Good day Guys > > Would anyone be willing to share their shortcircuiting list. > > Currently I am just shortcircuiting CLAMAV, Im looking to improve SA. > > Many thanks. > > Regards > Brent shortcircuit ALL_TRUSTED off sho

SA shortcircuit

Good day Guys Would anyone be willing to share their shortcircuiting list. Currently I am just shortcircuiting CLAMAV, Im looking to improve SA. Many thanks. Regards Brent

Re: Shortcircuit reports only 1 test

On 28.01.18 13:36, Chip wrote: shortcircuit DKIM_VALID_AU on shortcircuit SPF_PASS on score DKIM_VALID_AU -100 score SPF_PASS -100 1. shortcircuiting is affected by priotiry, not score. 2. are you sure you want to pass spam just because it was sent through hacked accounts? (which is nowadays

Re: Shortcircuit reports only 1 test

Now I see that whitelist_from_rcvd is probably the best all around. As explained here: *whitelist_from_rcvd a...@lists.sourceforge.net  sourceforge.net* Works similarly to whitelist_from, except that in addition to matching a sender address, a relay's r

Shortcircuit reports only 1 test

I will try my best to explain a subset of this project in greater detail without going into too much detail as you never know who is on this list. Assume all of the following: An smtp server that always accepts email but never sends email. Mailboxes with unique user names such that it would be hi

Re: Shortcircuit reports only 1 test

On 01/28/2018 02:25 PM, Benny Pedersen wrote: Chip skrev den 2018-01-28 21:01: I see that makes sense.  Thanks for the clarity. However how do you get to 150? good DKIM = 100 good SPF = 100 That totals 200 one more reason not to use it use domain based whitelist_auth not just global all th

Re: Shortcircuit reports only 1 test

Chip skrev den 2018-01-28 21:01: I see that makes sense.  Thanks for the clarity. However how do you get to 150? good DKIM = 100 good SPF = 100 That totals 200 one more reason not to use it use domain based whitelist_auth not just global all that is dkim pass or spf pass if you want spam

Re: Shortcircuit reports only 1 test

Ah, yes, it's coming together now.  Thanks for the tutorial.  I'm assuming when you say "less than" and you are working with negative numbers, that the less than moves the score towards, for example, -200 from a for example, -150. On 01/28/2018 03:12 PM, David Jones wrote: > On 01/28/2018 02:09 PM

Re: Shortcircuit reports only 1 test

On 01/28/2018 02:09 PM, David Jones wrote: On 01/28/2018 02:01 PM, Chip wrote: I see that makes sense.  Thanks for the clarity. However how do you get to 150? good DKIM = 100 good SPF = 100 That totals 200 Think about it for a minute.  We are talking about negative numbers. There could be

Re: Shortcircuit reports only 1 test

negative 200 to make it like -196.6 or -175.0. Anything less than minus 150 will have hit both SPF_PASS and DKIM_VALID_AU if those are the only shortcircuit'd hits. On 01/28/2018 02:53 PM, David Jones wrote: On 01/28/2018 12:36 PM, Chip wrote: I have the following in local.cf shortci

Re: Shortcircuit reports only 1 test

I see that makes sense.  Thanks for the clarity. However how do you get to 150? good DKIM = 100 good SPF = 100 That totals 200 On 01/28/2018 02:53 PM, David Jones wrote: > On 01/28/2018 12:36 PM, Chip wrote: >> I have the following in local.cf >> >> shortcir

Re: Shortcircuit reports only 1 test

On 01/28/2018 12:36 PM, Chip wrote: I have the following in local.cf shortcircuit DKIM_VALID_AU on shortcircuit SPF_PASS on score DKIM_VALID_AU -100 score SPF_PASS -100 Just to be clear about these settings above for new SA users, this is not recommended. This is a very special need that

Re: Shortcircuit reports only 1 test

Chip skrev den 2018-01-28 19:36: I have the following in local.cf shortcircuit DKIM_VALID_AU on shortcircuit SPF_PASS on score DKIM_VALID_AU -100 score SPF_PASS -100 The question is are all triggers reported in headers (DKIM and SPF), or just some? if you want to have both use: meta

Shortcircuit reports only 1 test

I have the following in local.cf shortcircuit DKIM_VALID_AU on shortcircuit SPF_PASS on score DKIM_VALID_AU -100 score SPF_PASS -100 The question is are all triggers reported in headers (DKIM and SPF), or just some? A look at the logs and SA headers shows: Logs: 2018-01-28 13:24:05 1efrcb

Re: Shortcircuit work partially

ant to reduce load > > > > -Messaggio originale- > Da: RW [mailto:rwmailli...@googlemail.com] > Inviato: martedì 30 agosto 2016 17:24 > A: users@spamassassin.apache.org > Oggetto: Re: R: R: Shortcircuit work partially > > On Tue, 30 Aug 2016 14:48:03 + > Nicol

Re: Shortcircuit work partially

daily limit of RBL/URIBL services and for whatever reason you have abnormal peaks of inbound tries "zero cost" turns when you would be able to shortcircuit a majority of the messages i even go so far and say it would be a possible attack when someone floods you with special comp

Re: R: R: R: Shortcircuit work partially

Nicola Piazzi wrote: > How to do it syncronously ? > It is not important to process a single mail in 5 or 50 seconds > 4 me ss most important to reduce load DNS lookups have essentially zero cost next to almost anything else SA does. I can say for certain that shortcircuit works; I

Re: R: Shortcircuit work partially

gna - Italia > Tel.  +39 051.6079.293 > Cell. +39 328.21.73.470 > Web: www.gruppocomet.it > > > > -Messaggio originale- > Da: li...@rhsoft.net [mailto:li...@rhsoft.net] > Inviato: martedì 30 agosto 2016 16:26 > A: users@spamassassin.apache.org > Ogg

R: R: R: Shortcircuit work partially

: Shortcircuit work partially On Tue, 30 Aug 2016 14:48:03 + Nicola Piazzi wrote: > em is that dns check are made asincronously if it will be made > sincronously it will happen like you said it is not important slowind > down all messages because I save a lot of query and cpu Run

Re: R: R: Shortcircuit work partially

On Tue, 30 Aug 2016 14:48:03 + Nicola Piazzi wrote: > em is that dns check are made asincronously > if it will be made sincronously it will happen like you said > it is not important slowind down all messages because I save a lot of > query and cpu Running then synchronously would mean runnin

Re: R: Shortcircuit work partially

6 10:37 AM, Axb wrote: shot in te dark: what happens if you do priority BAYES_ZERO -2000 shortcircuit BAYES_ZERO ham On 08/30/2016 04:30 PM, Nicola Piazzi wrote: And there is not a solution ? Nicola Piazzi CED - Sistemi COMET s.p.a. Via Michelino, 105 - 40127

R: R: Shortcircuit work partially

e a lot of query and cpu -Messaggio originale- Da: Bowie Bailey [mailto:bowie_bai...@buc.com] Inviato: martedì 30 agosto 2016 16:44 A: users@spamassassin.apache.org Oggetto: Re: R: Shortcircuit work partially I'm assuming that BAYES_ZERO is a meta of some sort. Would you also need to

Re: R: Shortcircuit work partially

_ZERO -2000 shortcircuit BAYES_ZERO ham On 08/30/2016 04:30 PM, Nicola Piazzi wrote: And there is not a solution ? Nicola Piazzi CED - Sistemi COMET s.p.a. Via Michelino, 105 - 40127 Bologna - Italia Tel. +39 051.6079.293 Cell. +39 328.21.73.470 Web: www.gruppocomet.it -Mess

Re: R: Shortcircuit work partially

shot in te dark: what happens if you do priority BAYES_ZERO -2000 shortcircuit BAYES_ZERO ham On 08/30/2016 04:30 PM, Nicola Piazzi wrote: And there is not a solution ? Nicola Piazzi CED - Sistemi COMET s.p.a. Via Michelino, 105 - 40127 Bologna - Italia Tel

R: Shortcircuit work partially

2016 16:26 A: users@spamassassin.apache.org Oggetto: Re: Shortcircuit work partially Am 30.08.2016 um 16:21 schrieb Nicola Piazzi: > When i shortcircuit a rule not all other are bypassed > > Here an example ... > > Local.cf : > priority BAYES_ZERO -

Re: Shortcircuit work partially

Am 30.08.2016 um 16:21 schrieb Nicola Piazzi: When i shortcircuit a rule not all other are bypassed Here an example ... Local.cf : priority BAYES_ZERO -980 shortcircuit BAYES_ZERO ham the dns stuff is fired asynchronous long before bayes is even

Shortcircuit work partially

When i shortcircuit a rule not all other are bypassed Here an example ... Local.cf : priority BAYES_ZERO -980 shortcircuit BAYES_ZERO ham Spam report : -0.03 ABUSIX_PRESENCE Contatto Anti-Abuse presente in abuse-contacts.abusix.org -1.00 BAYES_ZERO Bayes

Re: Detecting which shortcircuit rule fires

having this problem where some spam is not detected properly due to a shortcircuit rule. However, I'm having some difficulty figuring out which one of them is causing the problem. Here is the X-Spam-Report - which should cause the email to be classed as spam, really: But when the message

Re: Detecting which shortcircuit rule fires

now having this problem where some spam is not detected properly due to a shortcircuit rule. However, I'm having some difficulty figuring out which one of them is causing the problem. Here is the X-Spam-Report - which should cause the email to be classed as spam, really: But when the message

Re: Detecting which shortcircuit rule fires

detected properly due to a shortcircuit rule. However, I'm having some difficulty figuring out which one of them is causing the problem. Here is the X-Spam-Report - which should cause the email to be classed as spam, really: But when the message goes through Exim * show the headers of s

Re: Detecting which shortcircuit rule fires

On 02/12/15 09:49, Reindl Harald wrote: Am 02.12.2015 um 10:30 schrieb Sebastian Arcus: After properly configuring a bayes database and training it following the great advice from this list, I am now having this problem where some spam is not detected properly due to a shortcircuit rule

Re: Detecting which shortcircuit rule fires

Am 02.12.2015 um 10:30 schrieb Sebastian Arcus: After properly configuring a bayes database and training it following the great advice from this list, I am now having this problem where some spam is not detected properly due to a shortcircuit rule. However, I'm having some difficulty fig

Detecting which shortcircuit rule fires

After properly configuring a bayes database and training it following the great advice from this list, I am now having this problem where some spam is not detected properly due to a shortcircuit rule. However, I'm having some difficulty figuring out which one of them is causing the pr

Re: shortcircuit dnsbl/uribl

On Wed, 03 Jun 2015 11:22:42 +0200 Reindl Harald wrote: > > Am 02.06.2015 um 16:30 schrieb RW: > > On Tue, 02 Jun 2015 14:36:07 +0200 > > Reindl Harald wrote: > > > >> given that USER_IN_SPF_WHITELIST score with -100 here there is no > >> real point to fire up all the other tests, it's clear anyw

Re: shortcircuit dnsbl/uribl

Am 02.06.2015 um 16:30 schrieb RW: On Tue, 02 Jun 2015 14:36:07 +0200 Reindl Harald wrote: given that USER_IN_SPF_WHITELIST score with -100 here there is no real point to fire up all the other tests, it's clear anyways that this message will pass As far as possible spamassassin does network

Re: shortcircuit dnsbl/uribl

On Tue, 02 Jun 2015 14:36:07 +0200 Reindl Harald wrote: > given that USER_IN_SPF_WHITELIST score with -100 here there is no > real point to fire up all the other tests, it's clear anyways that > this message will pass As far as possible spamassassin does network test in parallel with each other

shortcircuit dnsbl/uribl

#x27;s clear anyways that this message will pass meta SHORTCIRCUIT_NET_HAM (USER_IN_DKIM_WHITELIST || USER_IN_SPF_WHITELIST) priority SHORTCIRCUIT_NET_HAM -500 shortcircuit SHORTCIRCUIT_NET_HAM on scoreSHORTCIRCUIT_NET_HAM -0.001 describe SHORTCIRCUIT_NET_HAM Skip tests for

Re: is "Shortcircuit" not part of the default SA

solved, was tehre but commented in the .pre files [root@localhost:~]$ cat /etc/mail/spamassassin/shortcircuit.pre loadplugin Mail::SpamAssassin::Plugin::Shortcircuit Am 26.05.2015 um 15:17 schrieb Reindl Harald: SA 3.4.1 (Fedora 21) i played around with the rules below but messages still get

is "Shortcircuit" not part of the default SA

SA 3.4.1 (Fedora 21) i played around with the rules below but messages still get "BAYES_00,USER_IN_MORE_SPAM_TO,USER_IN_SPF_WHITELIST" and so hit bayes and likely other rules which i thought can be skipped "shortcircuit=_SCTYPE_" is also not replaced in the

Re: ShortCircuit?

s almost always right, I tried uncommenting >> >> Mail::SpamAssassin::Plugin::Shortcircuit and >> shortcircuit BAYES_99 spam >> >> in my local.cf. It seems to be working well, but is there a downside? > > > I wouldn't use short-circuiting on a home compu

Re: ShortCircuit?

ssassin::Plugin::Shortcircuit > and > shortcircuit BAYES_99 spam > > in my local.cf. It seems to be working well, but is there a downside? I wouldn't use short-circuiting on a home computer, unless it really can't cope with the throughput and even then I'd start by short

Re: ShortCircuit?

On Wed, 24 Aug 2011, Walter Hurry wrote: I have been using SA on my home box for a couple of months now; really more as a learning exercise than anything else. Having noticed that my Bayes is almost always right, I tried uncommenting Mail::SpamAssassin::Plugin::Shortcircuit and shortcircuit

ShortCircuit?

I have been using SA on my home box for a couple of months now; really more as a learning exercise than anything else. Having noticed that my Bayes is almost always right, I tried uncommenting Mail::SpamAssassin::Plugin::Shortcircuit and shortcircuit BAYES_99 spam in my local.cf. It seems to

Re: whitelist_from_dkim and shortcircuit

On 7/10/11 5:01 PM, Chris wrote: SPF_PASS,T_DKIM_INVALID,UNPARSEABLE_RELAY shows the dkim signature to be invalid. Is there a reason why that would be? When SA is ran against it a 2nd time then I guess it's failing verification? guess so. you can find out why, and fix it. or, give up and use

Re: whitelist_from_dkim and shortcircuit

On Sun, 2011-07-10 at 16:40 -0400, Michael Scheidell wrote: > On 7/10/11 4:29 PM, Chris wrote: > > 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not > > valid > something is breaking your dkim signature before you get it. > if this is INTERNAL, make sure your split zone dns has y

Re: whitelist_from_dkim and shortcircuit

On 7/10/11 4:29 PM, Chris wrote: 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid something is breaking your dkim signature before you get it. if this is INTERNAL, make sure your split zone dns has your dkim dns entries. google for dkim test email address's. make sur

whitelist_from_dkim and shortcircuit

I seem to be having some issues getting this correct in my local.cf file to get shortcircuit working. For instance, adding whitelist_from_dkim *@us.army.mil when SA is ran against a message that I sent myself from work the output is: -2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at http

Re: Reduce filtering time by white-listing [Mail::SpamAssassin::Plugin::Shortcircuit]

On Thursday 07 July 2011 16:46:42 Andrzej Adam Filip wrote: > Have you considered using Shortcircuit plugin? > Mail::SpamAssassin::Plugin::Shortcircuit Partially I use it. I gave up for anything more than using it with whitelist_from.

Re: Reduce filtering time by white-listing [Mail::SpamAssassin::Plugin::Shortcircuit]

more than some short network tests... > Does what I desire seem as what can be achieved? Or maybe I got > something wrong? Please let me know... Have you considered using Shortcircuit plugin? Mail::SpamAssassin::Plugin::Shortcircuit IMHO it should be capable to deliver what you want. -- [pl>en

How to set right priorities when mixing Multi-scoring ClamAV & Shortcircuit plugins?

as to wait until all those late priority= rules are triggered. Shortcircuit rules are supposed to get low priorities to fire early ifplugin Mail::SpamAssassin::Plugin::Shortcircuit # ClamAV support: no need to scan viruses/malware priority CLAMAV - shortcircuit CLAMAV spam score CLAMA

Re: score=100.0 required=3.0 tests=SHORTCIRCUIT,,USER_IN_BLACKLIST

On 27/01/2011 14:53, J4K wrote: However, spam was not rejected, although I think that this might cause unnecessary backscatter in the case of probably forged From addresses, which is a little unfair. A reject 'in SMTP-session' will not cause backscatter... you have not accepted the message

Re: score=100.0 required=3.0 tests=SHORTCIRCUIT,,USER_IN_BLACKLIST

e false > positives. > > /^X-Spam-Level: / DISCARD This is a spam message > (score 12) > > Shortcircuit is useful as it will not run any other tests (less cpu usage) if > it is sure that message is spam. > > > -Original Message- > From: Bow

Re: score=100.0 required=3.0 tests=SHORTCIRCUIT,,USER_IN_BLACKLIST

On 27/01/2011 13:55, Florescu, Dan Alexandru wrote: Fire up what? Correct me if I'm wrong, but as far as I know SA does not reject at SMTP session level. I myself am using it with amavis and I have: $sa_quarantine_cutoff_level = 12.0; which will drop any spammy message with that score or above i

RE: score=100.0 required=3.0 tests=SHORTCIRCUIT,,USER_IN_BLACKLIST

ou can use header_checks and drop spams there, although you should be warned that false positives will be dropped also. I think SA delivers by default spam-marked messages to avoid these false positives. /^X-Spam-Level: / DISCARD This is a spam message (score 12) Shortcircuit is us

Re: score=100.0 required=3.0 tests=SHORTCIRCUIT,,USER_IN_BLACKLIST

erver.test > X-Spam-Flag: YES > X-Spam-Level: ** > X-Spam-Status: Yes, score=100.0 required=3.0 tests=SHORTCIRCUIT, > USER_IN_BLACKLIST shortcircuit=spam autolearn=disabled version=3.3.1 > X-Spam-Virus: _CLAMAVRESULT_ &

score=100.0 required=3.0 tests=SHORTCIRCUIT,,USER_IN_BLACKLIST

-Status: Yes, score=100.0 required=3.0 tests=SHORTCIRCUIT, USER_IN_BLACKLIST shortcircuit=spam autolearn=disabled version=3.3.1 X-Spam-Virus: _CLAMAVRESULT_ X-Spam-Report: * 0.0 SHORTCIRCUIT Not all rules were run, due to a shortcircuited rule * 100 USER_IN_BLACKLIST From: address is in the user&#

Re: Shortcircuit Rules

On Fri, Oct 30, 2009 at 02:21:10AM -0700, Mynabbler wrote: > > > Alex-325 wrote: > > I'm interested in experimenting with shortcircuiting, and wondered if > > anyone had some examples they're using that they could share? > We are using it to shortcircuit HAM

Re: Shortcircuit Rules

Alex-325 wrote: > I'm interested in experimenting with shortcircuiting, and wondered if > anyone had some examples they're using that they could share? We are using it to shortcircuit HAM and prevent blowing CPU cycles on newsletters that people expect to never contain spam

Re: Shortcircuit Rules

Hi, > I use a number of shortcircuits but they are not in SA they are > in sendmail.cf  They are subject line checks.  I started this > with the Viagra spam, looking at the common permutations of viagra > spelling, such as v!agra, etc. > > Why not block it at the MTA before it even gets to SA - if

Re: Shortcircuit Rules

Alex wrote: Hi, I'm interested in experimenting with shortcircuiting, and wondered if anyone had some examples they're using that they could share? My $0.02 I use a number of shortcircuits but they are not in SA they are in sendmail.cf They are subject line checks. I started this with the

Shortcircuit Rules

Hi, I'm interested in experimenting with shortcircuiting, and wondered if anyone had some examples they're using that they could share? If I understand correctly, the tests involving simple parsing instead of those involving network connections work best due to the inherent overhead with network

Re: partial (lazy) scoring? (shortcircuit features)

Matus UHLAR - fantomas wrote: >> Matt Kettler verizon.net> writes: >> >>> In theory, a feature could be added to let you do something like this >>> (SA doesn't have this feature, but I'm proposing it could be added): >>> > > On 22.09.09 11:46, ArtemGr wrote: > >> That would be a nic

Re: partial (lazy) scoring? (shortcircuit features)

Matus UHLAR - fantomas fantomas.sk> writes: > You haven't read Matt's explanation of why it wasn't a good idea, did you? > > There are rules with negative scores, which can puch the score back to the > ham, e.g. whitelist. Would you like to stop scoring before e.g. whitelist is > checked? I am n

Re: partial (lazy) scoring? (shortcircuit features)

> Matt Kettler verizon.net> writes: > > In theory, a feature could be added to let you do something like this > > (SA doesn't have this feature, but I'm proposing it could be added): On 22.09.09 11:46, ArtemGr wrote: > That would be a nice optimization: most of the spam we receive have a >10 > sc

Re: partial (lazy) scoring? (shortcircuit features)

Matt Kettler verizon.net> writes: > In theory, a feature could be added to let you do something like this > (SA doesn't have this feature, but I'm proposing it could be added): That would be a nice optimization: most of the spam we receive have a >10 score. It seems a real waste of resource to pe

Re: partial (lazy) scoring? (shortcircuit features)

the DCC and RAZOR2 tests. > > Is it possible? > > > Not exactly the way you describe, no. SpamAssassin has a priority and a shortcircuit facility that provide a vaguely similar functionality, but it doesn't really work exactly the way you want. Priority allows you to change

Re: Shortcircuit info

On Mon, 2009-08-31 at 23:47 +0100, RW wrote: > [...] > RCVD_IN_XBL runs only on the last-external, so it rarely hits anything > if the MX server is rejecting on zen. It actually will not hit on anything at all, if you are rejecting based on ZEN -- UNLESS for that very tiny timing window between a

Re: Shortcircuit info

On Mon, 31 Aug 2009 18:17:51 -0400 MySQL Student wrote: > Hi all, > > I'm trying to understand how shortcircuit works to ease some of the > load on the severs. First, does anyone have any recommended metas that > they use in their environment that might help? > > Ca

Shortcircuit info

Hi all, I'm trying to understand how shortcircuit works to ease some of the load on the severs. First, does anyone have any recommended metas that they use in their environment that might help? Can I add shortcircuit to an existing rule, or does the rule have to be designed to be used

Re: [spamassassin-users] shortcircuit

On Mon, 18 May 2009, John Hardin wrote: > On Mon, 18 May 2009, b-sub-...@rope.net wrote: > > > body SA1/dear friend/i > > describe SA1SA - dear friend > > score SA1 13 > > # Score of 12 is enough to classify as spam > > Poison Pill rules are generally a ba

Re: [spamassassin-users] shortcircuit

On Mon, 18 May 2009, b-sub-...@rope.net wrote: body SA1/dear friend/i describe SA1SA - dear friend score SA1 13 # Score of 12 is enough to classify as spam Poison Pill rules are generally a bad idea. If you _truly_ want to implement them, there are be

Re: [spamassassin-users] shortcircuit

b-sub-...@rope.net wrote: > I am implementing a new SA installation. It looks like the shortcircuit > feature would be very useful, in my case. However, in searching the wiki, > google, etc., etc., I have not been able to find a *simple* explicit > example for my use. > > As

[spamassassin-users] shortcircuit

I am implementing a new SA installation. It looks like the shortcircuit feature would be very useful, in my case. However, in searching the wiki, google, etc., etc., I have not been able to find a *simple* explicit example for my use. As I understand it, I should be able to define a rule, and if

Re: [spamassassin-users] shortcircuit

On Sun, 17 May 2009, Matt Kettler wrote: > > Could someone please show me how I could alter this frivilous rule to use > > shortcircuit: > > > > body SA1/dear friend/i > > describe SA1SA - dear friend > > score SA1

Re: [spamassassin-users] shortcircuit

b-sub-...@rope.net wrote: > On Sun, 17 May 2009, Matt Kettler wrote: > > >>> Could someone please show me how I could alter this frivilous rule to use >>> shortcircuit: >>> >>> body SA1/dear friend/i >>> describe SA1

  1   2   >