On Mon, 5 Aug 2019 15:40:45 +0200
hg user wrote:
> I'm trying to understand why this rule fires on some messages:
> metaPHISH_ZIMBRA ( __ZIMBRA_00 + __ZIMBRA_01 + __ZIMBRA_02 +
> __ZIMBRA_03 > 2 ) && __NOT_FROM_INTERNAL
What are these rules?
I noticed that the rules come from compiled bundle... as soon as I modified
them adding one dummy word, spamassassing used the new "interpreted" ones
and now the matched words are listed...
so, is it normal that compiled rules don't output debug matches?
how can I disable the compiled rules?
On
I'm trying to understand why this rule fires on some messages:
metaPHISH_ZIMBRA ( __ZIMBRA_00 + __ZIMBRA_01 + __ZIMBRA_02 +
__ZIMBRA_03 > 2 ) && __NOT_FROM_INTERNAL
I read it in this way:
IF at least THREE rules among __ZIMBRA_00, 01, 02 or 03 are matched AND
rule __NOT_FROM_INTERNAL is
On Tue, 30 Sep 2014 09:47:41 +0200,
Matus UHLAR - fantomas wrote:
> Do you trust smtp.cesky-hosting.cz?
> Even if it's open socks and http proxy server?
I wonder if slovensky-hosting.sk does better :-P
--
Please *no* private copies of mailing list or newsgroup messages.
Local Variables:
mode:c
On Mon, 29 Sep 2014 20:16:28 +0200
A. Schulze wrote:
> I wonder why RCVD_IN_SORBS_HTTP and RCVD_IN_SORBS_SOCKS fire up.
> https://wiki.apache.org/spamassassin/Rules/RCVD_IN_SORBS_SOCKS tell me
>This check tests the IP address of the *last untrusted relay*
>
> for me the last untrusted relay *
Matus UHLAR - fantomas:
Do you trust smtp.cesky-hosting.cz?
Even if it's open socks and http proxy server?
No, I don't.
But I initially wonder why sa looked up the external submission host
while docu say "last untrusted relay" which it isn't.
Andreas
On 29.09.14 20:16, A. Schulze wrote:
today I was pointed to a message with these headers:
X-Spam-Score: 6.789
X-Spam-Status: Yes, score=6.789 tag=-999 tag2=5 kill=6
tests=[HTML_MESSAGE=0.001, MISSING_MIMEOLE=1.843,
RCVD_IN_SORBS_HTTP=2.499, RCVD_IN_SORBS_SOCKS=2.443]
Received: from
On September 29, 2014 10:02:06 PM "A. Schulze" wrote:
> Trusted network and internal network in local.cf for all your own
> ipv6, ipv4 :)
ups, I had no settings at all for trusted/internal/msa networks :-/
Remember to add non routeble ips aswell this will speedup rbl checking
127.0.0.1 is h
Benny Pedersen:
Trusted network and internal network in local.cf for all your own
ipv6, ipv4 :)
ups, I had no settings at all for trusted/internal/msa networks :-/
Thanks for the pointer
Andreas
On September 29, 2014 8:16:28 PM "A. Schulze" wrote:
for me the last untrusted relay *should be* smtp.cesky-hosting.cz
but it looks like sa think it's 90.182.154.138
what settings I should check?
Trusted network and internal network in local.cf for all your own ipv6, ipv4 :)
In case of fine
Hello,
today I was pointed to a message with these headers:
X-Spam-Score: 6.789
X-Spam-Status: Yes, score=6.789 tag=-999 tag2=5 kill=6
tests=[HTML_MESSAGE=0.001, MISSING_MIMEOLE=1.843,
RCVD_IN_SORBS_HTTP=2.499, RCVD_IN_SORBS_SOCKS=2.443]
Received: from smtp.cesky-hosting.cz (smt
Kai Schaetzl wrote:
Per Jessen wrote on Fri, 18 Jul 2008 12:40:27 +0200:
[^a-z](P[^a-z]{0,4}A[^a-z]{0,4}Y[^a-z]{0,4}I[^a-z]
Pay88)
Regex Coach doesn't complain about it, but don't you need a quantifier
after the first [^a-z] range?
no, the default quantifier is {1,1}.
as said earlier, th
Per Jessen wrote on Fri, 18 Jul 2008 12:40:27 +0200:
> [^a-z](P[^a-z]{0,4}A[^a-z]{0,4}Y[^a-z]{0,4}I[^a-z]
> Pay88)
Regex Coach doesn't complain about it, but don't you need a quantifier
after the first [^a-z] range?
Kai
--
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Servi
Per Jessen wrote:
body PND_STOCK_PAYI /[^a-z](P[^a-z]{0,4}A[^a-z]{0,4}Y[^a-z]{0,4}I[^a-z]
Pay88)/i
(all on one line of course).
In SA3.2.5, I get the following message:
[5183] info: config: invalid regexp for rule PND_STOCK_PAYI: /[^a-z
(P[^a-z]{0,2}A[^a-z]{0,2}Y[^a-z]{0: missing or invalid de
Jari Fredriksson wrote:
>> body PND_STOCK_PAYI
>> /[^a-z](P[^a-z]{0,4}A[^a-z]{0,4}Y[^a-z]{0,4}I[^a-z]
>> Pay88)/i
>>
>> (all on one line of course).
>>
>> In SA3.2.5, I get the following message:
>>
>> [5183] info: config: invalid regexp for rule
>> PND_STOCK_PAYI: /[^a-z
>> (P[^a-z]{0,2}A[^a-z
Per Jessen wrote:
body PND_STOCK_PAYI /[^a-z](P[^a-z]{0,4}A[^a-z]{0,4}Y[^a-z]{0,4}I[^a-z]
Pay88)/i
(all on one line of course).
In SA3.2.5, I get the following message:
[5183] info: config: invalid regexp for rule PND_STOCK_PAYI: /[^a-z
(P[^a-z]{0,2}A[^a-z]{0,2}Y[^a-z]{0: missing or invalid de
> body PND_STOCK_PAYI
> /[^a-z](P[^a-z]{0,4}A[^a-z]{0,4}Y[^a-z]{0,4}I[^a-z]
> Pay88)/i
>
> (all on one line of course).
>
> In SA3.2.5, I get the following message:
>
> [5183] info: config: invalid regexp for rule
> PND_STOCK_PAYI: /[^a-z
> (P[^a-z]{0,2}A[^a-z]{0,2}Y[^a-z]{0: missing or invalid
body PND_STOCK_PAYI /[^a-z](P[^a-z]{0,4}A[^a-z]{0,4}Y[^a-z]{0,4}I[^a-z]
Pay88)/i
(all on one line of course).
In SA3.2.5, I get the following message:
[5183] info: config: invalid regexp for rule PND_STOCK_PAYI: /[^a-z
(P[^a-z]{0,2}A[^a-z]{0,2}Y[^a-z]{0: missing or invalid delimiters
With SA3.1
He's hitting on 2 different DUL rules, because he's sending directly from
his DSL IP to your S/A server. You need to whitelist his IP address, or
otherwise have it bypasss S/A scanning.
On Tue, 5 Dec 2006, John Tice wrote:
> I have a new client whose mail is scoring way high... several others
>
I have a new client whose mail is scoring way high... several others
on the same server, different domains, score in negative numbers.
Mail sent through a mail script on this domain scores -1.0. I believe
they're using verizon dsl, windows xp w/ outlook or outlook express.
This is just goin
wrote on Sun, 13 Mar 2005 01:57:18 -0300:
> So, I redirect those messages to me and I received them as no spam again!
>
As I just wrote to "GRP Productions": Bayes doesn't work this way.
Kai
--
Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com
Citando Matt Kettler <[EMAIL PROTECTED]>:
> At 11:57 PM 3/12/2005, you wrote:
> >So, I redirect those messages to me and I received them as no spam again!
>
> Define exactly what you mean by "redirect those messages". What specific
> actions did you do?
I used redirect tool from webmail (hord
Hi everyone!
Probably I'm doing a stupid question... but, anyway, here it go:
I saved in a folder some messages that I received classified as no spam. So, i
run these command:
sa-learn --spam
So I take the following :
Learned from 2 message(s) (3 message(s) examined).
So, I redirect those messa
Thanks for straightening me out. The RFC's are certainly clear on this. I
was just being dense. I've run that header into IMail from outside (without
the folding) and all is well. I'll report the bug to the globalpay.com
postmaster.
Thanks again.
Dan
Subject: RE: What's wro
At 12:33 PM 10/21/2004, Dan Barker wrote:
09 Message-ID:
<[EMAIL PROTECTED]
10 ay.com>
11 X-MS-Has-Attach:
12 X-MS-TNEF-Correlator:
13 Thread-Topic: 4 Candles - A Beautiful Message
14 Thread-Index: AcS3BWlt5dySvEvTSWeuRuweMuzolAAY/hRA
15 From:
16 To:
17 and up ...
Newlines with a number (nnS
Well, I've just rolled out SA to my IMail server (Windoze, gaaagh!) and my
hook to pass to SA also copies the input to a flat file. I can
rerun/edit/inspect anything that my nightly "kill -3days" hasn't yet hit.
Nice feature for this sort of thing. Maybe I'll keep it.
The input file begins:
00 Re
Here is the rule from 3.0
header __SANE_MSGID MESSAGEID =~ /^<[^<>\\ [EMAIL PROTECTED]<>\\
\t\n\r\x0b\x80-\xff]+>\s*$/m
header __HAS_MSGID MESSAGEID =~ /\S/
header __MSGID_COMMENT MESSAGEID =~ /\(.*\)/m
meta INVALID_MSGID __HAS_MSGID && !(__SANE_MSGID || __MSGID_COMMENT)
describe INVALID_MSGID
At 09:15 AM 10/21/2004 -0400, you wrote:
I can't for the life of me see anything wrong with:
Message-ID:
<[EMAIL PROTECTED]>
It looks to me like 2822 sez:
First, I'm assuming that line break before the < is an artifact of your
mail client, and isn't in the real message. (This is one reason why
co
SpamAssassin (default settings except a few score's) 3.0.0 sez:
1.1 INVALID_MSGID Message-Id is not valid, according to RFC 2822
I can't for the life of me see anything wrong with:
Message-ID:
<[EMAIL PROTECTED]>
It looks to me like 2822 sez:
message-id= "Message-ID:" msg-id CRLF
29 matches
Mail list logo
