Re: SPF_FAIL

2020-11-12 Thread Matus UHLAR - fantomas
On Wed, 11 Nov 2020 17:01:21 +0100 On 11.11.20 15:41, RW wrote: >Note that without a DKIM pass, SPF is easily spoofed in TxRep. is it? how does that work then? It's implicit in the next bit. >DKIM reputations are identified by a combination of header from >address and signing domain. SPF pa

Re: SPF_FAIL

2020-11-12 Thread RW
On Thu, 12 Nov 2020 12:34:25 +0100 Matus UHLAR - fantomas wrote: > >On Wed, 11 Nov 2020 17:01:21 +0100 > > > >> On 11.11.20 15:41, RW wrote: > On 11.11.20 19:06, RW wrote: > >These two cases share the same "authenticated" primary reputation: > > > > Return-path: c...@example.com > > From: c

USER_IN_SPF_WHITELIST vs freemails

2020-11-12 Thread Darrell Budic
Got a few of these 411 google form spams recently and was wondering why they weren’t getting caught by SA. Looks like the Return-Path: is triggering a whitelist rule on google.com so the rest of the tests aren’t enough to get it tagged. Anything I can do to keep the whitelist rule from firing wh

Re: USER_IN_SPF_WHITELIST vs freemails

2020-11-12 Thread John Hardin
On Thu, 12 Nov 2020, Darrell Budic wrote: Got a few of these 411 google form spams recently and was wondering why they weren’t getting caught by SA. Looks like the Return-Path: is triggering a whitelist rule on google.com so the rest of the tests aren’t enough to get it tagged. Anything I can

Re: USER_IN_SPF_WHITELIST vs freemails

2020-11-12 Thread Darrell Budic
On Nov 12, 2020, at 11:54 AM, John Hardin wrote: > > On Thu, 12 Nov 2020, Darrell Budic wrote: > >> Got a few of these 411 google form spams recently and was wondering why they >> weren’t getting caught by SA. Looks like the Return-Path: is triggering a >> whitelist rule on google.com so the r

Re: USER_IN_SPF_WHITELIST vs freemails

2020-11-12 Thread John Hardin
On Thu, 12 Nov 2020, Darrell Budic wrote: On Nov 12, 2020, at 11:54 AM, John Hardin wrote: On Thu, 12 Nov 2020, Darrell Budic wrote: Got a few of these 411 google form spams recently and was wondering why they weren’t getting caught by SA. Looks like the Return-Path: is triggering a white

Re: USER_IN_SPF_WHITELIST vs freemails

2020-11-12 Thread RW
On Thu, 12 Nov 2020 11:23:29 -0600 Darrell Budic wrote: > Got a few of these 411 google form spams recently and was wondering > why they weren’t getting caught by SA. Looks like the Return-Path: is > triggering a whitelist rule on google.com so the rest of the tests > aren’t enough to get it tagge

Re: USER_IN_SPF_WHITELIST vs freemails

2020-11-12 Thread Darrell Budic
On Nov 12, 2020, at 12:31 PM, John Hardin wrote: > > On Thu, 12 Nov 2020, Darrell Budic wrote: > >> On Nov 12, 2020, at 11:54 AM, John Hardin wrote: >>> >>> On Thu, 12 Nov 2020, Darrell Budic wrote: >>> Got a few of these 411 google form spams recently and was wondering why they we

Re: USER_IN_SPF_WHITELIST vs freemails

2020-11-12 Thread Darrell Budic
> On Nov 12, 2020, at 1:01 PM, RW wrote: > > On Thu, 12 Nov 2020 11:23:29 -0600 > Darrell Budic wrote: > >> Got a few of these 411 google form spams recently and was wondering >> why they weren’t getting caught by SA. Looks like the Return-Path: is >> triggering a whitelist rule on google.com

Re: USER_IN_SPF_WHITELIST vs freemails

2020-11-12 Thread John Hardin
On Thu, 12 Nov 2020, Darrell Budic wrote: On Nov 12, 2020, at 12:31 PM, John Hardin wrote: I'd have to see a spample to tell whether that would hit your particular case, though. Can you upload an example to pastebin for us? Sure, it’s at https://paste.centos.org/view/045312a7 The line it’

Re: USER_IN_SPF_WHITELIST vs freemails

2020-11-12 Thread RW
On Thu, 12 Nov 2020 13:56:10 -0600 Darrell Budic wrote: > > On Nov 12, 2020, at 1:01 PM, RW wrote: > > > > On Thu, 12 Nov 2020 11:23:29 -0600 > > Darrell Budic wrote: > > > >> Got a few of these 411 google form spams recently and was wondering > >> why they weren’t getting caught by SA. Looks