google domains spam

2021-02-28 Thread Matus UHLAR - fantomas
Hi gyus, last time I received too many spam with links to sites.google.com and goo.gl redirects. The sites.google.com website containg "report" links, however after about a week of reporting them all, spam containing the same site comes and the site is not removed. The goo.gl does not seem to c

AskDNS with a DNAME

2021-02-28 Thread Michael Grant
I'm trying to use a rule like this: askdns RBL_SENDGRID_ID _SENDGRIDID_.sendgrid-id.localhost A 127.0.0.2 where I have this in my db.local running bind9: sendgrid-id IN DNAMEsendgrid-id.LICENSEKEY.invaluement.com. where LICENSEKEY is a valid license key. I can query this on the c

AskDNS with a DNAME

2021-02-28 Thread Damian
I don't know about AskDNS, but this technique works with stock spamhaus rules via spamhaustech. I have a local spamhaus.net zone with a DNAME record as their nameservers block me anyway. You could try with an invaluement.com zone at least temporarily as a comparison to AskDNS.

Re: AskDNS with a DNAME

2021-02-28 Thread Michael Grant
On Sun, Feb 28, 2021 at 02:14:55PM +, Damian wrote: > I don't know about AskDNS, but this technique works with stock spamhaus rules > via spamhaustech. I have a local spamhaus.net zone with a DNAME record as > their nameservers block me anyway. > You could try with an invaluement.com zone at

Re: AskDNS with a DNAME

2021-02-28 Thread Giovanni Bechis
On Sun, Feb 28, 2021 at 07:38:22AM -0500, Michael Grant wrote: > Ultimately I want the spamassassin report in the headers but I don't > want the license key in there. > you can set 'tflags net nolog' if you are using trunk. Invaluement uri and license key will be printed as *redacted*. Giovanni

Re: google domains spam

2021-02-28 Thread Benny Pedersen
On 2021-02-28 12:26, Matus UHLAR - fantomas wrote: How can I make SA to rbl-check for subdomain, not just google.com domain? 2nd tld cf file or https://github.com/spamhaus/spamassassin-dqs/blob/master/SH.pm#L78 change SH.cf to sh_local.cf to your own rbldnsd the sh.pm module have more funti

Re: AskDNS with a DNAME

2021-02-28 Thread Michael Grant
On Sun, Feb 28, 2021 at 03:53:33PM +0100, Giovanni Bechis wrote: > On Sun, Feb 28, 2021 at 07:38:22AM -0500, Michael Grant wrote: > > Ultimately I want the spamassassin report in the headers but I don't > > want the license key in there. > > > you can set 'tflags net nolog' if you are using trunk.

Re: AskDNS with a DNAME

2021-02-28 Thread John Hardin
On Sun, 28 Feb 2021, Michael Grant wrote: I've traced through the AskDNS plugin and it's definitely only looking at the first response that gets returned in this case. I also tried a regex submatch like: askdns RBL_SENDGRID_ID _SENDGRIDID_.sendgrid-id.localhost A /127.0.0.2/ and still not

Re: AskDNS with a DNAME

2021-02-28 Thread RW
On Sun, 28 Feb 2021 07:42:42 -0800 (PST) John Hardin wrote: > On Sun, 28 Feb 2021, Michael Grant wrote: > > > I've traced through the AskDNS plugin and it's definitely only > > looking at the first response that gets returned in this case. I > > also tried a regex submatch like: > > > > askdns

Re: AskDNS with a DNAME

2021-02-28 Thread John Hardin
On Sun, 28 Feb 2021, RW wrote: On Sun, 28 Feb 2021 07:42:42 -0800 (PST) John Hardin wrote: On Sun, 28 Feb 2021, Michael Grant wrote: I've traced through the AskDNS plugin and it's definitely only looking at the first response that gets returned in this case. I also tried a regex submatch li

Re: AskDNS with a DNAME

2021-02-28 Thread RW
On Sun, 28 Feb 2021 10:33:15 -0500 Michael Grant wrote: > On Sun, Feb 28, 2021 at 03:53:33PM +0100, Giovanni Bechis wrote: > > On Sun, Feb 28, 2021 at 07:38:22AM -0500, Michael Grant wrote: > > > Ultimately I want the spamassassin report in the headers but I > > > don't want the license key in t

Re: AskDNS with a DNAME

2021-02-28 Thread Michael Grant
> > askdns RBL_SENDGRID_ID > > _SENDGRIDID_.sendgrid-id.MYLICENSE.invaluement.com A 127.0.0.2 > > describe RBL_SENDGRID_ID Sendgrid Id blacklist tflags > > RBL_SENDGRID_ID net nolog > > > > askdns RBL_SENDGRID_DOM > > _SENDGRIDDOM_.sendgrid-efd.MYLICENSE.invaluement.com A 127.0.0.2 > > des

Re: AskDNS with a DNAME

2021-02-28 Thread Giovanni Bechis
On Sun, Feb 28, 2021 at 10:33:15AM -0500, Michael Grant wrote: > On Sun, Feb 28, 2021 at 03:53:33PM +0100, Giovanni Bechis wrote: > > On Sun, Feb 28, 2021 at 07:38:22AM -0500, Michael Grant wrote: > > > Ultimately I want the spamassassin report in the headers but I don't > > > want the license key

docusign changes

2021-02-28 Thread Alex
Hi, I have a number of rules that checks for the existence of legitimate docusign links and general weirdness (like the lack of a legitimate To address or to undisc-recips), but it doesn't work for this legitimate docusign email: https://pastebin.com/tZthJnb2 Somehow it's sending to hel...@gmail

Re: docusign changes

2021-02-28 Thread RW
On Sun, 28 Feb 2021 14:17:08 -0500 Alex wrote: > Hi, > > I have a number of rules that checks for the existence of legitimate > docusign links and general weirdness (like the lack of a legitimate To > address or to undisc-recips), but it doesn't work for this legitimate > docusign email: > > htt