Scoring Based on IP Address

2020-12-17 Thread Matt
Is there a way with spamassassin local.conf to add a higher score based on source ip address or subnet? Basically the last IP in "Received:" header. bad_subnet_add_20_points: 192.168.240.0/24 Raising the score if that IP appeared anywhere in headers or body might work too.

Re: How the hell barracuda behaves?

2010-08-18 Thread Matt
;even increase my false positive rate' Perhaps for authenticated SMTP not record the IP address in the headers but rather just the authenticated username in the headers. I think Squirrelmail does that. Your MTA logs will have the IP recorded if needed later. Matt

Re: How the hell barracuda behaves?

2010-08-18 Thread Matt
> By the way I'm not a big fan of registering my servers to any private > entity in order to improve "deliverability". Register our servers here: www.dnswl.org Do not really use it for scoring but do not grey list any servers listed. Matt

Re: A new paradigm for DNS based lists

2010-12-29 Thread Matt
Could a similiar thing be accomplished with a simple list of free email provider etc. domains and checking there SPF or DKIM records and if they pass bypassing any other DNS lists? So any email from hotmail.com, gmail.com, yahoo.com, etc. if there SPF or DKIM passes skip any further DNS tests?

Re: Greylisting delay (was Re: Q about short-circuit over ruling blacklisting rule)

2011-01-19 Thread Matt
>> The legitimate mail that passes through my mail server comes from >> hosts / networks I might not hear from again for months, by which >> time I have to potentially wait 24 hours for the greylisting / mail >> server to try again. I run greylisting on an email server with several thousand email

Re: Greylisting delay (was Re: Q about short-circuit over ruling blacklisting rule)

2011-01-19 Thread Matt
The legitimate mail that passes through my mail server comes from hosts / networks I might not hear from again for months, by which time I have to potentially wait 24 hours for the greylisting / mail server to try again. >> >> I run greylisting on an email server with several th

Should Emails Have An Expiration Date

2011-02-28 Thread Matt
I think this would be a great idea. Many end users never bother to delete old emails and on some, such as sales etc, there is no valid reason for them to countinue to waste disk and server space. http://www.zdnet.com/news/should-emails-have-an-expiration-date/6197888

Re: Should Emails Have An Expiration Date

2011-02-28 Thread Matt
Looking at top 8 newest messages from my personnel email account: Newsletter Magazine Renwal Offer Ebook Update Notice Travel Deal of Week Sales Flyer with weekly specials Reply to forum thread Anouther Newsletter Custommer Service Response. Etc. Hmm. All of these could really expire at 30 day ma

Re: Should Emails Have An Expiration Date

2011-02-28 Thread Matt
>> Looking at top 8 newest messages from my personnel email account: > > [Spammy subjects deleted] None of them are SPAM. If I wanted to unsubscribe from them I would. Its just if I do not read them within 30 days why keep them. > It looks like you need some sort of anti-spam system.  Maybe > so

DKIM Checks

2011-05-18 Thread Matt
I am running spamassassin-3.2.5-1.el5 on 64 bit CentOS. sa-update -D seems to indicate that the DKIM libraries are installed. May 18 10:25:02.682 [15134] dbg: diag: [...] module installed: Digest::SHA1, version 2.11 May 18 10:25:02.682 [15134] dbg: diag: [...] module installed: HTML::Parser, vers

Re: DKIM Checks

2011-05-18 Thread Matt
>> Looking at the X-Spam-Report on various messages and I never see that >> its looked at.  I see that SPF is checked and scored.  Any idea why >> its not checking the DKIM signatures? > > Check the file v312.pre and see if the "loadplugin" line for DKIM is > commented out.  If it is, uncomment it

Re: Lots of Chinese Spam with attachments

2011-08-05 Thread Matt
Most seem to get through for me. What are you doing to catch them? I added this too local.conf and it did not help at all: #ok_languages en es fr de cs da lv nl pl sv ok_languages en TextCat appears to be enabled in v310.pre: # TextCat - language guesser # loadplugin Mail::SpamAssassin::Plugin

Re: Lots of Chinese Spam with attachments

2011-08-05 Thread Matt
>> Hear is the typical hits I get on a message: >> >> X-Spam-Status: No, score=3.4 required=5.0 tests=BODY_8BITS,HTML_MESSAGE, >>        MIME_HTML_ONLY,RCVD_IN_BRBL_LASTEXT,RP_MATCHES_RCVD,SPF_PASS >> autolearn=no >>        version=3.3.1 > > ... >> >> X-Spam-Status: No, score=4.6 required=5.0 tests

Re: Lots of Chinese Spam with attachments

2011-08-05 Thread Matt
> Most here score along this: > > X-Spam-Status: Reqd:5.0 Hits:14.6 Tests:BODY_8BITS=1.5 >        CHARSET_FARAWAY_HEADER=3.2 HTML_MESSAGE=0.001 MIME_CHARSET_FARAWAY=2.45 >        MIME_HTML_ONLY=1.105 MISSING_HEADERS=1.207 RCVD_IN_BRBL_LASTEXT=1.644 >        TVD_SPACE_RATIO_MINFP=0.674 UNWANTED_LANG

Skipping Blacklists

2012-06-27 Thread Matt
Is there a way to tell SA to skip blacklist checks against certain IP pools? I still want all other tests run but the IP may be listed in SORBS-DUHL and others due to being dynamic.

Re: Spamhaus and others check at MTA level: how disable in Spamassassin?

2012-08-04 Thread Matt
we are using zen.spamhaus.org and psbl.surriel.com DNSBL at MTA level (qmail + rblsmtpd) so we would like to disable this check in spamassassin. So we added this in local.cf: > > and, since DNS is cached anyway, why bother disabling them? +1 Doubt it costs anything to run both plac

RDNS_NONE

2012-08-15 Thread Matt
I have messages marked as such: RDNS_NONE Delivered to internal network by a host with no rDNS Problem is they very clearly have reverse and matching forward DNS that Exim even agrees on. Why is SA tagging them as such?

Re: How to report a spam botnet

2012-11-20 Thread Matt
> Spamhaus already do this. It's called the Exploits Block List (XBL): > > http://www.spamhaus.org/xbl/ > > To quote: > > The Spamhaus Exploits Block List (XBL) is a realtime database of IP > addresses of hijacked PCs infected by illegal 3rd party exploits, including > open proxies (HTTP, socks, An

Re: Greylisting (was Re: "Fairly-Secure" Anti-SPAM Gateway Using OpenBSD, Postfix, Amavisd-new, SpamAssassin, Razor and DCC ? Can I get your opinion?)

2012-11-29 Thread Matt
>> I've never had any >> complaints about delivery speed, but some senders have broken mail >> servers that don't retry on receiving a temporary failure. > > Many such servers use broken SMTP implementations that can't handle > a 4xx code in response to RCPT properly. > > We greylist after the end

Re: Greylisting (was Re: "Fairly-Secure" Anti-SPAM Gateway Using OpenBSD, Postfix, Amavisd-new, SpamAssassin, Razor and DCC ? Can I get your opinion?)

2012-12-03 Thread Matt
>> We greylist after the end of DATA. This wastes bandwidth, but lets us >> use the Subject: line as an additional mix in the greylisting tuple. >> This catches ratware that retries in the face of greylisting, but >> mutates the subject line with each retry. > We use grey listing on our low volum

Re: "Fairly-Secure" Anti-SPAM Gateway Using OpenBSD, Postfix, Amavisd-new, SpamAssassin, Razor and DCC ? Can I get your opinion?

2012-12-03 Thread Matt
>> You will probably want to put a little effort into maintaining lists >> of regular correspondents who can bypass greylisting. There may be >> tools to automate that, e.g. to whitelist someone a local user has >> sent mail to. > > Has anyone looked into the use of a DNS-based white listing servic

Port 587 Scanning

2012-12-04 Thread Matt
I am using Exim directors to call Spamassassin. I do not scan messages that come in on port 587 or are in my popb4smtp file. This was done due to some of those IP's being on DUL blacklists and getting flagged. Is there a way to tell SA to skip certain tests if the message came in on authenticate

USPS Spam

2013-08-30 Thread Matt
I am seeing tons of junk getting through claiming to be from the USPS about a missed delivery package. Anyone else seeing this? I am running SpamAssassin 3.3.1 and execute sa-update weekly.

Mail SPF Check

2014-02-25 Thread Matt
When doing sa-update -D I get this: dbg: diag: [...] module not installed: Mail::SPF ('require' failed) What do I need to get this on Centos? I see this: # yum list available |grep -i spf libspf2.x86_64 1.2.9-1.el6.rf rpmforge libspf2-devel.x86_64

Improving Results

2014-03-10 Thread Matt
I am running Spamassassin 3.003002 and sa-update -D indicates I have these modules installed. module installed: Digest::SHA1, version 2.12 module installed: HTML::Parser, version 3.64 module installed: Net::DNS, version 0.65 module installed: NetAddr::IP, version 4.027 module installed: Time::HiRe

Question on spamassassin not catching mails

2004-10-01 Thread Matt
or 4.5 and is spam. I have the bigevil files and a bunch of the other files from the rules emporium but still things don't seem to be getting marked. Any pointers? I am running spamassassin 2.64 at the moment. ~ matt

Can anyone explain these e-mails (and how to stop them)?

2004-10-06 Thread Matt
We've been getting some of these e-mails (see attached) and I'm wondering how to stop them. They are totally not in english so I'm struggeling... --- Begin Message --- Title: ÐÐÑÐÐÐÑÐ Ð ÐÐÑÐÐÐÑÐÑÐ ÐÐ     Matthew Kiessling Chilitech Internet Solutions 570-323-21

Re: Can anyone explain these e-mails (and how to stop them)?

2004-10-06 Thread Matt
Uggg.. that didn't come through right.. let me try this again.. they look like this: ÐÐÑÐÐÐÑÐÑÑ ÐÐÐÑÑ ÐÐÐÑÑÑ ÐÑÐ ÐÑÐÐÑÐÐ, ÐÐÐÑÑÐÐ ÑÐÐÑÐÑÑÑÑ ÐÐÑÑÐÐÑÐÐÑÑÑ. ÐÐÐ ÐÐ ÑÐÐÐÑÑÐÑÑ ÐÑ Ð ÐÐÑÐÑÐ Ð ÐÑÐÐÐÑÐ ÐÐÑÐÐÐÑÐÐÐ ÐÐÐÑÑ Ð ÐÐÑÐÐÐÑÐÑÑ ÐÐÑ, Ñ ÐÐ ÐÐÐÑÐÑÐÐÐ ÐÐÐÑÑ ÑÑÑ ÐÑÑÐÐÐÑÐÑÑ

New blacklist with URI

2004-10-08 Thread Matt
Hi, I have a question on the new(ish) scanning that spamassassin does on URI's.It seems to be working very well for us here, but I have a question.. WIll it catch: http://www.blah.com/?jj38942 as well as http://www.blah.com/?34223 We are beginning to notice alot of e-mails (being marked ri

Strange mail causing 2.64 to not scan or scan really long?

2004-10-15 Thread Matt
: Thread-Topic: Problem with Mail? thread-index: AcSvpdPjK6iINjJWQQWdVehj1wUvDgDPs2Nw Importance: normal Priority: normal From: "Durman, Michael R." <[EMAIL PROTECTED]> To: "Matt" <[EMAIL PROTECTED]> Return-Path: <[EMAIL PROTECTED]> X-OriginalArrivalTime: 15 Oct 2004 18:29:

Re: Strange mail causing 2.64 to not scan or scan really long?

2004-10-18 Thread Matt
What's odd is it DOES take 600 seconds every time it's sent.. what's additionally wierd is this person's mail server keeps sending the message over and over.. once an hour... (we're working on that with him). He's the only one in the millions of emails we handle every day that is having this issue

Running a "mock" spamassassin run?

2004-10-20 Thread Matt
Hi, Is there anyway that I can get spamassassin to run in "mock" mode? That is, to only log what would be marked, but to not actually mark it? I basically want to test the mail server to see what messages would be marked and which ones would not.

Question on using SpamAssassin at a college?

2004-10-25 Thread Matt
Hi, Does anyone have experience with using spamassassin and rule sets at a college environment? We'd like to block just mail that is one hundred percent spam, and not risk blocking false positives. Any thoughts or ideas?

Problems with SURBL and catching stuff..

2004-11-02 Thread Matt
Hi, Perhaps someone can help here. I have recently added the SURBL functionality to my SpamAssassin installation, and things seem to work wonderfully. However, we do on a fairly regular basis seem to be the "first" to get hit with the spam. What I mean is that spamassassin will catch it only

Re: Problems with SURBL and catching stuff..

2004-11-03 Thread Matt
I figured as much (that the messages just weren't in the SURBL lists, but I'd still like to find a way to mark them =) Here attached is one that looks alot like the ones that come through (my apologies... clean your eyes out with soap afterwards). This account that received it is kinda a 'spam t

Re: Problems with SURBL and catching stuff..

2004-11-03 Thread Matt
I'll be more then h appy to report them, but is there anything we can do to get spamassassin to detect them more? On Wed, 3 Nov 2004 04:51:21 -0800, Jeff Chan <[EMAIL PROTECTED]> wrote: > On Wednesday, November 3, 2004, 4:45:24 AM, Matt Matt wrote: > > > > I figured

Re: Problems with SURBL and catching stuff..

2004-11-03 Thread Matt
th the detection of these 'image' only spams? On Wed, 3 Nov 2004 05:13:35 -0800, Jeff Chan <[EMAIL PROTECTED]> wrote: > On Wednesday, November 3, 2004, 5:09:24 AM, Matt Matt wrote: > > I'll be more then h appy to report them, but is there anything we can > > do

Slightly OT: How to get Outlook To stop screwing messages up

2004-11-03 Thread Matt
Hi, As much as I hate Outlook, I have to support it.. ugh.. Is there anyway to get the full source and message, from outlook without having to view source, then view headers? I want the full untainted source as I can get from other quality mail programs like mozilla, and thunderbird.

Re: Slightly OT: How to get Outlook To stop screwing messages up

2004-11-03 Thread Matt
Yeah that views the headers.. the problem is that to get the un-munged message in raw format you can't touch the header/body combo and need to get it as is. On Wed, 3 Nov 2004 12:46:59 -0800, Raquel Rice <[EMAIL PROTECTED]> wrote: > On Wed, 3 Nov 2004 13:58:10 -0500 >

Score 10 - Mail Rejected?

2004-12-06 Thread Matt
What do I need to do to send a sample spam to the list and have it get through? I think I just got blocked: This is an automatically generated Delivery Status Notification Delivery to the following recipient failed permanently: users@spamassassin.apache.org Technical details of failure: P

Odd hanging on mail servers

2005-01-15 Thread Matt
Hello, I am running SpamAssassin version 2.64... yes I know it's a little old but it serves well and I've been a bit scared to upgrade to 3.0... will be doing that soon now that things seem to be running well for people... My issue is that spamd seems to be hanging on me.. I can't quite tell where

Re: Odd hanging on mail servers

2005-01-17 Thread Matt
Seems to chug on through it.. doesn't hesitate at all.. yet if I turn spamassassin scanning on.. the mail server starts lagging so bad it's not even funny.. On Fri, 14 Jan 2005 21:35:50 -0600, Keith Whyte <[EMAIL PROTECTED]> wrote: > Hi Matt, maybe you could try running

URIBL_SBL

2005-01-18 Thread Matt
an3/Mail::SpamAssassin::Plugin::URIDNSBL.3pm So I think its there, right? I see no hits on this though and I have a large amount of traffic on this box, 600+ email users. Any idea what I have set wrong? Matt

Re: URIBL_SBL

2005-01-18 Thread Matt
, 2005, 6:01:28 PM, Matt Matt wrote: I have SpamAssassin 3.0.2 installed on Fedora Core 2 release. How do I get URIBL_SBL to work? I see in "25_uribl.cf": # Requires the Mail::SpamAssassin::Plugin::URIDNSBL plugin be loaded. # Note that this plugin defines a new config setting, 'uri

Re: URIBL_SBL

2005-01-18 Thread Matt
ow? Thanks. Matthew From: Matt Subject: URIBL_SBL Date: Tue, 18 Jan 2005 00:19:44 -0600 I just installed the latest version of 0.48 Net::DNS and still no go. This is how I start Spamd in rc.local. /usr/bin/spamd -d -c -m 5 This is running under Exim Exiscan. Looks like it uses spamc -u to connec

Re: URIBL_SBL

2005-01-18 Thread Matt
Works now. Thanks. Matt Matt install Net::DNS from CPAN perl -MCPAN -eshell install Net::DNS the RH RPMs are nortious at sticking stuff in stupid places that only other RH RPM based packages can see. -- Martin Hepworth Snr Systems Administrator Solid State Logic Tel: +44 (0)1865 842300 Matt

Re: Odd hanging on mail servers

2005-01-20 Thread Matt
Ahh ha! Got it.. it seems to be domains that either the name servers are not responding.. or the domain doesn't exist yet.. for instance: debug: DNS MX records found: 0 Is there anyway to get around this? It seems to hang and do this twice for long enough to delay the system... any thoughts?

Re: Odd hanging on mail servers

2005-01-20 Thread Matt
Ok that works great if you KNOW the domain.. but what do you do when this happens once every 3 or 4 days to random domains? On Thu, 20 Jan 2005 20:30:18 +0100, Chr. von Stuckrad <[EMAIL PROTECTED]> wrote: > On Thu, Jan 20, 2005 at 01:47:12PM -0500, Matt wrote: > > Ahh ha! Got it..

Specific user settings on virtual user accounts

2005-02-25 Thread Matt
Hi, Is there anyway with spamassassin to have it use settings that users's have set on mail servers where the user's accounts are virtual?

Porn E-Mail

2005-02-28 Thread Matt
Has anyone noticed lately a higher then normal amount of porn spam getting through?I've seen alot of it that seems to be hitting the customer base as of late.. marked only by the SURBL... but those that aren't SURBLed yet.. get through with a score of like 2.3 Return-Path: <[EMAIL PROTECTED]>

Re: Porn E-Mail

2005-02-28 Thread Matt
Hrmm well that could do it: pts rule name description -- -- 1.3 SARE_HOUSEWIVESBODY: Mentions housewives, as in porn or in-home biz 0.8 HTML_30_40 BODY: Message is 30% to 40% HTML 0.0 HTML

Re: Porn E-Mail

2005-02-28 Thread Matt
As just an aside.. has anyone noticed a more massive amount of spam lately then normal? Seems in gmail as well as my ISP I am logging a whole lot more spam then normal. On Mon, 28 Feb 2005 14:10:16 -0500, Chris Santerre <[EMAIL PROTECTED]> wrote: > > >Has anyone noticed lately a higher then nor

Greylisting

2005-03-02 Thread Matt
wide setup, but rather would like to do it on a per-user basis. Any thoughts? ~ Matt

spamassasin global bayes database

2005-03-02 Thread Matt
What do I have to do to get spamassassin to use a global bayes database for all users on the system, rather then per user?

Issue with bayes and users

2005-03-11 Thread Matt
I'm tyring to use a global bayes database... but when user's try to feed it spam a nd ham with sa-learn it does the following... right now I even have the bayes directory set 777 just to debug.. what am I doing wrong? debug: Score set 0 chosen. debug: running in taint mode? yes debug: Running in t

sa-learn help

2005-03-17 Thread Matt
have these addresses cover all domains and users on the server. Is that possible? Thanks Matt

Effectiveness

2005-03-23 Thread Matt
iveness of Spamassassin? Thanks. Matt

Re: Effectiveness

2005-03-23 Thread Matt
to test how well my spam scanning is working. Seems strange after even being completely dead for several years the crap keeps coming. It has not even been used as a real email address in likely over 4 years. Matt 500 spams/day?! Wow. I've had this address for something like 7 years. I

Re: Effectiveness

2005-03-23 Thread Matt
extra rules from www.rulesemporium.com/rules, auto updated with rules_du_jour. make sure the surbl URI-RBL's are active. They are. Which rule sets should I choose from those below? This domain is for a small ISP so has a diversity of users. Thanks. Matt # Here are some of the rul

Restarting SPAMD

2005-03-24 Thread Matt
in /etc/init.d/ that would support just doing "spamd start" and "spamd restart", etc? Where can I find a copy if so? Thanks. Matt

Re: Restarting SPAMD

2005-03-24 Thread Matt
c.d/init.d entry for starting and stopping spamd using the "service" script as with "service spamassassin restart". None on mine. Otherwise you have to use kill and the command below. So: /usr/bin/spamd -d -c -m 5 -r /var/run/spamd.pid Do I need to invoke it like that so I can kill

rewrite_subject 0 lint: 1 issues detected

2005-03-24 Thread Matt
d. please rerun with debug enabled for more information. I understand it is due to SA 3.0.2 no longer supporting "rewrite_subject 0". Question is how do I fix it? Matt

Re: Effectiveness

2005-03-24 Thread Matt
lost some setting? February 12 seems to be about the last day they worked. At least I see no more URIBL in SPAM headers anymore. Any ideas? Thanks. Matt If SURBLs are active you should be detecting at least 90% of spams (more like 99+%). The rules above are SARE rules, not SURBL ones, BTW

Re: Effectiveness

2005-03-24 Thread Matt
rt" then it all works. Whats the deal, any ideas? For now I have added a spamd restart to cron.daily just in case. THanks. Matt If SURBLs are active you should be detecting at least 90% of spams (more like 99+%). The rules above are SARE rules, not SURBL ones, BTW. In order to use SUR

Re: Effectiveness

2005-03-24 Thread Matt
This server connects to the Internet through an AT&T managed Cisco 3640 so the network should be up instantly. Although it runs as its own DNS server. Perhaps named is not fully up when SPMAD starts? Is there something like "cron.fiveminutesafterbootup" that I can do a spamd res

Re: Effectiveness

2005-03-26 Thread Matt
Thanks. That fixed all my troubles! Matt I'd just add... dns_available yes ...to your local.cf file. This server connects to the Internet through an AT&T managed Cisco 3640 so the network should be up instantly. Although it runs as its own DNS server. Perhaps named is not fully up w

Re: Effectiveness

2005-03-26 Thread Matt
"blacklist_to" appears to add 10 points to spam score. I would like to change it so it adds 20 points. How would I do that? Reason being that way "blacklist_to" messages will always be scored high enough to trigger them to be bayes auto_learn spam. Matt Add th

Re: Effectiveness

2005-03-28 Thread Matt
That worked but your right it has no effect on the autolearn=spam. Any idea how I get it to autolearn all email to a given address as spam? Matt score USER_IN_BLACKLIST_TO 100.0 or whatever score you want Dunno if the bayes auto-learner works with blacklist_to rules; it doesn't work with

Re: Bombarded by German political spam

2005-05-17 Thread Matt
Does anyone know the logic behind this spam bombing? I have a friend who has a gmx.de account and he has gotten 0 german spam in it... yet here in the u.s. we are getting bombarded by the spam.

DCC Troubles

2007-08-14 Thread Matt
I am getting this continuously in my maillog log file running exim and sa. dccproc[18723]: open(/var/dcc/map): Permission denied I have DCC installed. [EMAIL PROTECTED] ~]# rpm -qa | grep dcc -i dcc-1.3.57-0.rhel4 Any idea what is wrong? Matt

Re: DCC Troubles

2007-08-15 Thread Matt
le > Show the settings regarding dcc in your local.cf? Nothing regarding dcc in local.cf. Matt

Re: Mail server hosted by Comcast

2007-08-16 Thread Matt
server and does not appear to > come from a dynamic address. If you use smtp.comcast.net as outgoing I doubt you even need reverse DNS on your IP. Just be sure you update your SPF record to include smtp.comcast.net or something. Everyone has an SPF record, right? Matt

Re: Mail server hosted by Comcast

2007-08-20 Thread Matt
~all" But not sure. You need to look at all the mail coming out from your server flowing through smtp.comcast.net and see that its source is always one of the a record IP's for smtp.comcast.net. Matt

Re: Question - How many of you run ALL your email through SA?

2007-08-21 Thread Matt
n about blocking there email. This server works in an ISP setting so must deal with 1500+ unique custommers who have differing ideas on how there email should be filtered. I just add headers and knock priority on hits to low so they can filter easilly with OE or there email client of choice. Matt

Whitelisting IP's

2007-08-27 Thread Matt
I have a file on my server that contains a list of IP's that have successfully authenticated to my server with POP3. /etc/virtual/pophosts Its updated on the fly by popb4smtp. I would like spamassassin to treat all the IP's in this file as trusted networks on the fly. Anyway to do that? Matt

Re: OT: Spamtraps

2007-09-18 Thread Matt
tc doesnt seem to > work Try posting to alt.test and other newsgroups. Look at spam you receive for removal form links. Google for more spamtrap info. Matt

Tweaking Rules

2008-01-28 Thread Matt
? The RDNS_DYNAMIC worries me a bit since I know a few email servers hosted on dynamic looking reverse DNS's. Matt

Re: [OT] Yahoo Deferred

2008-02-25 Thread Matt
> Is anyone else having issues sending mail to Yahoo? Yes. I have heard using Domainkeys or DKIM helps greatly? Is that true? We have not implemented it yet but do use SPF records which are much easier to implement with Exim or any MTA and do mostly the same thing if you ask me. Matt

Re: [Fwd: Re: No SPF_FAIL flag, why?]

2008-02-27 Thread Matt
MTA says helo this [EMAIL PROTECTED] Thats what SPF looks at. The MTA then adds that as the return path to the headers. >>Return-path: <[EMAIL PROTECTED]> That return path looks flaky. I would think spamassassin would have some way of since its not a valid domain consider it suspect. Not sure though. Matt

Re: [OT] Yahoo Deferred

2008-02-28 Thread Matt
= 10s log_message = Sender $sender_address rate $sender_rate / $sender_rate_period excedes limit delayed 10 seconds It does not work as well when using webmail since messages all appear to come from 127.0.0.1. I did find a plugin for Squirrelmail that limits max recipients and messages sent

Whitelisting IP's

2008-03-07 Thread Matt
's in that file? Right now I have it setup in Exim to just not scan messages from those IP's but I think it would be better to scan and whitelist them that way bayes would have more good messages to learn from. Or will it help bayes any? If not I'll just leave it the way it is. Matt

Re: Whitelisting IP's

2008-03-08 Thread Matt
you/your > clients to use standard SMTP authentication This seemed like a great solution but naturally did not work. My popb4smtp database is just a flat file that contains IP addresses. POPAuthPlugin wants a "access.db style hash file" which I do not have. Any fix for that? Matt

Re: foreign spam slipping through

2008-04-03 Thread Matt
How do I unsubscribe from here? There are no unsubscribe links at the bottom of these messages. On Thu, Apr 3, 2008 at 4:12 PM, Caleb Cushing <[EMAIL PROTECTED]> wrote: > the attached email is one of the mails that keeps slipping through. > > I have no idea what it says, or why it continues to s

Was "One large image" now is "several small images"

2006-06-15 Thread Matt
It seems the spammers have gotten smart to the fact that we were filtering for one large image and no text... now what I am seeing is that the spammers are sending many small images inline with the e-mails!But, I have yet to see a way to filter against this. Any thoughts?

Re: How to detect current images-only messages?

2006-06-21 Thread Matt
On 6/21/06, Matt <[EMAIL PROTECTED]> wrote: Ditto... having the same problem. Here are the headers from one.. it got only a 2.0! Is there somethign I can do to just block any inline images? C{UT} Received: from ntmail2.shscares.org (10.193.16.28 [10.193.16.28]) by ntmail1.shscares.or

Blocking all inline GIF or JPG Images

2006-06-27 Thread Matt
Hi, What would I need to do to just outright block all e-mail that has an inline gif or jpg (or multiple ones)?

Re: Blocking all inline GIF or JPG Images

2006-06-27 Thread Matt
: Tuesday, June 27, 2006 08:09 > To: users@spamassassin.apache.org > Subject: Re: Blocking all inline GIF or JPG Images > > From: "Matt" <[EMAIL PROTECTED]> > > > Hi, > > What would I need to do to just outright block all e-mail > that has an > > i

Re: Blocking all inline GIF or JPG Images

2006-06-27 Thread Matt
An inline gif is INLINE with HTML.. an attached GIF is attached to the message and the message is in MIME-text format. HTML does not belong in e-mails. On 6/27/06, Stuart Johnston <[EMAIL PROTECTED]> wrote: Matt wrote: > 1 - No legit e-mail should have in-line gifs.. they should be

Re: Q. about spam directed towards highest MX Record?

2006-10-18 Thread Matt
Just to clarify here You are talking about doing something like: domain.com 1200 IN MX 10 smtp-1.domain.com domain.com 1200 IN MX50 smtp-2.domain.com You all are saying that most of the spam should be coming in MX 50 right? I have to admit I've tried this, but it seems l

Re: Q. about spam directed towards highest MX Record?

2006-10-18 Thread Matt
We tried that and had problems with some clients (the business client not the mail client). Seems a lot of Exchange servers will try the lowest priority MX for some reason, and then never try the highest, just fail. With the current setup a valid message will eventually get through. DAve Isn't

spamd keeps crashing

2005-10-13 Thread Matt
I just upgraded to the new spamassassin: SpamAssassin version 3.1.0 running on Perl version 5.6.1 Every hour or so spamd is dieing I ran it in debug mode and got this when it died... can anyone explain what is going on, or point me where to look for more info? [19863] warn: prefork: select

Re: Webmail spammers

2009-03-02 Thread Matt
Using Ratelimit in Exim MTA and plugin "Restrict Senders" in Squirrelmail slows them down. Spammers need to send out large number of messages to get any payback. Limiting the number they can send with a compromised account really makes that account of no value to them. Matt On Sun, M

Re: sa-compile

2009-04-16 Thread Matt
user11m38.879s sys 0m37.250s matt

Re: sa-compile

2009-04-16 Thread Matt
RobertH wrote: matt, wouldnt deleting the ~./spamassassin folder also delete the bayes data in many circumstances? Yes this would - this was purely for testing purposes - as Justin said in a previous email some information is cached in that folder so I deleted it to make sure that it

Re: sa-compile

2009-04-17 Thread Matt
Karsten Bräckelmann wrote: Would constructing it using a binary (or n-ary, with small upper bound of n) tree speed the compilation up? Err, Matt, just had a very brief look at the code and the resulting metas, but -- how is that different? :) The result is exactly the tree

Re: emailBL

2009-04-28 Thread Matt
pdate channel for this for some time the details are on Julian Field's blog (he wrote a script to do what Regexp::Assemble does) http://www.jules.fm/Logbook/files/anti-spear-phishing.html matt

Re: Code Rot?

2009-04-28 Thread Matt
ounts..... matt

Re: Another yukky email

2009-05-19 Thread Matt
http://www.backscatterer.org/ May help. Here's another e-mail that got through SpamAssassin: > > http://rafb.net/p/cFMnIy61.html > > As you can see I've effectively disabled the BAYES_00 rule as it's giving > false credit to a ton of backscatter crud messages, but is there really a > way to bloc

Barracuda Blacklist

2009-05-28 Thread Matt
Is there a reason the Barracuda blacklist is not in the official checks by Spamassassin yet? I keep thinking sometime "sa-update -D" will add it but have yet to see it. Matt

sa-update recently failing with gpg error

2009-07-16 Thread Matt
7;t seen anyone else mention this I am thinking maybe I need to update something, although I am not sure what. Matt -- GnuPG Key ID: 0xC33BD882 aim: beyondzero123 yahoo msg: beyondzero123 I do not want to die without any scars. -Tyler Durden

  1   2   3   4   5   6   7   8   9   10   >