Re: Does (Unix sockets) spamd still pipe the mail message?

st getting my teeth into NFS, educate me ;^) DAve -- Systems Administrator http://www.tls.net Get rid of Unwanted Emails...get TLS Spam Blocker!

Re: SA 3.01 scoring very low

Sean Doherty wrote: On Wed, 2004-11-03 at 21:40, Dave Goodrich wrote: Good afternoon, I just finished testing an upgrade of SA to 3.01 and my scores fell through the floor. Read the docs, tried to use the Wiki, followed everyone else's upgrade on the list. Not sure just what went wrong. X

Re: SA 3.01 scoring very low

http://bugzilla.spamassassin.org/show_bug.cgi?id=3949 However, the Received: path parsing bug is something I leave up to Dave to file. No need, I rechecked my test message and it had some formatting problems from being transfered off my workstation (Thunderbird) and onto the SA box. I grabbed a couple other mes

Re: SA 3.01 scoring very low

Sean Doherty wrote: On Thu, 2004-11-04 at 14:14, Dave Goodrich wrote: Sean Doherty wrote: I will look into that, I didn't set it as I want no network to be trusted. I'll reread what I can find on that. Just set trusted_network 127.0.0.1 Yes, this fixed it. Since you hit ALL_TRUSTED cer

Re: SA 3.01 scoring very low

) set "dns_available yes", this stopped the testing of dns availability, while still allowing dns tests themselves to run. Of note, setting "skip_rbl_checks 1" does not stop SURBL tests, which is good. Just stops the rbl checks for smtp connections. DAve Matt Kettler wrote: A

Re: SA 3.01 scoring very low

s, in order to define a trusted relay via whitelist_from_rcvd, I first must trust ALL relays, or put all the relays I have in whitelist_from_rcvd into my trusted networks as well. DAve -- Systems Administrator http://www.tls.net Get rid of Unwanted Emails...get TLS Spam Blocker!

Spam with ``=?utf-8?q?'' in From/To/Subject

adding rules (SA 2.63) to match "utf-8" in these fields, but they don't work--apparently SA is decoding them before applying the rules. There's no "rawheader" tag, and "full" seems to only include the body. Is there any way to match these messages? I could upgrade this system to 3.0 if that would help. -Dave

Re: Spam with ``=?utf-8?q?'' in From/To/Subject

Excellent, thanks everyone. The :raw did the trick. I'm upgrading to 3.0, too. -Dave

Spamd cpu issues.

cal/bin/softlimit -a 12800 \ /usr/local/bin/spamd -i 10.0.240.253 -p 1783 -A 10.0.240.0/24 \ -m 10 --max-conn-per-child=200 -u vpopmail -x -q -s stderr 2>&1 DAve -- Systems Administrator http://www.tls.net Get rid of Unwanted Emails...get TLS Spam Blocker!

Re: URIDNSBL on freebsd?

y DNS servers IP addresses in the root file. All local apps use 127.0.0.1 for DNS, and dnscache uses my DNS servers to answer queries not in the cache. No problems. URIDNSBL works fine here. DAve -- Systems Administrator http://www.tls.net Get rid of Unwanted Emails...get TLS Spam Blocker!

Re: quick poll on SURBL hit %

even higher. I watched very closely and finally set my SURBL scores to 5.0 each. I tag at 5.0, so if I hit any SURBL, it's spam. So I guess my average would be 100% ? 12 weeks running, 4000+ users, no complaints, no false positives. DAve -- Systems Administrator http://www.tls.net Get rid o

Re: Using SQL config

I'm new to using SpamAssassin. I've seen that MySQL can be used instead of DB files for different things. Is there a place that shows the database schema etc? Also I'm running Communigate as my email server and I just have one rule set up to check all incoming messages so I don't have a way for

Re: quick poll on SURBL hit %

Jeff Chan wrote: On Wednesday, January 5, 2005, 9:06:37 AM, Dave Goodrich wrote: Chris Santerre wrote: Just curious as to what average percent of spam people see SURBL hitting. In a non scientific manor, I average about 85% or greater hitting SURBL for all spam that doesn't get rejected by m

Re: A very long spam

I try to train as much HAM as I can but I don't think it's possible to train HAM/SPAM equally as 90% of incoming email is SPAM. On Jan 8, 2005, at 1:55 PM, Fajar Priyanto wrote: At 04:34 AM 1/9/2005 +0700, you wrote: Hi all, Greetings. I've just joined the list. I've been using sa-learn with SA 2

Re: spamassassin process a single message for 10 minutes !

DY1, NIGERIAN_BODY2, NIGERIAN_BODY3, NIGERIAN_BODY4, RCVD_IN_BL_SPAMCOP_NET, RISK_FREE, SPF_HELO_PASS, SPF_PASS, URG_BIZ, URIBL_SBL, URIBL_WS_SURBL, US_DOLLARS_3 X-Spam-Level: * X-Spam-Flag: YES Subject: ***SPAM*** real0m0.174s user0m0.001s sys 0m0.003s DAve similar result h

[OT] SA Users and spam folder deliveries.

;d like to run one method of catching the result of spamc and delivering based on the result spamc hands back. I'm concerned about using procmail and system resources/speed, I've never used maildrop, how are others handling delivery after spamc? Thanks, DAve -- Dave Goodrich System

Re: multiple hosts for spamc -d ?

your DNS server sends the results back in a different order each time then it will not be a fallback but a round robin. You might be able to simply use /etc/host entries. I've never tried it as I use qmail which will not use the host file, so I always rely on DNS. Don't know if spamc w

Re: running spamd remotely

spamd on another host that is listening to a socket. You need -i ip.address in your spamd startup. http://spamassassin.apache.org/full/3.0.x/dist/doc/spamd.html DAve But I don't even see anything in syslog on hostB. TIA =-=-=-=-=-=-=-=-=-=- generated by /dev/dave -=-=-=-=-=-=-=-=-=-=-=-=

Re: Detecting short-TTL domains?

amazon and yahoo use a TTL 60sec google uses a TTL of 300sec cnn had 8 A records and a TTL of 600 dave On 10/08/07 19:42, clsgis wrote: > > Jim Maul wrote: >> Stream Service || Mark Scholten wrote: >>> For so far I know it isn't possible to have a TTL that is to low

debug returns misleading information (dns/async)

371] dbg: dns: success for 0 of 24 queries Although all DNS queries were answered (logs says so, and message gets tagged with some RBLs), it still claims that none of the queries were successful. That said the async part says that it got 24 completed queries without starting any! any pointers?

Re: debug returns misleading information (dns/async)

Bug 5581 / patch attachment 4081 seems to solve my problem BTW Mark, very nice DNS timings in debug output :) cheers, dave On 11/08/07 14:25, Dave Mifsud wrote: > Hi guys, > > The following is an excerpt from a "spamassassin -D" output or an actual > spam message: &g

Re: fdf spam

ied 2007-07-27, and you have to actually read the .pm to see that it's now at 0.8. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "NASCAR is a Yankee conspiracy to keep you all placated so the South won't rise again." --QuestionableContent.net

Re: debug returns misleading information (dns/async)

nefit of others trying to find out what I was referring to) :) dave -- Dave Mifsud Systems Engineer Computing Services Centre University of Malta CSC Tel: (+356) 2340 3004 CSC Fax: (+356) 21 343 397

Re: Question - How many of you run ALL your email through SA?

t;pre SA", reject filtering only, or full content > filtering with SA. A surprising number prefer to use just the more > basic checks and deal with what gets through with their mua. > > -Aaron > What's the default option for users? Dave -- Dave Mifsud Systems Engineer Computin

Re: How do I temporarily disable SpamAssassin?

t the commands aren't found? They're right there in the > directory? Root typically uses a fixed PATH that doesn't include the current directory (for security reasons). Try giving it an explicit path: ./clamav-clamd.sh stop or /usr/local/etc/rc.d/clamav-clamd.sh stop and that

Re: How do I temporarily disable SpamAssassin?

with qmail I'm no help to you here. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "Jon, the CIA's credibility has never been lower. Crazy people no longer believe the CIA is implanting a chip in their heads to listen to their dreams. They just don't think they can pul

Re: Bouncing emails from certain countries

oles.us to block based on sender countries. Lying about why the message was rejected is going to be something you have to do in your MTA, and I'd consider it an extremely bad idea because it's going to make troubleshooting difficult. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "

Re: Posioned MX is a bad idea [Was: Email forwarding and RBL trouble]

> If > someone is sending email using one of my domains I want people verifying > the sender addresses. So do you run your servers with VRFY enabled? -- Dave Pooser Cat-Herder-in-Chief Pooserville.com "Jon, the CIA's credibility has never been lower. Crazy people no longer

Re: Posioned MX is a bad idea [Was: Email forwarding and RBL trouble]

> On Sat, 25 Aug 2007, Dave Pooser wrote: >> >> So do you run your servers with VRFY enabled? > > Yes. If you are verifying addresses at RCPT time, which you must to avoid > spam blowback, then there's no point disabling VRFY. Except that I can verify addresses af

Re: Posioned MX is a bad idea [Was: Email forwarding and RBL trouble]

all my MX as ?.mx.$my_domain and there is no reason > why this should be indicative of anything. > he literally means *.mx.*, not something.mx.something: > dig yheweathernetwork.com mx ;; ANSWER SECTION: yheweathernetwork.com. 9807IN MX 0 *.mx.*. dave -- Dave Mifsud Syste

Re: autolearn=failed

are running spamd as? What happens if you do a: chmod 1777 /usr/spamassassin and then retest? Strong suggestion, do -not- put your bayes stuff into a directory that contains other SA components. Best to have a directory in your "/var" partition just for the bayes stuff. -- Dav

Re: FPs for SUBJECT_FUZZY_MEDS

r the score or create a meta rule that checks for Medzinarodny and if it is present and SUBJECT_FUZZY_MEDS hits adds a negative score equal to the SUBJECT_FUZZY_MEDS score. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "The one thing I never want to see again is a military parade." --Ulysses S. Grant

Re: bayes_seen = 256GB

Theo and all. I know this topic comes up on occasion, but I am not sure I've ever seen an explanation as to why the bayes_seen file is not auto pruned along with the bayes db file. Since tokens expire in the main DB file, what is the purpose of having a seen file to unlearn tokens which may have

Re: bayes_seen = 256GB

30 day purge should be more than safe for most anyone and bets a non-expiry system. Michael Parker wrote: > Dave Koontz wrote: > >> Theo and all. I know this topic comes up on occasion, but I am not sure >> I've ever seen an explanation as to why the bayes_seen file is

SpamAssassin 3.1.9 not catching any emails

Hi all, As part of an ³Ensim² (Linux control panel) installation, I¹m running the Ensim-provided install of SpamAssassin 3.1.9. Unfortunately, I¹m finding that no emails are being caught as spam. Whilst I¹m sure that Ensim is doing some non-standard stufff around SpamAssassin, I¹m wondering if a

Re: OT - massive newsletter

If I might ask, where are you getting the list "SEED" addresses from? It's hard for me to imagine you have such a large number of users that have already requested information you have not configured to send yet. If this is a purchased list of addresses ... you may have some problems quickly. Re

Re: SpamAssassin 3.1.9 not catching any emails

Hi Tom, > From: Tom Ray <[EMAIL PROTECTED]> > Date: Fri, 21 Sep 2007 13:05:02 -0400 > To: Dave Addey <[EMAIL PROTECTED]> > Cc: > Subject: Re: SpamAssassin 3.1.9 not catching any emails > > Dave Addey wrote: >> Hi all, >> >> As part of an ³Ens

Re: sender name same as recipient name

rk tests? Assuming your timestamps are accurate all of these should have hit on one or more URIBL rules. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "...Life is not a journey to the grave with the intention of arriving safely in one pretty and well-preserved piece, but to slide across th

Re: SpamAssassin 3.1.9 not catching any emails

l it but failing every time? Dave. > From: Dave Addey <[EMAIL PROTECTED]> > Date: Mon, 24 Sep 2007 11:03:44 +0100 > To: > Conversation: SpamAssassin 3.1.9 not catching any emails > Subject: Re: SpamAssassin 3.1.9 not catching any emails > > Hi Tom, > >> From

Re: R: R: URIWhois-0.02

If nothing else, you should likely add a disclaimer to your rules as you can't control the threshold at which a site may be blocked for excessive queries. I doubt that most users on this list have email volumes as low as yours (100?), and will go well above the thresholds you've tested. I am a wh

Re: R: R: R: URIWhois-0.02

Thanks for the explanation, but I think you are missing the point here. What is reasonable and what will cause a block? An individual may well issue 100 queries a day for research. Not many have the time to do tens of thousands+ a day (or more). Any system that does will likely fall into the AU

Re: New domains (was: URIWhois plugin)

ical matter we'd be talking about a multi-gigabyte zone file and I expect that would prove a little problematic for whatever sucker^H^H^H kind soul ended up hosting the thing. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "...Life is not a journey to the grave with the intentio

Re: newbie question: scan msgs smaller than certain size

Reject spam scoring 10+ deny message = Message blocked by our spam filter.\nEmail <[EMAIL PROTECTED]> with questions. condition = ${if <{$message_size}{100K}{true}{false}} spam = nobody:true condition = ${if >{$spam_score_int}{99}{1}{0}} --

LashBack URL / BL?

Does anyone use the LashBack URL as an MTA BL block or SA rule? I just discovered them and they sound intriguing. Any feedback on their reliability and FP rate would be appreciated. I am a little concerned that I've never heard of them before.. http://www.lashback.com/support/UnsubscribeBlac

Re: BAYES_99 on all mail

Do you have Auto Learning enabled? That helps balance the number of ham and spam messages your system learns. My experience has been that the Bayes database does this eventually if it's feed far more spam than ham. If your spam level is very high, you may want to look at both auto-learn as well

Re: Forward Conformed Reverse DNS troubleshooting tool

Umm... this is nice, however, your main page doesn't look so good. http://ipadmin.junkemailfilter.com/ returns: Fedora *Test Page* Might want to fix that! ;-) Marc Perkel wrote: > http://ipadmin.junkemailfilter.com/rdns.php > > You might want to bookmark this page. Try it out and see if your

Re: the opposit of "ok_locales" ??

s. Then he shouldn't be tweaking SpamAssassin conf files, or most other server settings. The world has enough Mouse Clicking System Engineers. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "...Life is not a journey to the grave with the intention of arriving safely in one pretty and

RE: BOTNET 0.8 + SA 3.2.3

I am running Botnet 0.8 with SA 3.2.3 without issue. Try a fresh install of all Botnet files. -Original Message- From: UxBoD [mailto:[EMAIL PROTECTED] Sent: Friday, January 11, 2008 5:45 AM To: Arthur Dent Cc: users@spamassassin.apache.org Subject: Re: BOTNET 0.8 + SA 3.2.3 I am runni

Re: BOTNET 0.8 + SA 3.2.3

Arthur Dent wrote: Nope sorry.. Please confirm... that your botnet.pm file is where your other plugin PM modules reside. And that the botnet.cf file is where your custom rules live (may be a different path depending on configuration). Make sure the botnet.cf is in the same directory as y

Re: URIBL

I remember there was a period of time when dozens of URI delist requests were submitted all together without any detail. Could that have been the case with your reports? Theo Van Dinter wrote: FWIW, I used to report FP domains to URIBL daily until I was told to stop because there were too ma

Please help with rule

I am still getting some Storm Worm messages that are not being caught, even with Sane Security / ClamAV. I thought I'd write a rule to score any URL that has a dot exe, scr or pif extension. However, my rule is not working. Can someone help advise what is wrong? I want it to pickup any http

Please help with rule

I am still getting some Storm Worm messages that are not being caught, even with Sane Security / ClamAV. I thought I'd write a rule to score any URL that has a dot exe, scr or pif extension. However, my rule is not working. Can someone help advise what is wrong? I want it to pickup any http

Re: [OT] Yahoo Deferred

Ditto, please share any resolve should you get one. This has been an ongoing problem for us for well over a year now. Ramprasad wrote: Tony Bunce wrote: Sorry for the Off Topic thread but I’m at a loss Is anyone else having issues sending mail to Yahoo? They are returning 421 Message tempo

RE: Please help with rule

contains executable content scoreDANGEROUS_URL7.5 Joseph Brennan Wrote: --On Saturday, February 23, 2008 23:08 -0500 Dave Koontz <[EMAIL PROTECTED]> wrote: > I am still getting some Storm Worm messages that are not being caught, > even with Sane Security / ClamAV. I thought

Re: [Fwd: Re: No SPF_FAIL flag, why?]

the envelope-from address is interpolated into the headers as the Return-path header during the delivery process). -- Dave Funk University of Iowa College of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center Sys_admin/Postmaster

Re: [Fwd: Re: No SPF_FAIL flag, why?]

(make sure that the domain name represents a valid domain via DNS). In that case the message should have been blocked at the MTA and never even made it to SA. -- Dave Funk University of Iowa College of Engineering 319/335-5751 FAX: 319/384-0549

Bayes not run ?

I just noticed that for some reason only some of my messages are actually being run through Bayesian classifying. I am not sure how long this has been occuring. I did a google search which did not turn up much as to what could cause this. One suggestion was there was not enough processing thr

Re: Bayes not run ?

Justin Mason wrote: The only indication is SA's X-Spam-DataBase: Bayes not run. header. SpamAssassin doesn't add a header like that... what are you using: spamd, MailScanner, amavisd? --j. I use a product called MDaemon, which has a windows port of SA. Perhaps my header mapping in l

Re: Bayes not run ?

r per-user dbs? if the latter, maybe there just isn't enough training for bayes to be active? Try getting debug logs from SpamAssassin -- they'll fill you in on the reason (although I'm not sure if MDaemon allows you to do that). --j. Dave Koontz writes: Justin Mason wrote: Th

RE: Bayes not run ?

CTED] [mailto:[EMAIL PROTECTED] Sent: Friday, March 07, 2008 10:47 AM To: Dave Koontz Cc: Justin Mason; users@spamassassin.apache.org Subject: Re: Bayes not run ? aha -- that's being added by SpamAssassin alright, then, due to the add_header line. Are you using 1 global Bayes db, or per-us

Re: Howto stop SPF_FAIL from internal network?

> An SPF_PASS is pretty worthless But awfully handy for whitelist_from_spf. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com

Re: relays.ordb.org returning positive for everything?

s systems suddenly started rejecting all mail. That PROVES that he was still using the dead RBL and needed the clue-by-4 along side the head to wake him up. This is not the first time an expiring RBL resorted to that technique and probably will not be the last (sad to say). -- Dave Funk

Re: Dramatic increase in bounce messages to forged addresses

s do try to avoid using forged addresses from domains that publish DKIM/SPF records; that's a simple check they can run to increase the chance of their spew hitting inboxes instead of /dev/null. -- Dave Pooser Cat-Herder-in-Chief,Pooserville.com "Jon, the CIA's credibility has never be

Re: whitelist_from_rcvd not working

us SA will not accept that for whitelist_from_rcvd. You have two choices, either get 213.183.100.11 to DNS map to gw.dtdm.tomsk.ru or use some other whitelist method such as whitelist_from_spf (which will work as there are matching SPF records published for dtd

Re: Upgrading

ed the "local.cf" file and I'm trying to restart spam assassin. I write: /etc/init.d/# spamassassin restart But I get: Unable to open restart: No such file or directory [snip..] so /etc/init.d/spamassassin restart or so cd /etc/init.d/ ./spamassassin restart Linux basics. ;)

RE: Blocking all inline GIF or JPG Images

John D. Hardin Wrote: >"inline" is an HTML-format email with text and images interspersed. >When the message is rendered the images will be embedded in the message body text. > >"attached" is the images attached like any other type of file. > >I have had exactly one instance to use inline images

RE: Blocking all inline GIF or JPG Images

John, if you have absolute authority to your network and what format your users can receive/send email, then you may want to look at the 'DEMIME' project. Perhaps you can use it to convert all user email to plain text and remove any and all attachments as a part of your filtering. I use this to

Re: Image spams getting thru

with that were both HTML and text WITH images and they came through perfect without hitting the rule. I will be keeping a close eye on this one as these have seemed to elude every other method. If I see more success, I will be increasing the score. Thanks Derek! -- Here to serve, Dave Aug

Re: ImageInfo plugin for SA

Pardon the question but how are you generating these stats? Dave On Thu, 2006-08-03 at 21:35 -0400, Theo Van Dinter wrote: > On Thu, Aug 03, 2006 at 07:05:52PM -0500, Dallas L. Engelken wrote: > > > I made some major edits (1/3 smaller and also faster :) ), > > > but

RE: ImageInfo plugin for SA

Many Thanks Dallas, this plugin Rocks! It's amazing how many image only spams this baby has flagged in the short time I've been running it. -Original Message- From: Dallas L. Engelken [mailto:[EMAIL PROTECTED] Sent: Thursday, August 03, 2006 4:14 PM To: dev@spamassassin.apache.org Cc: u

RE: Image spam with inline jpeg image

Perhaps it could be as simple as only updating existing rules for your installation? In other words, you would have to download the CF file and install it first (but you would do this anyways to test!!!). Then sa-update could simply parse your rules directory and update rules found there accordin

Re: DNSing MX to 127.0.0.1: Ruleset (or something) for this?

steal the time to set up my exim/SA filtering gateway I'll check out using that list for ignore_target_hosts as well. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "And the beer I had for breakfast Wasn't bad, so I had one more for dessert."

Re: Should this hit more rules?

an get an idea of which (if any) might be keepers for me? My Perl-fu is weak enough that just reading the rules text isn't necessarily helpful. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "Someone once asked me if I had learned anything from going to war so many times. My reply: Yes, I learned how to cry." -- War correspondent Joe Galloway

Re: FuzzyOcr 2.3b released, fixes bugs and improves stability

> I can see it now: spammers reduced to sending obfuscated text rendered > as an animated GIF embedded in a Word document in a Zip file attached > to an email whose subject is "Invoice #437892" with no body text... :) And 500,000 people would STILL buy what they're selli

Suse OpenExchange forwarding to Microsoft Exchange

I can do on the Linux side to avoid this? If not, does anyone know what to do on the Exchange side? Thanks, -- Dave Higgins Secure64 Software Corporation Englewood, Colorado [EMAIL PROTECTED] -- Old programmers never die, they just branch to a new address. begin:vcard fn:Dave Higgins n:Higgins;Da

SA Bayes and secondary MX/ gateway MX

TA (CommuniGate Pro) is much more limited in its anti-spam capabilities. In that case, I have a similar concern, specifically relating to MTA differences. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "Sarcasm Error: Abort, Retry, Bite Me?" -Legostar Galactica

Re: Q. about spam directed towards highest MX Record?

since I got ImageInfo.pm working properly I haven't noticed any spam make it through mail3 unscathed. -- Dave Pooser Cat-Herder-in-Chief Pooserville.com "Dogs are what puppies turn into if you don't eat 'em before they go all stringy." --Sgt. Schlock

Re: sa-learn and "Caught" spams

atever. My own theory is "Learn 'em all and let Bayes sort 'em out." -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "NOTHING says love like a monkey. It's a fuzzy screeching bundle of tenderness!" -- QueenOfWands.net

Re: use of ram after upgrade

> 4.7M Oct 10 03:00 blacklist-uri.cf Remove this and use URI blacklists instead. Notice how this rule's size is orders of magnitude greater than any of the others you listed? Same goes for its RAM footprint. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "...Life is not a j

Re: Any comments of the SpamHaus lawsuit?

tion and out of US hands. > Where's the problem? The only problem I see is the spammy scumbags get to claim a victory. They'll be lying, of course, but still. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "Yup, that's the citrusy taste of failure all right."

Re: Concerned with scores for from rfc-ignorant.org

scenarios. Rules that hit a lot of spam for me would hit a lot of ham for a stockbroker. That's why you can adjust scores in local.cf. If your experience is that the RFCI rules aren't hitting any spam, then disable them. But to dismiss them as useless for anyone because they're use

Re: Scanning aliases for spam

ll be. So the general answer is to look at your incoming MTA and see how you can fit SA into that (different MTAs have different sets of options available to them). This is similar to the question of how to SA filter mail for an Exchange server (no procmail there ;). Dave --

Re: What's with UCEPROTECT List?

e same microsecond, after all. Have you actually seen a server DOSed by sender callouts, ever? I never have and I've ever heard of one -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "And the beer I had for breakfast Wasn't bad, so I had one more for dessert."

EvalTest failures

L is enabled or disabled makes no difference. Any assistance? Google isn't of much help for once. dave

Re: EvalTest failures

nd completely avoids this problem. Thanks, guys, I appreciate the suggestions and I'll give them a shot, first by upping the timeout and then by moving everything to sql. dave

Bayes works when run manually, but not under procmail

deas what could be wrong?  Also, I tried changing my procmail recipe to this to capture debug output, but no file gets created: :0fw | $HOME/sauser/bin/spamassassin -D 2>> $HOME/sa.log Any help would be greatly appreciated. -- Dave Mabehttp://dave.runningland.com

Re: What countries to block ?

acklisted" to "your host $HOST is on a network from which we do not normally accept email" to avoid adding insult to injury, and to minimize confusion. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "NOTHING says love like a monkey. It's a fuzzy screeching bundle of tenderness!" -- QueenOfWands.net

Re: What countries to block ? and detectng Trojan attachments?

am I'd just unplug my mail server. I don't block *.nl, or any of western Europe, based on country, but they do get a +2 on the SA score. It seems to work in my specific situation, which is all I can ask for. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com A computer lets you mak

Re: OT: Spammers' reactions to rejection

> I would vote that these "legitimate mailing list" are not so > legitimate if they can't clean up bounces after several years of > getting them. Legitimate != well-run. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "In our family, happy usually involves gu

Re: Spam not getting tagged as Spam

a LOT of false positives. All those rules you're using are calibrated for a threshold of 5. If I understand you correctly when you say "The score is 3" you should probably give serious consideration to raising your threshold. -- Dave Pooser Cat-Herder-in-Chief Pooserville.com "Dogs

Re: Bye Bye Bayes

> I used to have a couple of users who treated their Trash folder as > long-term read-message storage. I have a user like that at $DAYJOB. I used to ask him if he kept his car title and other important documents in the wastebasket under his desk at home. -- Dave Pooser Cat-Herder-in

Re: accept only gpg/pgp mail

dmdm wrote ... (3/7/2009 2:07 PM): > What lines lines would need to be added and in which file > to accept only gpg/pgp encrypted and non-ecrypted signed emails to my admin > account? > (debian lenny mail server amavisd-new) > > dmdm > > Wrong list. SA does not accept nor reject emails, it only

Re: Suddenly bouncing emails

OMAIN results. Best practice is to run a DNS instance on your mail server for its exclusive use to avoid that sort of problem. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "You know a nice little side benefit of watching women's sports? Sitting in front of the TV for a while w

Re: Spam Assassin White List

safer in a world where spammers forge "From:" addresses constantly. -- Dave Pooser Cat-Herder-in-Chief, Pooserville.com "You're useless when you're high on catnip, you know that?"

Re: Spam Assassin White List

> Is there a blacklist_noauth? Because it seems that would be far more > useful for paypal. > > blacklist_auth *paypal* You whitelist_auth paypal.com and then a rule that scores +50 for From contains *...@paypal.com -- quick and easy. -- Dave Pooser Cat-Herder-in-Chief, Pooservill

Suggestions on Rules and SA config location in Plesk?

an ignorant control panel for a couple of the options - then writes to what I'm really after - but leaves no clues as to where that file is to attempt to edit it! Unless it's then compiled, which may run faster but is annoying, so how do I get it in a plain form - edit - then recompile? Also not in docs I could find after an exhaustive search. Thanks! Dave PSCGi

Re: Suggestions on Rules and SA config location in Plesk?

- Original Message - From: "Kris Deugau" To: "SpamAssassin Users List" Sent: Thursday, March 26, 2009 4:04 PM Subject: Re: Suggestions on Rules and SA config location in Plesk? Dave Duffner wrote: OK, apparently when I had an Ensim box it was long ago in

Re: 20_dnsbl_tests.cf

Michael Hutchinson wrote ... (4/7/2009 7:09 PM): > I have made some changes to my SA 3.1.7 20_dnsbl_tests.cf when I > compared it to the 3.2.5 release. I basically just removed 2 DNSBL > lookups that are redundant. This is done in attempt to solve an issue > random scan times of 30 seconds plus. Wh

Re: Phishing

Hi Thomas! Casartello, Thomas wrote ... (4/24/2009 8:05 PM): > > One major issue we’ve been having lately is with phishing emails being > targeted at us. They’re being sent to us from hacked accounts at other > educational institutes. The message usually is about “Your EDU webmail > account is exp

Re: Phishing

John Hardin wrote ... (4/25/2009 12:06 PM): >> A phisher would send emails to a large number of people saying, >> literally, "I am your email administrator, your account is to be >> suspended, please send me your username and password". >> >> DKIM will not work, > > BAYES should work quite well. >

<    2   3   4   5   6   7   8   9   >