On Tue, Oct 31, 2017 at 12:00 PM, Rupert Gallagher <r...@protonmail.com
<mailto:r...@protonmail.com>> wrote:
Addenda:
> From: Invoicing <invoic...@canadianchemistry.ca
<mailto:invoic...@canadianchemistry.ca>>
SPF should fail hard here.
How do you know what the envelope-from domain is from that sample? SPF
uses the envelope-from not the From: header.
The OP may need to install a milter depending on the MTA in use to add
headers that SA can use for SPF checks. I am using policyd-spf and
opendmarc to give SA more information from the MTA.
- Body: attachment without introductory text
I do not have a rule for this, yet.
The default SA returns the following:
0.0 TVD_SPACE_RATIO No description available.
0.0 TVD_SPACE_RATIO_MINFP Space ratio
Our SA returns a big fat spam flag.
RG
My SA scores 18.7 but some of that could have been after-the-fact RBL
additions since some time has passed. I have some custom local rules
that add a few points for "invoice" related words in the subject.
In all cases, the domain matches the domain in the From header.
So far, the From has always been in the form:
Invoicing invoic...@example.com <mailto:invoic...@example.com>
The only SA rules that they're all hitting are:
TVD_SPACE_RATIO
TVD_SPACE_RATIO_MINFP
Install the KAM.cf rules and schedule updates a few times a day.
Install DCC if not installed and active. Make sure you are getting DCC
hits in your mail logs.
Add the Lashback RBL. I am trying to get this added to the default SA
rules. See my post on 2017-10-17 in the following link and increase the
scores after some testing.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=6372
Add the score.senderscore.com RBL to the MTA or SA. This IP has a score
of 15 out of 100 so I add 5.0 points for poor reputation. See the SA
mailing list archives for details.
--
David Jones
