yes, again Sent from ProtonMail Mobile
On Tue, Oct 31, 2017 at 1:36 PM, David Jones <djo...@ena.com> wrote: >> On Tue, Oct 31, 2017 at 12:00 PM, Rupert Gallagher > wrote: >> Addenda: >> >> >> > From: Invoicing > > >> >> SPF should fail hard here. How do you know >> what the envelope-from domain is from that sample? SPF uses the >> envelope-from not the From: header. The OP may need to install a milter >> depending on the MTA in use to add headers that SA can use for SPF checks. I >> am using policyd-spf and opendmarc to give SA more information from the MTA. >> >>> - Body: attachment without introductory text >>> I do not have a rule >> for this, yet. >>> >>> The default SA returns the following: >>> 0.0 >> TVD_SPACE_RATIO No description available. >>> 0.0 >> TVD_SPACE_RATIO_MINFP Space ratio >>> >>> Our SA returns a big fat spam >> flag. >>> >>> RG >>> My SA scores 18.7 but some of that could have been >> after-the-fact RBL additions since some time has passed. I have some custom >> local rules that add a few points for "invoice" related words in the >> subject. >>> >>> >>>> In all cases, the domain matches the domain in the >> From header. >>>> >>>> So far, the From has always been in the form: >>>> >> Invoicing invoic...@example.com >>>> >>>> The only SA rules that they're >> all hitting are: >>>> TVD_SPACE_RATIO >>>> TVD_SPACE_RATIO_MINFP >>>> >> Install the KAM.cf rules and schedule updates a few times a day. Install DCC >> if not installed and active. Make sure you are getting DCC hits in your mail >> logs. Add the Lashback RBL. I am trying to get this added to the default SA >> rules. See my post on 2017-10-17 in the following link and increase the >> scores after some testing. >> https://bz.apache.org/SpamAssassin/show_bug.cgi?id=6372 Add the >> score.senderscore.com RBL to the MTA or SA. This IP has a score of 15 out of >> 100 so I add 5.0 points for poor reputation. See the SA mailing list >> archives for details. -- David Jones @example.com> @canadianchemistry.ca> >> @canadianchemistry.ca> @protonmail.com> @protonmail.com>
