You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by John Minnihan <jb...@freepository.com> on 2007/02/20 03:48:45 UTC
Custom To: rule variant to exclude matches?
SA Team,
I have a fully functional SA installation that is serving me very
well. I use Mailscanner and a few custom rules, and am generally very
pleased with the results.
There’s one more rule that I’d like to run, but haven’t figured out how
to implement it. I want to use a header rule that will trigger on any
mail sent to my domains that is to an address that is *not* in my test
block, for example:
header TO_ADDRESS_BOGUS To !~ /my|real|addresses|here/i
describe TO_ADDRESS_BOGUS To: contains bogus address
score TO_ADDRESS_BOGUS 5.0
I know about blacklists and whitelists and have a solution in place that
works ok, but I really want a header rule like the one above. Yes, I’ve
searched. Yes, I have found many rules that implement a To: match test
but have not found an rule that implements a non-match test. I suspect
that my use of !~ is incorrect, but lint is happy with that rule as-is.
Is this type of rule possible? If so, how might I implement it?
--
John Minnihan
Founder, Freepository
http://freepository.com
Software development infrastructure since 1999
Blog: http://commavee.com
Re: Odd score
Posted by Magnus Holmgren <ho...@lysator.liu.se>.
On Tuesday 20 February 2007 17:35, Scott Lockwood wrote:
> X-Spam-Status: No, score=-79.4 required=5.0
> tests=BAYES_99,HELO_DYNAMIC_HCC,
> HELO_DYNAMIC_IPADDR2,HTML_MESSAGE,INVALID_DATE,RCVD_IN_BL_SPAMCOP_NET,
> RCVD_IN_XBL,SPF_SOFTFAIL,UPPERCASE_25_50,USER_IN_WHITELIST autolearn=no
> version=3.1.1
>
> I keep getting these messages with really low scores that should be
> really high scores. I can't figure out why, after all the tests that it
> hit on, the score ends up -79.4.
>
> Anyone have any ideas???
USER_IN_WHITELIST, -100 points
This means you have whitelisted an address in some sender header. It doesn't
have to be From:, it can be Return-Path: or Envelope-Sender: among others.
--
Magnus Holmgren holmgren@lysator.liu.se
(No Cc of list mail needed, thanks)
"Exim is better at being younger, whereas sendmail is better for
Scrabble (50 point bonus for clearing your rack)" -- Dave Evans
Re: Odd score
Posted by Raymond Dijkxhoorn <ra...@prolocation.net>.
Hi!
> Is that per user? So, if I nuke the whitelist, this should go away?
>>> Anyone have any ideas???
>>
>> USER_IN_WHITELIST !
Thats a bit depending on your setup. But trashing it would be a nice idea,
most people dont use the whitelist anyway. I dont...
Bye,
Raymond.
Re: Odd score
Posted by Scott Lockwood <sc...@cashnetusa.com>.
Is that per user? So, if I nuke the whitelist, this should go away?
On Tue, 2007-02-20 at 17:37 +0100, Raymond Dijkxhoorn wrote:
> Hi!
>
> > X-Spam-Status: No, score=-79.4 required=5.0
> > tests=BAYES_99,HELO_DYNAMIC_HCC,
> > HELO_DYNAMIC_IPADDR2,HTML_MESSAGE,INVALID_DATE,RCVD_IN_BL_SPAMCOP_NET,
> > RCVD_IN_XBL,SPF_SOFTFAIL,UPPERCASE_25_50,USER_IN_WHITELIST autolearn=no
> > version=3.1.1
>
> > I keep getting these messages with really low scores that should be
> > really high scores. I can't figure out why, after all the tests that it
> > hit on, the score ends up -79.4.
> >
> > Anyone have any ideas???
>
> USER_IN_WHITELIST !
>
> Bye,
> Raymond.
>
Re: Odd score
Posted by Raymond Dijkxhoorn <ra...@prolocation.net>.
Hi!
> X-Spam-Status: No, score=-79.4 required=5.0
> tests=BAYES_99,HELO_DYNAMIC_HCC,
> HELO_DYNAMIC_IPADDR2,HTML_MESSAGE,INVALID_DATE,RCVD_IN_BL_SPAMCOP_NET,
> RCVD_IN_XBL,SPF_SOFTFAIL,UPPERCASE_25_50,USER_IN_WHITELIST autolearn=no
> version=3.1.1
> I keep getting these messages with really low scores that should be
> really high scores. I can't figure out why, after all the tests that it
> hit on, the score ends up -79.4.
>
> Anyone have any ideas???
USER_IN_WHITELIST !
Bye,
Raymond.
RE: Odd score
Posted by Dan Barker <db...@visioncomm.net>.
Display the scores too!
Put tests=_TESTSSCORES(,)_ in your local.cf and you won't scratch your head
so hard next time.
It puts in lines like:
X-Spam-Status: No, score=-100.0 required=5.0
tests=AWL=0.009,BAYES_50=0.001,SPF_PASS=-0.001,USER_IN_WHITELIST=-100
autolearn=no version=3.1.7
when coded as:
add_header all Status "_YESNO_, score=_SCORE_ required=_REQD_
tests=_TESTSSCORES(,)_ autolearn=_AUTOLEARN_ version=_VERSION_"
(Watch out for line breaks. All the "paragraphs" above are 1 logical line)
Dan
-----Original Message-----
From: Scott Lockwood [mailto:scott@cashnetusa.com]
Sent: Tuesday, February 20, 2007 11:35 AM
To: users@spamassassin.apache.org
Subject: Odd score
X-Spam-Status: No, score=-79.4 required=5.0
tests=BAYES_99,HELO_DYNAMIC_HCC,
HELO_DYNAMIC_IPADDR2,HTML_MESSAGE,INVALID_DATE,RCVD_IN_BL_SPAMCOP_NET,
RCVD_IN_XBL,SPF_SOFTFAIL,UPPERCASE_25_50,USER_IN_WHITELIST autolearn=no
version=3.1.1
I keep getting these messages with really low scores that should be
really high scores. I can't figure out why, after all the tests that it
hit on, the score ends up -79.4.
Anyone have any ideas???
Odd score
Posted by Scott Lockwood <sc...@cashnetusa.com>.
X-Spam-Status: No, score=-79.4 required=5.0
tests=BAYES_99,HELO_DYNAMIC_HCC,
HELO_DYNAMIC_IPADDR2,HTML_MESSAGE,INVALID_DATE,RCVD_IN_BL_SPAMCOP_NET,
RCVD_IN_XBL,SPF_SOFTFAIL,UPPERCASE_25_50,USER_IN_WHITELIST autolearn=no
version=3.1.1
I keep getting these messages with really low scores that should be
really high scores. I can't figure out why, after all the tests that it
hit on, the score ends up -79.4.
Anyone have any ideas???
Re: Custom To: rule variant to exclude matches?
Posted by John Minnihan <jb...@freepository.com>.
Matt,
Thanks for the hint about using ToCc - that prompted me to realize my
error. I had not supplied FQ addresses in the rule, only user names. The
rule would have never fired when I wanted it to fire (and it didn't).
The corrected rule is below:
header TO_ADDRESS_BOGUS ToCc !~
/name1\@domain\.com|name2\@domain\.com|name3\@domain\.com/i
score TO_ADDRESS_BOGUS 4.0
This newly corrected rule is working exactly as expected, and as I
result I no longer have to manage a complex set of white and black lists.
John Minnihan wrote:
> Thanks for the quick reply & bonus suggestion, Matt.
>
> I'll continue modeling this now that I know !~ should function as
> expected, i.e. "return true if the pattern is not matched".
>
>
>> John Minnihan wrote:
>>
>>> SA Team,
>>>
>>> I have a fully functional SA installation that is serving me very
>>> well. I use Mailscanner and a few custom rules, and am generally
>>> very pleased with the results.
>>>
>>> There’s one more rule that I’d like to run, but haven’t figured
>>> out
>>> how to implement it. I want to use a header rule that will trigger on
>>> any mail sent to my domains that is to an address that is *not* in my
>>> test block, for example:
>>>
>>> header TO_ADDRESS_BOGUS To !~ /my|real|addresses|here/i
>>> describe TO_ADDRESS_BOGUS To: contains bogus address
>>> score TO_ADDRESS_BOGUS 5.0
>>>
>>> I know about blacklists and whitelists and have a solution in place
>>> that works ok, but I really want a header rule like the one above.
>>> Yes, I’ve searched. Yes, I have found many rules that implement a To:
>>> match test but have not found an rule that implements a non-match
>>> test. I suspect that my use of !~ is incorrect, but lint is happy with
>>> that rule as-is.
>>>
>>>
>> Your use of !~ should work properly here.
>>
>> However, I might suggest using ToCc instead of To. This will at least
>> match mail that's Cc'ed to you...
>>
>> Of course, neither will match any mail that's Bcc'ed to you, including
>> mailing list posts (ie: this list). So make sure you whitelist anyone
>> who will send you Bcc'ed mail.
>>
>>
>>
>
>
>
--
John Minnihan
Founder, Freepository
http://freepository.com
Software development infrastructure since 1999
Blog: http://commavee.com
Re: Custom To: rule variant to exclude matches?
Posted by John Minnihan <jb...@freepository.com>.
Thanks for the quick reply & bonus suggestion, Matt.
I'll continue modeling this now that I know !~ should function as
expected, i.e. "return true if the pattern is not matched".
> John Minnihan wrote:
>> SA Team,
>>
>> I have a fully functional SA installation that is serving me very
>> well. I use Mailscanner and a few custom rules, and am generally
>> very pleased with the results.
>>
>> Thereâs one more rule that Iâd like to run, but havenât figured
>> out
>> how to implement it. I want to use a header rule that will trigger on
>> any mail sent to my domains that is to an address that is *not* in my
>> test block, for example:
>>
>> header TO_ADDRESS_BOGUS To !~ /my|real|addresses|here/i
>> describe TO_ADDRESS_BOGUS To: contains bogus address
>> score TO_ADDRESS_BOGUS 5.0
>>
>> I know about blacklists and whitelists and have a solution in place
>> that works ok, but I really want a header rule like the one above.
>> Yes, Iâve searched. Yes, I have found many rules that implement a To:
>> match test but have not found an rule that implements a non-match
>> test. I suspect that my use of !~ is incorrect, but lint is happy with
>> that rule as-is.
>>
>
> Your use of !~ should work properly here.
>
> However, I might suggest using ToCc instead of To. This will at least
> match mail that's Cc'ed to you...
>
> Of course, neither will match any mail that's Bcc'ed to you, including
> mailing list posts (ie: this list). So make sure you whitelist anyone
> who will send you Bcc'ed mail.
>
>
--
John Minnihan
Founder, Freepository
http://freepository.com
Software Development Infrastructure since 1999
Re: Custom To: rule variant to exclude matches?
Posted by Matt Kettler <mk...@verizon.net>.
John Minnihan wrote:
> SA Team,
>
> I have a fully functional SA installation that is serving me very
> well. I use Mailscanner and a few custom rules, and am generally
> very pleased with the results.
>
> There’s one more rule that I’d like to run, but haven’t figured out
> how to implement it. I want to use a header rule that will trigger on
> any mail sent to my domains that is to an address that is *not* in my
> test block, for example:
>
> header TO_ADDRESS_BOGUS To !~ /my|real|addresses|here/i
> describe TO_ADDRESS_BOGUS To: contains bogus address
> score TO_ADDRESS_BOGUS 5.0
>
> I know about blacklists and whitelists and have a solution in place
> that works ok, but I really want a header rule like the one above.
> Yes, I’ve searched. Yes, I have found many rules that implement a To:
> match test but have not found an rule that implements a non-match
> test. I suspect that my use of !~ is incorrect, but lint is happy with
> that rule as-is.
>
Your use of !~ should work properly here.
However, I might suggest using ToCc instead of To. This will at least
match mail that's Cc'ed to you...
Of course, neither will match any mail that's Bcc'ed to you, including
mailing list posts (ie: this list). So make sure you whitelist anyone
who will send you Bcc'ed mail.
Re: Custom To: rule variant to exclude matches?
Posted by Loren Wilton <lw...@earthlink.net>.
You might be able to make something work with !~, but the easy way is to use a meta rule to reverse the sense.
header __TO_TEST To =~ /my name/i
meta TO_TEST !__TO_TEST
score TO_TEST 5
I'm going to assume you know the FP consequences of something like this, and not bother with the standard disclaimer about this being in general a bad idea if scored at more than a point or two.
Loren
----- Original Message -----
From: John Minnihan
To: users@spamassassin.apache.org
Sent: Monday, February 19, 2007 6:48 PM
Subject: Custom To: rule variant to exclude matches?
SA Team,
I have a fully functional SA installation that is serving me very well. I use Mailscanner and a few custom rules, and am generally very pleased with the results.
There’s one more rule that I’d like to run, but haven’t figured out how to implement it. I want to use a header rule that will trigger on any mail sent to my domains that is to an address that is *not* in my test block, for example:
header TO_ADDRESS_BOGUS To !~ /my|real|addresses|here/i
describe TO_ADDRESS_BOGUS To: contains bogus address
score TO_ADDRESS_BOGUS 5.0
I know about blacklists and whitelists and have a solution in place that works ok, but I really want a header rule like the one above. Yes, I’ve searched. Yes, I have found many rules that implement a To: match test but have not found an rule that implements a non-match test. I suspect that my use of !~ is incorrect, but lint is happy with that rule as-is.
Is this type of rule possible? If so, how might I implement it?
--
John Minnihan
Founder, Freepository
http://freepository.com
Software development infrastructure since 1999
Blog: http://commavee.com