You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "Dan Mahoney, System Admin" <da...@prime.gushi.org> on 2007/01/06 01:52:23 UTC
remove known-postmaster entries from AWL?
Hey all,
The subject line says it all. I've got a lot of users complaining about
bounce spam, and while there's an 0.1 scoring "Vbounce" ruleset, I notice
that more often than not "postmaster" scores sometimes a whopping .5, and
at other times -17. Is there any way to simply say "dont do this for
unqualified addresses?" (or "postmaster addresses")
-Dan
--
"If you aren't going to try something, then we might as well just be
friends."
"We can't have that now, can we?"
-SK & Dan Mahoney, December 9, 1998
--------Dan Mahoney--------
Techie, Sysadmin, WebGeek
Gushi on efnet/undernet IRC
ICQ: 13735144 AIM: LarpGM
Site: http://www.gushi.org
---------------------------
Re: remove known-postmaster entries from AWL?
Posted by Sander Holthaus <in...@orangexl.com>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Dan Mahoney, System Admin wrote:
> Hey all,
>
> The subject line says it all. I've got a lot of users complaining
> about bounce spam, and while there's an 0.1 scoring "Vbounce"
> ruleset, I notice that more often than not "postmaster" scores
> sometimes a whopping .5, and at other times -17. Is there any way
> to simply say "dont do this for unqualified addresses?" (or
> "postmaster addresses")
>
> -Dan
I think your best bet is to not pipe bounce spam through SpamAssassin.
It is pretty much useless and it is likely to screw things up, such as
AWL or even Bayes. Plus, you be using a lot of resources to come to an
obvious conclusion.
If the message is not to big, you can check bounces to see if any of
your mail-relay(s) or otherwise authorized relays for an
account/domain are somewhere in the body of the bounce (body of the
bounce usually include headers of the original message). If you can't
find any of your relays, it is almost certainly a false bounce. Using
something like SPF for your domains might help too btw. And make sure
to avoid catch-all addresses.
Kind Regards,
Sander Holthaus
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (MingW32)
iD8DBQFFn7WKVf373DysOTURAvWwAJ9HGVqPIHy7aQ810ZOxfsoIvnxL8gCgzpkv
9z5VcitERtPMY9dCDX/Almk=
=OwGa
-----END PGP SIGNATURE-----
Re: [sa-list] Re: remove known-postmaster entries from AWL?
Posted by Matt Kettler <mk...@verizon.net>.
Dan Mahoney, System Admin wrote:
>
>> You do realize the AWL isn't a whitelist, right?
>
> Why is it hitting, then? If it has the power to influence the score
> hamward (on a non-real and possibly forged email address), I'd prefer
> it not to apply.
Well, first, back to the point. The AWL is an averager, not a whitelist.
That said, sometimes it can affect scores hamward. But it's not a
whitelist. It can also affect scores spamward.
That said, personally, I'd say chuck the AWL. It's IMHO not production
ready for a variety of other reasons. (ie: there's no expiry in the
AWL.. period).
I'd also double-check your trust path. If SA is getting confused about
trust, it might be using the wrong IP in the AWL database. If you're
under-trusting, it might always be using your MX server as the IP, which
will likely always be the same for all messages. This would mean any and
all postmaster@foobar.com emails, from anywhere in the world, would
always match the same AWL entry. Even forgeries. This could yield some
rather poor AWL results.
Re: [sa-list] Re: remove known-postmaster entries from AWL?
Posted by "Dan Mahoney, System Admin" <da...@prime.gushi.org>.
On Fri, 5 Jan 2007, Matt Kettler wrote:
> Dan Mahoney, System Admin wrote:
>> Hey all,
>>
>> The subject line says it all. I've got a lot of users complaining
>> about bounce spam, and while there's an 0.1 scoring "Vbounce" ruleset,
>> I notice that more often than not "postmaster" scores sometimes a
>> whopping .5, and at other times -17. Is there any way to simply say
>> "dont do this for unqualified addresses?" (or "postmaster addresses")
>>
>> -Dan
>>
> Why should the AWL even matter here?
Because it's matching, with bizarrely sporadic results.
> You do realize the AWL isn't a whitelist, right?
Why is it hitting, then? If it has the power to influence the score
hamward (on a non-real and possibly forged email address), I'd prefer it
not to apply.
-Dan
--
"Happy, Sad, Happy, Sad, Happy, Sad, Happy, Intruiged! I've never been so
in touch with my emotions!"
-AndrAIa as Hexadecimal, Reboot Episode 3.2.3
--------Dan Mahoney--------
Techie, Sysadmin, WebGeek
Gushi on efnet/undernet IRC
ICQ: 13735144 AIM: LarpGM
Site: http://www.gushi.org
---------------------------
Re: remove known-postmaster entries from AWL?
Posted by Matt Kettler <mk...@verizon.net>.
Dan Mahoney, System Admin wrote:
> Hey all,
>
> The subject line says it all. I've got a lot of users complaining
> about bounce spam, and while there's an 0.1 scoring "Vbounce" ruleset,
> I notice that more often than not "postmaster" scores sometimes a
> whopping .5, and at other times -17. Is there any way to simply say
> "dont do this for unqualified addresses?" (or "postmaster addresses")
>
> -Dan
>
Why should the AWL even matter here?
You do realize the AWL isn't a whitelist, right?