You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Jason Haar <Ja...@trimble.co.nz> on 2006/05/02 23:01:15 UTC
Re: qmail auth mail received as spam
hamann.w@t-online.de wrote:
> So what happens: a mail is sent via an authenticated session, to a qmail / qmail-scanner
> setup running at mydomain.de
>
By default Qmail-Scanner specifically doesn't pass locally generated or
authenticated mail to SpamAssassin. Have you overridden that? If so,
why? As most of your authenticated end-users are connecting to your
Internet mail server from dialup (DUL) addresses, it makes no sense to
run SA against their email (if SA is configured to do RBL checks that is).
> The mail is sent to its destination, another qmail machine running SA
> Here, SA assigns score to DUL lists, and to a numeric ip in helo (which
> was only added by qmail-scanner, The HOST_EQ_D_D_D_D and HOST_EQ_D_D_D_DB
> entries also seem to be triggered by the qmail-scanner header
>
>
HOST_EQ_D_D_D_D isn't part of standard SA - where did that come from?
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
Re: qmail auth mail received as spam
Posted by jdow <jd...@earthlink.net>.
From: "Matt Kettler" <mk...@evi-inc.com>
> Jason Haar wrote:
>> HOST_EQ_D_D_D_D isn't part of standard SA - where did that come from?
>>
>
> It appears to come from:
> http://www.rulesemporium.com/rules/88_FVGT_headers.cf
>
>
>
> header HOST_EQ_D_D_D_D X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns=[^
> ]+\d{1,3}[^0-9]\d{1,3}[^0-9]\d{1,3}[^0-9]\d{1,3}[^ ]+ /
> score HOST_EQ_D_D_D_D 0.665
> #counts HOST_EQ_D_D_D_D 10886s/231h of 41745 corpus (34134s/7611h FVGT) 03/29/06
>
> header HOST_EQ_D_D_D_DB X-Spam-Relays-Untrusted =~ /^[^\]]+
> rdns=\d{1,3}[^0-9]\d{1,3}[^0-9]\d{1,3}[^0-9]\d{1,3}[^ ]+ /
> score HOST_EQ_D_D_D_DB 0.888
> #counts HOST_EQ_D_D_D_DB 4324s/71h of 42070 corpus (34144s/7926h FVGT) 04/19/06
>
>
>>>From the looks of it they're detecting untrusted relays which reverse-dns names
> which are of the typical host-208-39-141-94.example.com format for dynamic hosts.
It's time for Fred to work over 88_FGVT rule scores a little. Or else
I get a different mix of spam than he does. I just set FM_3PLUS_NODNS
and FB_SINGLE_1WORD to zero. They were not hitting much of anything and
what they hit was more ham than spam.
{^_^}
Re: qmail auth mail received as spam
Posted by "Daryl C. W. O'Shea" <sp...@dostech.ca>.
Jason Haar wrote:
> I guess a more generic question would be: how do sites handle calling SA
> for validated-but-remote local users? Qmail-Scanner defaults to *not*
> calling SA - is that what most others do too?
>
> If not, how do you handle the fact those users are (by definition) going
> to be on DUL lists?
If you can't avoid scanning their mail, either by not scanning mail sent
through your own MSAs, or funky configuring in an application like
Qmail-scanner, there are ways to deal with it in SpamAssassin:
http://wiki.apache.org/spamassassin/DynablockIssues
Re: qmail auth mail received as spam
Posted by Jason Haar <Ja...@trimble.co.nz>.
I guess a more generic question would be: how do sites handle calling SA
for validated-but-remote local users? Qmail-Scanner defaults to *not*
calling SA - is that what most others do too?
If not, how do you handle the fact those users are (by definition) going
to be on DUL lists?
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
Re: qmail auth mail received as spam
Posted by Matt Kettler <mk...@evi-inc.com>.
Jason Haar wrote:
> HOST_EQ_D_D_D_D isn't part of standard SA - where did that come from?
>
It appears to come from:
http://www.rulesemporium.com/rules/88_FVGT_headers.cf
header HOST_EQ_D_D_D_D X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns=[^
]+\d{1,3}[^0-9]\d{1,3}[^0-9]\d{1,3}[^0-9]\d{1,3}[^ ]+ /
score HOST_EQ_D_D_D_D 0.665
#counts HOST_EQ_D_D_D_D 10886s/231h of 41745 corpus (34134s/7611h FVGT) 03/29/06
header HOST_EQ_D_D_D_DB X-Spam-Relays-Untrusted =~ /^[^\]]+
rdns=\d{1,3}[^0-9]\d{1,3}[^0-9]\d{1,3}[^0-9]\d{1,3}[^ ]+ /
score HOST_EQ_D_D_D_DB 0.888
#counts HOST_EQ_D_D_D_DB 4324s/71h of 42070 corpus (34144s/7926h FVGT) 04/19/06
>From the looks of it they're detecting untrusted relays which reverse-dns names
which are of the typical host-208-39-141-94.example.com format for dynamic hosts.