You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Leandro <ll...@uyuyuy.com> on 2004/11/08 15:03:27 UTC
spam mails with missing from
How can I mark as spam mails with missing "From" ?
Thanks.
Leandro LATTANZIO.
Re: spam mails with missing from
Posted by jplesset <ja...@dp-design.com>.
You are correct. I apologize.
jay
Matt Kettler wrote:
> At 10:57 AM 11/8/2004, jplesset wrote:
>
>> I would advise against marking mails without "from" as spam.
>>
>> Internet RFC requires that DSN (Delivery Status Notice) not have a
>> "from". So, if you eliminate such, you are dropping valid/useful mails.
>
>
> AFAIK, That's not true.
>
> Are you sure it says that, and you're not confusing the NULL return
> path requirements with message From: header requirements?
>
> RFCs do require that DSN's have a NULL return path designated as <>.
>
> However, this is neither a From header, nor is it a missing header.
>
Re: SA using blacklists ?.
Posted by Loren Wilton <lw...@earthlink.net>.
> >I also have another cf file for drug contents , how can I specify
spamassassin
> >to use it ?.
>
> Sa will always try to parse all .cf files in /etc/mail/spamassassin/.
Thus,
> you only need to copy a file there and restart spamd to use it.
But note that antidrug is already part of 3.0, so your local rules may no
longer be needed.
Loren
Re: SA using blacklists ?.
Posted by Matt Kettler <mk...@evi-inc.com>.
At 11:44 AM 11/8/2004, hitete@free.fr wrote:
>How can I check if Spamassassin is really doing domain lookups ?.
>( I have a list like this in local.cf :
>
>blacklist_from *@domain1
>blacklist_from *@domain2)
Try running a message with one of those from domains in it through SA?
>I also have another cf file for drug contents , how can I specify spamassassin
>to use it ?.
Sa will always try to parse all .cf files in /etc/mail/spamassassin/. Thus,
you only need to copy a file there and restart spamd to use it.
SA using blacklists ?.
Posted by hi...@free.fr.
How can I check if Spamassassin is really doing domain lookups ?.
( I have a list like this in local.cf :
blacklist_from *@domain1
blacklist_from *@domain2)
I also have another cf file for drug contents , how can I specify spamassassin
to use it ?.
I have a lot of false positives..
/hitete
Re: spam mails with missing from
Posted by Loren Wilton <lw...@earthlink.net>.
> I receive spam mails with missing from.
> subject: variable
> body: empty
>
> but I wan´t mark as spam mails with empty body.
SARE has a rule for that in one of the files, I don't recall which.
Off the top of my head (and this may have errors in it) you could do
something like this:
header __LW_GOOD_FROM From =~ /\s/
body __LW_GOOD_BODY /\s/
meta LW_EMPTY_MAIL !__LW_GOOD_FROM && !__LW_GOOD_BODY
score LW_EMPTY_MAIL 1
describe LW_EMPTY_MAIL No Body from Nobody
Loren
Re: spam mails with missing from
Posted by Leandro <ll...@uyuyuy.com>.
(excluse me for my bad english)
I receive spam mails with missing from.
subject: variable
body: empty
but I wan´t mark as spam mails with empty body.
Leandro.
----- Original Message -----
From: "Matt Kettler" <mk...@evi-inc.com>
To: "jplesset" <ja...@dp-design.com>; "Matt Kettler" <mk...@comcast.net>
Cc: "Leandro" <ll...@uyuyuy.com>; "spamassassin"
<us...@spamassassin.apache.org>
Sent: Monday, November 08, 2004 1:11 PM
Subject: Re: spam mails with missing from
> At 10:57 AM 11/8/2004, jplesset wrote:
> >I would advise against marking mails without "from" as spam.
> >
> >Internet RFC requires that DSN (Delivery Status Notice) not have a
> >"from". So, if you eliminate such, you are dropping valid/useful mails.
>
> AFAIK, That's not true.
>
> Are you sure it says that, and you're not confusing the NULL return path
> requirements with message From: header requirements?
>
> RFCs do require that DSN's have a NULL return path designated as <>.
>
> However, this is neither a From header, nor is it a missing header.
>
Re: spam mails with missing from
Posted by Matt Kettler <mk...@evi-inc.com>.
At 10:57 AM 11/8/2004, jplesset wrote:
>I would advise against marking mails without "from" as spam.
>
>Internet RFC requires that DSN (Delivery Status Notice) not have a
>"from". So, if you eliminate such, you are dropping valid/useful mails.
AFAIK, That's not true.
Are you sure it says that, and you're not confusing the NULL return path
requirements with message From: header requirements?
RFCs do require that DSN's have a NULL return path designated as <>.
However, this is neither a From header, nor is it a missing header.
Re: spam mails with missing from
Posted by Loren Wilton <lw...@earthlink.net>.
> I would advise against marking mails without "from" as spam.
>
> Internet RFC requires that DSN (Delivery Status Notice) not have a
> "from". So, if you eliminate such, you are dropping valid/useful mails.
Possibly so. And I would also argue against dropping mails solely because
they lack a From: header.
But FWIW, I don't believe that I've received more than one or two mails, if
that, in the last several years that lacked a from and weren't a broken spam
message. I'd want to mass-check such a rule, but I bet it would be pretty
decent.
I do have a check for missing from and missing subject, and another for
missing from and missing body. Both of those seem to only trigger on spam,
at least here.
Loren
Re: spam mails with missing from
Posted by jplesset <ja...@dp-design.com>.
I would advise against marking mails without "from" as spam.
Internet RFC requires that DSN (Delivery Status Notice) not have a
"from". So, if you eliminate such, you are dropping valid/useful mails.
jay
Matt Kettler wrote:
> At 11:03 AM 11/8/2004 -0300, Leandro wrote:
>
>> How can I mark as spam mails with missing "From" ?
>
>
> A little rule:
>
> header __FROM_PRESENT exists:From
> meta MISSING_FROM !__FROM_PRESENT
> score MISSING_FROM 1.0
> describe MISSING_FROM from header missing
>
> Note: use with caution, as I've not done any testing of this.
>
> However, the rule works the same way MISSING_SUBJECT works in the
> standard 3.0 code, and I've done plenty of similar rules before.
Re: spam mails with missing from
Posted by Matt Kettler <mk...@comcast.net>.
At 11:03 AM 11/8/2004 -0300, Leandro wrote:
>How can I mark as spam mails with missing "From" ?
A little rule:
header __FROM_PRESENT exists:From
meta MISSING_FROM !__FROM_PRESENT
score MISSING_FROM 1.0
describe MISSING_FROM from header missing
Note: use with caution, as I've not done any testing of this.
However, the rule works the same way MISSING_SUBJECT works in the standard
3.0 code, and I've done plenty of similar rules before.