spamhaus-XBL

[Martin Hepworth]

Jason

In that case you need to look at what third party rules you run with SA.
Even with SA 3.02 I run most of the rules in
www.rulesemporium.com/rules.htm and also in the 'other section' for
things like chickenpox.cf,munged.cf etc.

I also run the URI-RBL's, pyzor, and bayes and some local rules for
obsfucations.

A default install of SA still needs alot of help from extra rules IMHO.

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300


Jason wrote:
> Hi Drew,
>
> In fact, this spamhaus-XBL has detected serveral messages that are
> missed by
> spamassassin (not enough score). So if Frank's suggestion do work, I would
> give it a try. If it doesn't, I would surely use spamassassin only. False
> positive is alway troublesome.
>
> Jason
>
> ----- Original Message -----
> From: "Drew Marshall" <drew at THEMARSHALLS.CO.UK>
> To: <MAILSCANNER at JISCMAIL.AC.UK>
> Sent: Tuesday, March 15, 2005 5:33 PM
> Subject: Re: spamhaus-XBL
>
>
>> Frank Louwers said:
>>
>>> On Tue, Mar 15, 2005 at 09:18:32AM -0000, Drew Marshall wrote:
>>>
>>>> Jason said:
>>>> > Hi,
>>>> >
>>>> >     But 219.132.219.6 is the client (outlook express), not the email
>>>> > server.
>>>> > The client is sending email through the server by smtp auth.
>>>> >
>>>> > Jason
>>>>
>>>> That won't make any difference. The client is establishing a SMTP
>>>> connection to the server and so it's IP address will be checked.
>>>> Spammers
>>>> will often fake the client so all SMTP connections have to be checked.
>>>
>>>
>>> Not realy. You should run auth-smtp on a different port (tcp/587) and
>>> ONLY run auth-smtp on that port, no regular smtp. That way, you can
>>> configure the MTA on 587 not to do special checks (blacklist checks).
>>
>>
>> But the mail is not being bounced but tagged as spam in MS. If the RBL
>> checks are set in MailScanner then messages from that IP address will
>> always be marked as spam. Better still as Martin suggested is to remove
>> all RBLs from MailScanner and let SpamAssassin check them. This won't
>> mean
>> that there isn't a chance that the message is tagged but it's less
>> likely.
>>
>> Drew
>>
>> --
>> In line with our policy, this message has
>> been scanned for viruses and dangerous
>> content by MailScanner, and is believed to be clean.
>> www.themarshalls.co.uk/policy
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> Support MailScanner development - buy the book off the website!
>>
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!

**********************************************************************

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.

**********************************************************************

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!