<div dir="ltr">Stef,<div><br><div>Can you post your MailScanner conf? (A sample of your blacklist rules specifically.) </div><div><br></div><div>Also, I see you have downloaded Mailborder before. If you still have the Mailborder box running, I’d suggest entering some sample rules in the GUI and see how the config files are built. Something as simple as using a space instead of a tab in a rule set can cause issues. </div>
</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, May 2, 2014 at 5:07 PM, Stef Morrell <span dir="ltr"><<a href="mailto:stef@aoc-uk.com" target="_blank">stef@aoc-uk.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-GB" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New"">Would you bother with bayes at all then? It would be impossible to hand sort my corpus.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New""><u></u> <u></u></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:mailscanner-bounces@lists.mailscanner.info" target="_blank">mailscanner-bounces@lists.mailscanner.info</a> [mailto:<a href="mailto:mailscanner-bounces@lists.mailscanner.info" target="_blank">mailscanner-bounces@lists.mailscanner.info</a>]
<b>On Behalf Of </b>Martin Hepworth<br>
<b>Sent:</b> 02 May 2014 15:51<br>
<b>To:</b> MailScanner discussion<br>
<b>Subject:</b> Re: Spamassassin rules not firing correctly<u></u><u></u></span></p>
</div>
</div><div class="">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">Stef<br>
also turn off autolearning - found this not great for a population of more than a handful of users.<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div><div><div class="">
<p class="MsoNormal"><br clear="all">
<u></u><u></u></p>
<div>
<p class="MsoNormal">-- <br>
Martin Hepworth, CISSP<br>
Oxford, UK<u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><u></u> <u></u></p>
</div><div><div class="">
<p class="MsoNormal">On 2 May 2014 11:13, Stef Morrell <<a href="mailto:stef@aoc-uk.com" target="_blank">stef@aoc-uk.com</a>> wrote:<u></u><u></u></p>
</div><div><div class="h5"><p class="MsoNormal">Hello Kai,<u></u><u></u></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
On 02 May 2014 10:16 Kai Schaetzl wrote:<br>
> This is a common misunderstanding. SA via MS may not use the same config<u></u><u></u></p>
</div>
<p class="MsoNormal">Yes, I take on board the technical suggestions. I've basically been through all those checks. :)<br>
<br>
I am now starting to believe there is actually nothing wrong and that given I'm seeing apparent fails on blacklist rules is because the domains aren't blacklisted at the time the spam is generated.<br>
<br>
<a href="http://moms-flowersbouquet-nice.me" target="_blank">moms-flowersbouquet-nice.me</a> - registered end of 30/04/2014, spam arrived early 01/05/2014<br>
<a href="http://russianbrides-dating-great.me" target="_blank">russianbrides-dating-great.me</a> - registered 11 hours ago, spam arrived 3 hours ago.<br>
<br>
So the problem is likely not MS, it's how to detect and deal with spam from brand new domains/ip.<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">
http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<u></u><u></u></p>
</div>
</div>
</div></div></div><span class="HOEnZb"><font color="#888888">
<p class="MsoNormal"><u></u> <u></u></p>
</font></span></div><span class="HOEnZb"><font color="#888888">
<p class="MsoNormal"><br>
-- <br>
This email has been scanned by the Alpha Omega Computers Ltd MailCrusader for <br>
viruses, spam and dangerous content. <br>
For more information please visit <a href="http://www.aoc-uk.com/" target="_blank"><b>Alpha Omega Computers Ltd</b></a>.
<u></u><u></u></p>
</font></span></div>
</div>
</div>
<br>--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><div><div><br>--<br></div>Jerry Benton<br></div>Mailborder Systems<br><a href="http://www.mailborder.com" target="_blank">www.mailborder.com</a><br>
</div>
</div>