#haraka

[13Haraka] 15msimerson opened pull request #1847: Smtp forward dest split (06master...06smtp-forward-dest-split) 02https://github.com/haraka/Haraka/pull/1847

morning

morning

happy birthday _smf_

Thanks baudehlo

Have you forgiven your cat yet ;-)

That photo gave me a good laugh - I remember those days!

Happy BD _smf_ =)

_smf_: yeah just about. Stupid bastard.

Thanks EyePulp!

interesting view into spamming state-of-the-art https://mackeeper.com/blog/post/339-spammergate...

EyePulp: thanks for this. I read a less technical article about this earlier and was looking for something more in-depth like this.

_smf_: this one looked even more specific http://www.csoonline.com/article/3176433/securi...

[13Haraka] 15msimerson pushed 1 new commit to 06master: 02https://github.com/haraka/Haraka/commit/3d574...

13Haraka/06master 143d574b2 15Matt Simerson: ignore undefined socket.remoteAddress (#1846)...

[13Haraka] 15msimerson pushed 1 new commit to 06master: 02https://github.com/haraka/Haraka/commit/34b93...

13Haraka/06master 1434b934e 15Matt Simerson: URL to manual was 404, point to Plugins.md (#1844)

I expect some raised eyebrows and conversation on this PR: https://github.com/haraka/Haraka/pull/1847

msimerson: I didn't grasp the finer points of that PR, but I'm happy to argue for or against it in a loud and obnoxious manner. Just let me know.

LOL. want more explanation?

RE previous discussions this AM, happy birthday _smf_

and...

I just got a phishing email (target: apple icloud credentials) delivered to my inbox by gmail. SpamAssassin score=-0.1, rspamd is_spam: false, score: 4.35. That's a mighty effective spam delivery system someone owns.

Thanks msimerson!

🍻

msimerson: can you gist the phish message?

sure

Re: 1847 - FWIW - I long since stopped using smtp_forward and now have a dedicated list of domain destinations and forced MX records for each.

forced MX is partly what 1847 is adding to smtp_forward. Since you're queueing, how are you managing all the bounces?

What bounces?

That phish scores: 9.1 in SA here.

Content analysis details: (9.1 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

2.5 URIBL_ZRD Contains URL's listed in the Spamhaus ZRD blocklist

[URIs: apple-secureaccount.ga]

0.0 FSL_TO_DISP_EQ_ADDR Display name is the same as the address

1.0 FSL_FROM_INFO_DOM From address is in .info

3.0 FSL_NOT_APPLE Display name says "Apple .. but address doesn't

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[209.85.215.103 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.215.103 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

Yes, they usually do 15 minutes *after* a spam run starts.

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 FSL_TO_LE_5_RCPTS Addressed to <=5 recipients

0.0 FSL_GOOGLE_VIA_SMTP Message injected via SMTP and not Google Mail

1.5 FSL_MIME_MPA multipart/alternative without both text and html parts

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

0.0 FSL_TO_2_RCPTS Addressed to two recipients

True enough

However - you won't be using the Spamhaus ZRD, and that isn't susceptable to that.

And as you can see it hit a bunch of non-network related rules.

So _smf_, when you say, "forced MX records", I understand that to mean you're using outbound, right?

[13Haraka] 15greenkeeper[bot] created 06greenkeeper/eslint-3.17.1 (+1 new commit): 02https://github.com/haraka/Haraka/commit/d0856...

13Haraka/06greenkeeper/eslint-3.17.1 14d085663 15greenkeeper[bot]: chore(package): update eslint to version 3.17.1...