Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (athena.apache.org: message received from 54.164.171.186
 which is an MX secondary for users@spamassassin.apache.org)
Message-ID: <553A5028.3070207@thelounge.net>
Date: Fri, 24 Apr 2015 16:16:08 +0200
From: Reindl Harald <h.reindl@thelounge.net>
Organization: the lounge interactive design
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
 rv:31.0) Gecko/20100101 Thunderbird/31.6.0
MIME-Version: 1.0
To: users@spamassassin.apache.org
Subject: Re: v=spf1 +all
References: 
 <20150423192408.Horde.7FoZOWMmAsch2e8cMYEJeQ7@horde.andreasschulze.de>
	<5d7870666f83aa0dd9af74c2b0e67e55@junc.eu>
	<20150424091347.2ef1cc45@hydrogen.roaringpenguin.com>
	<553A4279.8020701@thelounge.net>
	<20150424092230.6ac5e300@hydrogen.roaringpenguin.com>
	<553A4747.2040000@thelounge.net>
	<20150424095058.4549c849@hydrogen.roaringpenguin.com>
	<553A4B66.6010803@thelounge.net> <20150424141130.GB12337@fantomas.sk>
In-Reply-To: <20150424141130.GB12337@fantomas.sk>
OpenPGP: id=13540402D67A7F71C6E974EA866063CF7F780279;
	url=https://arrakis.thelounge.net/gpg/h.reindl_thelounge.net.pub.txt
Content-Type: multipart/signed; micalg=pgp-sha1;
 protocol="application/pgp-signature";
 boundary="GKffKIabF6fQcfXhxUer03nkO5X7kgXTD"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--GKffKIabF6fQcfXhxUer03nkO5X7kgXTD
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: quoted-printable


Am 24.04.2015 um 16:11 schrieb Matus UHLAR - fantomas:
>>> On Fri, 24 Apr 2015 15:38:15 +0200
>>> Reindl Harald <h.reindl@thelounge.net> wrote:
>>>> well, and how becomes SPF part of the game in case of a throw-away
>>>> domain as long as "score SPF_NONE 0" - why in the world should a
>>>> spammer add a TXT record to a throw-away domain?
>
>> Am 24.04.2015 um 15:50 schrieb Dianne Skoll:
>>> Ummm.... are you really that unclear on the concept?  I'll explain it=

>>> carefully:
>>>
>>> Spammers know that (some) filters filter less aggressively than norma=
l
>>> on an SPF "pass".  So they register a throwaway domain and use that
>>> in the envelope sender.  They publish a TXT record for that domain to=

>>> ensure they get an SPF pass.
>>>
>>> There.  That wasn't so hard, was it?
>
> On 24.04.15 15:55, Reindl Harald wrote:
>> and how does that care a SA setup?
>
> SA setup will detect such domains and will score mail positively.
> Is there something other to explain?

i don't really and everybody who pretends the opposite should be quiet=20
in the future when it comes to highly false positive prone rules with=20
scores of 1.5 or even higher


--GKffKIabF6fQcfXhxUer03nkO5X7kgXTD
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iEYEARECAAYFAlU6UCgACgkQhmBjz394AnlAegCdHkL/e9FECv3spxIqr0bDNbVc
CNwAnjTtrNrXr5MbbK8lMTdSIuD1iQjY
=MqQL
-----END PGP SIGNATURE-----

--GKffKIabF6fQcfXhxUer03nkO5X7kgXTD--