You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Rick Macdougall <ri...@nougen.com> on 2005/09/01 20:17:37 UTC
FP on forged_hotmail_rcvd with 3.1.0rc2
Hi,
As mentioned in the subject I'm getting an FP hit on forged_hotmail_rcvd
with 3.1.0 rc1 and rc2
Munged message below.
eceived: from bay0-smtp04.bay0.hotmail.com (65.54.234.157)
by mta001.aei.ca with SMTP; 1 Sep 2005 17:00:09 -0000
Message-ID: <BA...@phx.gbl>
X-Originating-IP: [66.36.130.196]
X-Originating-Email: [munged@msn.com]
Received: from BETSY ([66.36.130.196]) by BAY0-SMTP04.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.211);
Thu, 1 Sep 2005 10:00:08 -0700
Message-ID: <00...@BETSY>
Reply-To: "William A. McKee" <mu...@msn.com>
From: "William A. McKee" <mu...@msn.com>
To: <mu...@aei.ca>
Subject: Fw: axess problem
Date: Thu, 1 Sep 2005 13:00:10 -0400
Organization: Asia Communications Quebec Inc.
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="iso-8859-1";
reply-type=response
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2527
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
Return-Path: munged@msn.com
X-OriginalArrivalTime: 01 Sep 2005 17:00:08.0368 (UTC) FILETIME=[9B8B8300:01C5AF16]
Content-Transfer-Encoding: 7bit
------------=_43173399.E3143827--
Any ideas ?
Regards,
Rick
Re: FP on forged_hotmail_rcvd with 3.1.0rc2
Posted by Rick Macdougall <ri...@nougen.com>.
Matt Kettler wrote:
>Rick Macdougall wrote:
>
>
>>Hi,
>>
>>As mentioned in the subject I'm getting an FP hit on forged_hotmail_rcvd
>>with 3.1.0 rc1 and rc2
>>
>>
>
>It looks a bit like FORGED_HOTMAIL_RCVD doesn't like your Received: header
>format. It seems to be looking for a more sendmail-like header.
>
>That smells like a bug to me.
>
>Your MTA is generating Received headers in a qmail-ish format like this:
>
>from <rdns> (<ip>) by ...
>
>But the rule seems to be looking for something more like sendmail's format:
>
>from <helo> (<rdns> [<ip>]) by ..
>
>Unless I'm missing something and SA internally converts qmail Received: header
>formats into sendmail-style ones..
>
>
>
>
>>Munged message below.
>>
>>eceived: from bay0-smtp04.bay0.hotmail.com (65.54.234.157)
>> by mta001.aei.ca with SMTP; 1 Sep 2005 17:00:09 -0000
>>
>>
>
>
>Some quotes from EvalTests.pm:
>
> # Hotmail formats its received headers like this:
> # Received: from hotmail.com (f135.law8.hotmail.com [216.33.241.135])
> # spammers do not ;)
>
> if ($self->gated_through_received_hdr_remover()) { return; }
>
> if ($rcvd =~ /from \S*hotmail.com \(\S+\.hotmail(?:\.msn)?\.com[ \)]/ && $ip)
> { return; }
>
>
Hi,
You are correct, it is a qmail server. Should I open a bugzilla ticket
? And what do you recommend I do for now, score the rule at 0 ?
Regards,
Rick
Re: FP on forged_hotmail_rcvd with 3.1.0rc2
Posted by Matt Kettler <mk...@evi-inc.com>.
jdow wrote:
>
>
> Um, yes, a bug in QMail, I'd say. Intentionally losing information is
> not a good thing.
It's not loosing anything J.
It only does that when the helo and RDNS are an exact match. Otherwise it
inserts a "HELO=something.else.com" before the IP inside the ().
There's no information lost, just redundancy removed.
Re: FP on forged_hotmail_rcvd with 3.1.0rc2
Posted by jdow <jd...@earthlink.net>.
From: "Matt Kettler" <mk...@evi-inc.com>
> Rick Macdougall wrote:
>> Hi,
>>
>> As mentioned in the subject I'm getting an FP hit on forged_hotmail_rcvd
>> with 3.1.0 rc1 and rc2
>
> It looks a bit like FORGED_HOTMAIL_RCVD doesn't like your Received: header
> format. It seems to be looking for a more sendmail-like header.
>
> That smells like a bug to me.
>
> Your MTA is generating Received headers in a qmail-ish format like this:
>
> from <rdns> (<ip>) by ...
>
> But the rule seems to be looking for something more like sendmail's
> format:
>
> from <helo> (<rdns> [<ip>]) by ..
>
> Unless I'm missing something and SA internally converts qmail Received:
> header
> formats into sendmail-style ones..
Um, yes, a bug in QMail, I'd say. Intentionally losing information is
not a good thing.
{^_^}
Re: FP on forged_hotmail_rcvd with 3.1.0rc2
Posted by Matt Kettler <mk...@evi-inc.com>.
Rick Macdougall wrote:
> Hi,
>
> As mentioned in the subject I'm getting an FP hit on forged_hotmail_rcvd
> with 3.1.0 rc1 and rc2
It looks a bit like FORGED_HOTMAIL_RCVD doesn't like your Received: header
format. It seems to be looking for a more sendmail-like header.
That smells like a bug to me.
Your MTA is generating Received headers in a qmail-ish format like this:
from <rdns> (<ip>) by ...
But the rule seems to be looking for something more like sendmail's format:
from <helo> (<rdns> [<ip>]) by ..
Unless I'm missing something and SA internally converts qmail Received: header
formats into sendmail-style ones..
>
> Munged message below.
>
> eceived: from bay0-smtp04.bay0.hotmail.com (65.54.234.157)
> by mta001.aei.ca with SMTP; 1 Sep 2005 17:00:09 -0000
Some quotes from EvalTests.pm:
# Hotmail formats its received headers like this:
# Received: from hotmail.com (f135.law8.hotmail.com [216.33.241.135])
# spammers do not ;)
if ($self->gated_through_received_hdr_remover()) { return; }
if ($rcvd =~ /from \S*hotmail.com \(\S+\.hotmail(?:\.msn)?\.com[ \)]/ && $ip)
{ return; }
Re: FP on forged_hotmail_rcvd with 3.1.0rc2
Posted by Loren Wilton <lw...@earthlink.net>.
It may be a problem with that BAY0 in uppercase in the received line. I
have the vague and possibly incorrect impression that the bayN boxes are new
in hotmail, or at least that the code checking for these changed in the last
release or so.
Loren
----- Original Message -----
From: "Rick Macdougall" <ri...@nougen.com>
To: "SpamAssassin Users" <us...@spamassassin.apache.org>
Sent: Thursday, September 01, 2005 11:17 AM
Subject: FP on forged_hotmail_rcvd with 3.1.0rc2
> Hi,
>
> As mentioned in the subject I'm getting an FP hit on forged_hotmail_rcvd
> with 3.1.0 rc1 and rc2
>
> Munged message below.
>
> eceived: from bay0-smtp04.bay0.hotmail.com (65.54.234.157)
> by mta001.aei.ca with SMTP; 1 Sep 2005 17:00:09 -0000
> Message-ID: <BA...@phx.gbl>
> X-Originating-IP: [66.36.130.196]
> X-Originating-Email: [munged@msn.com]
> Received: from BETSY ([66.36.130.196]) by BAY0-SMTP04.bay0.hotmail.com
with Microsoft SMTPSVC(6.0.3790.211);
> Thu, 1 Sep 2005 10:00:08 -0700
> Message-ID: <00...@BETSY>
> Reply-To: "William A. McKee" <mu...@msn.com>
> From: "William A. McKee" <mu...@msn.com>
> To: <mu...@aei.ca>
> Subject: Fw: axess problem
> Date: Thu, 1 Sep 2005 13:00:10 -0400
> Organization: Asia Communications Quebec Inc.
> MIME-Version: 1.0
> Content-Type: text/plain;
> format=flowed;
> charset="iso-8859-1";
> reply-type=response
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-Mailer: Microsoft Outlook Express 6.00.2900.2527
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
> Return-Path: munged@msn.com
> X-OriginalArrivalTime: 01 Sep 2005 17:00:08.0368 (UTC)
FILETIME=[9B8B8300:01C5AF16]
> Content-Transfer-Encoding: 7bit
>
> ------------=_43173399.E3143827--
>
> Any ideas ?
>
> Regards,
>
> Rick
Re: FP on forged_hotmail_rcvd with 3.1.0rc2
Posted by "Daryl C. W. O'Shea" <sp...@dostech.ca>.
Loren Wilton wrote:
>>It's weird that Outlook Express apparently didn't add it's own Message-ID.
>
>
> But it did! Look again - there are TWO message-id headers in that mail!
Oops, when I ran it through SA I saw it his MESSAGE_ID_FROM_MTA (or
whatever it's called), saw the one added by the MTA and stopped looking.
Anyway, that's weird. Anybody else got similar messages from MSN account?
Daryl
Re: FP on forged_hotmail_rcvd with 3.1.0rc2
Posted by Loren Wilton <lw...@earthlink.net>.
> It's weird that Outlook Express apparently didn't add it's own Message-ID.
But it did! Look again - there are TWO message-id headers in that mail!
Loren
----- Original Message -----
From: "Daryl C. W. O'Shea" <sp...@dostech.ca>
To: "Rick Macdougall" <ri...@nougen.com>
Cc: "SpamAssassin Users" <us...@spamassassin.apache.org>
Sent: Wednesday, September 07, 2005 11:23 PM
Subject: Re: FP on forged_hotmail_rcvd with 3.1.0rc2
> Rick Macdougall wrote:
> > Hi,
> >
> > As mentioned in the subject I'm getting an FP hit on forged_hotmail_rcvd
> > with 3.1.0 rc1 and rc2
> >
> > Munged message below.
> >
> > eceived: from bay0-smtp04.bay0.hotmail.com (65.54.234.157)
> > by mta001.aei.ca with SMTP; 1 Sep 2005 17:00:09 -0000
> > Message-ID: <BA...@phx.gbl>
> > X-Originating-IP: [66.36.130.196]
> > X-Originating-Email: [munged@msn.com]
> > Received: from BETSY ([66.36.130.196]) by BAY0-SMTP04.bay0.hotmail.com
> > with Microsoft SMTPSVC(6.0.3790.211);
> > Thu, 1 Sep 2005 10:00:08 -0700
> > Message-ID: <00...@BETSY>
> > Reply-To: "William A. McKee" <mu...@msn.com>
> > From: "William A. McKee" <mu...@msn.com>
> > To: <mu...@aei.ca>
> > Subject: Fw: axess problem
> > Date: Thu, 1 Sep 2005 13:00:10 -0400
> > Organization: Asia Communications Quebec Inc.
> > MIME-Version: 1.0
> > Content-Type: text/plain;
> > format=flowed;
> > charset="iso-8859-1";
> > reply-type=response
> > X-Priority: 3
> > X-MSMail-Priority: Normal
> > X-Mailer: Microsoft Outlook Express 6.00.2900.2527
> > X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
> > Return-Path: munged@msn.com
> > X-OriginalArrivalTime: 01 Sep 2005 17:00:08.0368 (UTC)
> > FILETIME=[9B8B8300:01C5AF16]
> > Content-Transfer-Encoding: 7bit
> >
> > ------------=_43173399.E3143827--
> >
> > Any ideas ?
>
> It's weird that Outlook Express apparently didn't add it's own Message-ID.
>
> Anyway, if you can open a bug on this, and attach a few samples from
> different senders, I'll look at getting it fixed.
>
>
> Daryl
Re: FP on forged_hotmail_rcvd with 3.1.0rc2
Posted by Rick Macdougall <ri...@nougen.com>.
Daryl C. W. O'Shea wrote:
> Rick Macdougall wrote:
>
>> Hi,
>>
>> As mentioned in the subject I'm getting an FP hit on
>> forged_hotmail_rcvd with 3.1.0 rc1 and rc2
>>
>> Munged message below.
>>
>> eceived: from bay0-smtp04.bay0.hotmail.com (65.54.234.157)
>> by mta001.aei.ca with SMTP; 1 Sep 2005 17:00:09 -0000
>> Message-ID: <BA...@phx.gbl>
>> X-Originating-IP: [66.36.130.196]
>> X-Originating-Email: [munged@msn.com]
>> Received: from BETSY ([66.36.130.196]) by
>> BAY0-SMTP04.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.211);
>> Thu, 1 Sep 2005 10:00:08 -0700
>> Message-ID: <00...@BETSY>
>> Reply-To: "William A. McKee" <mu...@msn.com>
>> From: "William A. McKee" <mu...@msn.com>
>> To: <mu...@aei.ca>
>> Subject: Fw: axess problem
>> Date: Thu, 1 Sep 2005 13:00:10 -0400
>> Organization: Asia Communications Quebec Inc.
>> MIME-Version: 1.0
>> Content-Type: text/plain;
>> format=flowed;
>> charset="iso-8859-1";
>> reply-type=response
>> X-Priority: 3
>> X-MSMail-Priority: Normal
>> X-Mailer: Microsoft Outlook Express 6.00.2900.2527
>> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
>> Return-Path: munged@msn.com
>> X-OriginalArrivalTime: 01 Sep 2005 17:00:08.0368 (UTC)
>> FILETIME=[9B8B8300:01C5AF16]
>> Content-Transfer-Encoding: 7bit
>>
>> ------------=_43173399.E3143827--
>>
>> Any ideas ?
>
>
> It's weird that Outlook Express apparently didn't add it's own
> Message-ID.
>
> Anyway, if you can open a bug on this, and attach a few samples from
> different senders, I'll look at getting it fixed.
Hi,
Sorry, I only ever say it once (on a mailing from our local LUG) and I
no longer have the message. If it happens again I'll open a ticket.
Regards,
Rick
Re: FP on forged_hotmail_rcvd with 3.1.0rc2
Posted by "Daryl C. W. O'Shea" <sp...@dostech.ca>.
Rick Macdougall wrote:
> Hi,
>
> As mentioned in the subject I'm getting an FP hit on forged_hotmail_rcvd
> with 3.1.0 rc1 and rc2
>
> Munged message below.
>
> eceived: from bay0-smtp04.bay0.hotmail.com (65.54.234.157)
> by mta001.aei.ca with SMTP; 1 Sep 2005 17:00:09 -0000
> Message-ID: <BA...@phx.gbl>
> X-Originating-IP: [66.36.130.196]
> X-Originating-Email: [munged@msn.com]
> Received: from BETSY ([66.36.130.196]) by BAY0-SMTP04.bay0.hotmail.com
> with Microsoft SMTPSVC(6.0.3790.211);
> Thu, 1 Sep 2005 10:00:08 -0700
> Message-ID: <00...@BETSY>
> Reply-To: "William A. McKee" <mu...@msn.com>
> From: "William A. McKee" <mu...@msn.com>
> To: <mu...@aei.ca>
> Subject: Fw: axess problem
> Date: Thu, 1 Sep 2005 13:00:10 -0400
> Organization: Asia Communications Quebec Inc.
> MIME-Version: 1.0
> Content-Type: text/plain;
> format=flowed;
> charset="iso-8859-1";
> reply-type=response
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-Mailer: Microsoft Outlook Express 6.00.2900.2527
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
> Return-Path: munged@msn.com
> X-OriginalArrivalTime: 01 Sep 2005 17:00:08.0368 (UTC)
> FILETIME=[9B8B8300:01C5AF16]
> Content-Transfer-Encoding: 7bit
>
> ------------=_43173399.E3143827--
>
> Any ideas ?
It's weird that Outlook Express apparently didn't add it's own Message-ID.
Anyway, if you can open a bug on this, and attach a few samples from
different senders, I'll look at getting it fixed.
Daryl