You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Brendan Murtagh <bm...@powerhrg.com> on 2011/01/13 19:40:28 UTC
BlackBerry Email Being Blocked by SpamAssassin
Hello,
Many of our employees have BlackBerry devices as well as iPhones, Droids,
etc. However, the only device that is getting flagged as spam by
SpamAssassin is BlackBerry. It doesn't matter if a new email is composed or
its a reply. As long as its being sent from the device, it's being tagged
with some of the tests listed below. The emails are arriving, however they
are being delivered into the Spam folder and not the Inbox due to our mail
server settings which append to the Subject line the spam score and move it
to the Spam folder for email scored 3.0+
X-spam-flag: YES
X-spam-status: Yes, hits=3.01 required=3.00
tests=HTML_MESSAGE=0.00,RATWARE_RCVD_BONUS_SPC=1.00,VOWEL_URI_5=1.00,NO_RDNS2=0.01,MR_DIFF_MID=1.00
version=3.2.5
X-spam-level: ***
X-spam-checker-version: SpamAssassin 3.2.5 (1.1)
We are running SpamAssassin 3.2.5 (1.1) with IceWarp Mail Server and
currently the following are whitelisted within IceWarp:
*.bis.na.blackberry.com
*.blackberry.com
*.blackberry.net
@bis.na.blackberry.com
Any advice would be greatly appreciated. Thanks!
Sincerely,
Brendan
Brendan Murtagh
IT Coordinator / Mail Server Manager
PHONE: (610) 874-5000 x2232
FAX: (610) 874-5030
Power Home Remodeling Group
http://www.powerhrg.com
Window & Door Magazine's Dealer of the Year
Voted Best Place to Work by Philadelphia Inquirer
Before you print this email, is it necessary? Think pwsgreen.com
Confidentiality Notice: Please be advised that no quotes, agreements, or
understandings involving Power Windows and Siding, Inc., will be binding
unless and until codified in a written document signed by an officer of the
company. The information transmitted by this email is intended only for the
use of the addressee(s) and may contain confidential and/or privileged
information. Any interception, review, retransmission, dissemination, or
other use of, or taking any action upon this information by persons or
entities other than the intended recipient(s) is prohibited by law and may
subject them to criminal or civil liability. If you have received this
communication in error, please contact us immediately at (610) 874-5000 and
delete the message from any computer or other storage system.
--
View this message in context: http://old.nabble.com/BlackBerry-Email-Being-Blocked-by-SpamAssassin-tp30665108p30665108.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: BlackBerry Email Being Blocked by SpamAssassin
Posted by "Lawrence @ Rogers" <la...@nl.rogers.com>.
On 13/01/2011 3:10 PM, Brendan Murtagh wrote:
> We are running SpamAssassin 3.2.5 (1.1) with IceWarp Mail Server and
> currently the following are whitelisted within IceWarp:
>
> *.bis.na.blackberry.com
> *.blackberry.com
> *.blackberry.net
A score of 3.0 is much too low for determining if an e-mail is spam. We
have clients get e-mails all the time that score between 3.5 and 4.0 and
are non-spam. Anything that scores 5.0 or above is definitely spam in
our experience.
You may have whitelisted the domains within Icewrap, but all that does
is ensure they get to SA for scanning. Nothing more.
Cheers,
Lawrence
Re: BlackBerry Email Being Blocked by SpamAssassin
Posted by Kris Deugau <kd...@vianet.ca>.
Brendan Murtagh wrote:
> Many of our employees have BlackBerry devices as well as iPhones, Droids,
> etc. However, the only device that is getting flagged as spam by
> SpamAssassin is BlackBerry. It doesn't matter if a new email is composed or
> its a reply. As long as its being sent from the device, it's being tagged
> with some of the tests listed below. The emails are arriving, however they
> are being delivered into the Spam folder and not the Inbox due to our mail
> server settings which append to the Subject line the spam score and move it
> to the Spam folder for email scored 3.0+
Calling mail spam at a threshold of 3 is dangerous at best. Justin
Mason posted some interesting graphs a number of years ago; see
http://taint.org/2008/02/29/155648a.html and
http://taint.org/sa/thresholds-320/.
By lowering the threshold you are declaring that more false positives
than the targetted 0.1% at 5.0 is an acceptable situation.
> RATWARE_RCVD_BONUS_SPC=1.00
> VOWEL_URI_5=1.00,
> MR_DIFF_MID=1.00
I'm not certain about 3.2.5 (I don't have a copy of that handy) but none
of these are in the stock 3.3.1 rules. I found a 3.2.3 tarball, and
they're not in that version either.
> We are running SpamAssassin 3.2.5 (1.1) with IceWarp Mail Server and
> currently the following are whitelisted within IceWarp:
>
> *.bis.na.blackberry.com
> *.blackberry.com
> *.blackberry.net
> @bis.na.blackberry.com
Without an example message, we can't tell if these are relevant or not.
IME the From: address at least is usually the user's regular email
account - you would use these domains along with the sender addresses in
whitelist_from_rcvd instead, if you use SA's whitelisting capabilities.
By "whitelisted in IceWarp", do you mean that SA is bypassed completely?
On emails relayed from hosts in those domains? Emails using those
domains as the envelope sender? Emails using those domains in the From:?
-kgd
Re: BlackBerry Email Being Blocked by SpamAssassin
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Thu, 2011-01-13 at 13:57 -0500, Jason Bertoch wrote:
> On 2011/01/13 1:40 PM, Brendan Murtagh wrote:
> > tests=HTML_MESSAGE=0.00,
> > RATWARE_RCVD_BONUS_SPC=1.00,VOWEL_URI_5=1.00,NO_RDNS2=0.01,MR_DIFF_MID=1.00
> > version=3.2.5
> Yes, 3.0 is too low, but so is your SA version. None of those 1.00
> point rules exist in the current version of SA. That's not to say the
> current version wouldn't also have issues with BB mail, but you'd at
> least be dealing with a modern ruleset.
They are not in stock 3.2.5 either. They are entirely local rules.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: BlackBerry Email Being Blocked by SpamAssassin
Posted by Jason Bertoch <ja...@i6ix.com>.
On 2011/01/13 1:40 PM, Brendan Murtagh wrote:
> X-spam-flag: YES
> X-spam-status: Yes, hits=3.01 required=3.00
> tests=HTML_MESSAGE=0.00,RATWARE_RCVD_BONUS_SPC=1.00,VOWEL_URI_5=1.00,NO_RDNS2=0.01,MR_DIFF_MID=1.00
> version=3.2.5
> X-spam-level: ***
> X-spam-checker-version: SpamAssassin 3.2.5 (1.1)
Yes, 3.0 is too low, but so is your SA version. None of those 1.00
point rules exist in the current version of SA. That's not to say the
current version wouldn't also have issues with BB mail, but you'd at
least be dealing with a modern ruleset.
--
/Jason
Re: BlackBerry Email Being Blocked by SpamAssassin
Posted by Giles Coochey <gi...@coochey.net>.
On 13/01/2011 21:06, Brendan Murtagh wrote:
> Thank you all for your quick responses and suggestions. I went ahead and
> adjusted the threshold from 3.00 to 5.00. I'll continue to monitor how the
> server is reacting to spam as we move forward.
>
> Thanks again for your help.
>
> -Brendan
The method I use, and it works pretty well, I am not aware of any false
positives and get very few false negatives:
If a mail scores 10 points or more, my MTA rejects the message
completely (via a milter).
If a mail scores 8 points or more, my MUA moves the message to the Spam
folder.
If a mail scores 5 points or more, my MTA replaces the body of the message.
My email address gets pounded by 100+ spam a day and I get very good
results.
Re: BlackBerry Email Being Blocked by SpamAssassin
Posted by Brendan Murtagh <bm...@powerhrg.com>.
Thank you all for your quick responses and suggestions. I went ahead and
adjusted the threshold from 3.00 to 5.00. I'll continue to monitor how the
server is reacting to spam as we move forward.
Thanks again for your help.
-Brendan
Brendan Murtagh wrote:
>
> Hello,
>
> Many of our employees have BlackBerry devices as well as iPhones, Droids,
> etc. However, the only device that is getting flagged as spam by
> SpamAssassin is BlackBerry. It doesn't matter if a new email is composed
> or its a reply. As long as its being sent from the device, it's being
> tagged with some of the tests listed below. The emails are arriving,
> however they are being delivered into the Spam folder and not the Inbox
> due to our mail server settings which append to the Subject line the spam
> score and move it to the Spam folder for email scored 3.0+
>
> X-spam-flag: YES
> X-spam-status: Yes, hits=3.01 required=3.00
> tests=HTML_MESSAGE=0.00,RATWARE_RCVD_BONUS_SPC=1.00,VOWEL_URI_5=1.00,NO_RDNS2=0.01,MR_DIFF_MID=1.00
> version=3.2.5
> X-spam-level: ***
> X-spam-checker-version: SpamAssassin 3.2.5 (1.1)
>
> We are running SpamAssassin 3.2.5 (1.1) with IceWarp Mail Server and
> currently the following are whitelisted within IceWarp:
>
> *.bis.na.blackberry.com
> *.blackberry.com
> *.blackberry.net
> @bis.na.blackberry.com
>
> Any advice would be greatly appreciated. Thanks!
>
> Sincerely,
>
> Brendan
>
>
>
> Brendan Murtagh
> IT Coordinator / Mail Server Manager
> PHONE: (610) 874-5000 x2232
> FAX: (610) 874-5030
>
> Power Home Remodeling Group
>
> http://www.powerhrg.com
>
> Window & Door Magazine's Dealer of the Year
> Voted Best Place to Work by Philadelphia Inquirer
>
> Before you print this email, is it necessary? Think pwsgreen.com
>
> Confidentiality Notice: Please be advised that no quotes, agreements, or
> understandings involving Power Windows and Siding, Inc., will be binding
> unless and until codified in a written document signed by an officer of
> the company. The information transmitted by this email is intended only
> for the use of the addressee(s) and may contain confidential and/or
> privileged information. Any interception, review, retransmission,
> dissemination, or other use of, or taking any action upon this information
> by persons or entities other than the intended recipient(s) is prohibited
> by law and may subject them to criminal or civil liability. If you have
> received this communication in error, please contact us immediately at
> (610) 874-5000 and delete the message from any computer or other storage
> system.
>
--
View this message in context: http://old.nabble.com/BlackBerry-Email-Being-Blocked-by-SpamAssassin-tp30665108p30665900.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: BlackBerry Email Being Blocked by SpamAssassin
Posted by Karsten Bräckelmann <gu...@rudersport.de>.
On Thu, 2011-01-13 at 10:40 -0800, Brendan Murtagh wrote:
> [...] As long as its being sent from the device, it's being tagged
> with some of the tests listed below. The emails are arriving, however they
> are being delivered into the Spam folder and not the Inbox due to our mail
> server settings which append to the Subject line the spam score and move it
> to the Spam folder for email scored 3.0+
This description was much better than your subject. :) SA does not
block mail, and as you just described, it doesn't even quarantine
identified spam either on its own. Anyway...
> X-spam-flag: YES
> X-spam-status: Yes, hits=3.01 required=3.00
The default required_score threshold is 5.0, and stock SA rules' scores
have been generated with that in mind.
> tests=HTML_MESSAGE=0.00,
> RATWARE_RCVD_BONUS_SPC=1.00,VOWEL_URI_5=1.00,NO_RDNS2=0.01,MR_DIFF_MID=1.00
The *only* rule that is in the stock SA rules is the first one, and
scoring merely informational.
All rules but the first one are your local rules, accounting for a score
of 3.01 -- which by default would not exceed the threshold. Even worse,
by default the overall score would be a positive 0.0.
Your own rules, together with your low required_score setting, are
causing your FPs.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
Re: BlackBerry Email Being Blocked by SpamAssassin
Posted by Martin Hepworth <ma...@gmail.com>.
Brendan
I'd suggest a score of 3 is quite low to be marked as spam, I usually start
at 5 at least if not higher.
I'd also look at making sure the BB is sending from the correct company
domains and not the generic blackberry domains.
--
Martin Hepworth
Oxford, UK
On 13 January 2011 18:40, Brendan Murtagh <bm...@powerhrg.com> wrote:
>
> Hello,
>
> Many of our employees have BlackBerry devices as well as iPhones, Droids,
> etc. However, the only device that is getting flagged as spam by
> SpamAssassin is BlackBerry. It doesn't matter if a new email is composed or
> its a reply. As long as its being sent from the device, it's being tagged
> with some of the tests listed below. The emails are arriving, however they
> are being delivered into the Spam folder and not the Inbox due to our mail
> server settings which append to the Subject line the spam score and move it
> to the Spam folder for email scored 3.0+
>
> X-spam-flag: YES
> X-spam-status: Yes, hits=3.01 required=3.00
>
> tests=HTML_MESSAGE=0.00,RATWARE_RCVD_BONUS_SPC=1.00,VOWEL_URI_5=1.00,NO_RDNS2=0.01,MR_DIFF_MID=1.00
> version=3.2.5
> X-spam-level: ***
> X-spam-checker-version: SpamAssassin 3.2.5 (1.1)
>
> We are running SpamAssassin 3.2.5 (1.1) with IceWarp Mail Server and
> currently the following are whitelisted within IceWarp:
>
> *.bis.na.blackberry.com
> *.blackberry.com
> *.blackberry.net
> @bis.na.blackberry.com
>
> Any advice would be greatly appreciated. Thanks!
>
> Sincerely,
>
> Brendan
>
>
>
> Brendan Murtagh
> IT Coordinator / Mail Server Manager
> PHONE: (610) 874-5000 x2232
> FAX: (610) 874-5030
>
> Power Home Remodeling Group
>
> http://www.powerhrg.com
>
> Window & Door Magazine's Dealer of the Year
> Voted Best Place to Work by Philadelphia Inquirer
>
> Before you print this email, is it necessary? Think pwsgreen.com
>
> Confidentiality Notice: Please be advised that no quotes, agreements, or
> understandings involving Power Windows and Siding, Inc., will be binding
> unless and until codified in a written document signed by an officer of the
> company. The information transmitted by this email is intended only for the
> use of the addressee(s) and may contain confidential and/or privileged
> information. Any interception, review, retransmission, dissemination, or
> other use of, or taking any action upon this information by persons or
> entities other than the intended recipient(s) is prohibited by law and may
> subject them to criminal or civil liability. If you have received this
> communication in error, please contact us immediately at (610) 874-5000 and
> delete the message from any computer or other storage system.
> --
> View this message in context:
> http://old.nabble.com/BlackBerry-Email-Being-Blocked-by-SpamAssassin-tp30665108p30665108.html
> Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
>
>