You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Dave Pooser <da...@pooserville.com> on 2007/05/22 22:21:17 UTC
False positives: [SPF failed: ]
So I've seen a few messages get falsely flagged in my quarantine range
(5.0-9.9) and a common theme seems to be SPF_SOFTFAIL and SPF_HELO_SOFTFAIL
both firing. An example is below; please forgive the minor obfuscation of
sender and recipients local parts. Domains and all other information are
unmunged.
Mail.alfordmedia.com is my server, and has an Exim server listening on port
25 and then handing off messages to CommuniGate Pro running on the same
server. The server was rebooted late last night and I had noticed no such
problems prior to that reboot.
Any suggestions appreciated.
=====
Return-Path: <us...@biggame.org>
X-Find-Attachment: Scanned
X-AttachExt: jpg
X-ExtScanner: Niversoft's Find_Attachments
X-AMS-SpamSorted:Yes
Received: from [127.0.0.1] (HELO mail.alfordmedia.com)
by mail.alfordmedia.com (CommuniGate Pro SMTP 4.2.10)
with ESMTP id 9220795 for username@alfordmedia.com; Tue, 22 May 2007
14:03:05 -0500
Received: from mail.biggame.org ([69.15.29.2] helo=biggame.org)
by mail.alfordmedia.com with esmtp (Exim 4.63)
(envelope-from <us...@biggame.org>)
id JIGI7Z-0008I6-D4
for username@alfordmedia.com; Tue, 22 May 2007 14:03:05 -0500
Content-class: urn:content-classes:message
Subject: A/V for pavilion
MIME-Version: 1.0
Content-Type: multipart/related;
boundary="----_=_NextPart_001_01C79CA3.96F0BD7D";
type="multipart/alternative"
Date: Tue, 22 May 2007 14:01:21 -0500
X-MimeOLE: Produced By Microsoft Exchange V6.5
Message-ID: <3A...@dscserver.DSC.Local>
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
Thread-Topic: A/V for pavilion
Thread-Index: Aceco5YR6P13/A8wTqmLuxjv8aTFbg==
From: "Gray Thornton" <us...@biggame.org>
To: <us...@whitlock.com>,
"Rich Tate" <us...@alfordmedia.com>,
"Haskell Stricklen" <us...@biggame.org>
X-Warning: biggame.org failed verification
X-AMS-Spam-Score: 5.6 (+++++)
X-Spam-Report: Content analysis details: (5.6 points, 5.0 required)
pts rule name description
---- ---------------------- -------------------------------------------
1.1 EXTRA_MPART_TYPE Header has extraneous Content-type:...type=
entry
1.4 SPF_SOFTFAIL SPF: sender does not match SPF record
(softfail)
[SPF failed: ]
2.4 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record
(softfail)
[SPF failed: ]
-2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
[score: 0.0000]
1.8 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of
words
0.0 HTML_MESSAGE BODY: HTML included in message
1.5 MY_CID_AND_ARIAL2 SARE CID and Arial2
X-Spam-Level: +++++
This is a multi-part message in MIME format.
--
Dave Pooser
Cat-Herder-in-Chief, Pooserville.com
"...Life is not a journey to the grave with the intention of arriving
safely in one pretty and well-preserved piece, but to slide across the
finish line broadside, thoroughly used up, worn out, leaking oil, and
shouting GERONIMO!!!" -- Bill McKenna
Re: False positives: [SPF failed: ]
Posted by "Daryl C. W. O'Shea" <sp...@dostech.ca>.
Dave Pooser wrote:
>> This looks familiar... as in I think I've fixed this before familiar.
>> What version of SA are you using?
>
> SA 3.1.5, Perl 5.8.6, on Mac OS X
>
> Some more reading found that [SPF failed: ] is a normal result for an SPF
> timeout, so I set spf_timeout 30 and will see if that helps any.
Yeah, it was fixed in 3.1.6 by bug 5077. It's a one line change if you
can't just upgrade to at least 3.1.8 (which should be painless).
Daryl
Re: False positives: [SPF failed: ]
Posted by Dave Pooser <da...@pooserville.com>.
> This looks familiar... as in I think I've fixed this before familiar.
> What version of SA are you using?
SA 3.1.5, Perl 5.8.6, on Mac OS X
Some more reading found that [SPF failed: ] is a normal result for an SPF
timeout, so I set spf_timeout 30 and will see if that helps any.
--
Dave Pooser
Cat-Herder-in-Chief
Pooserville.com
"Jon, the CIA's credibility has never been lower. Crazy people no longer
believe the CIA is implanting a chip in their heads to listen to their
dreams. They just don't think they can pull it off. It's a sad day for
America when even our paranoid schizophrenics realize they don't need to
wear the aluminum foil hats anymore." -- Ed Helms, "The Daily Show"
Re: False positives: [SPF failed: ]
Posted by "Daryl C. W. O'Shea" <sp...@dostech.ca>.
Dave Pooser wrote:
> So I've seen a few messages get falsely flagged in my quarantine range
> (5.0-9.9) and a common theme seems to be SPF_SOFTFAIL and SPF_HELO_SOFTFAIL
> both firing. An example is below; please forgive the minor obfuscation of
> sender and recipients local parts. Domains and all other information are
> unmunged.
> 1.4 SPF_SOFTFAIL SPF: sender does not match SPF record
> (softfail)
> [SPF failed: ]
> 2.4 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record
> (softfail)
> [SPF failed: ]
This looks familiar... as in I think I've fixed this before familiar.
What version of SA are you using?
Daryl