[SpamAssassin Wiki] Updated: FalsePositives

[sp...@incubator.apache.org]

   Date: 2004-03-15T08:55:42
   Editor: DavidCary <d....@ieee.org>
   Wiki: SpamAssassin Wiki
   Page: FalsePositives
   URL: http://wiki.apache.org/spamassassin/FalsePositives

   FORGED_JUNO_RCVD is broken

Change Log:

------------------------------------------------------------------------------
@@ -2,14 +2,63 @@
 
 As http://spamassassin.org/tag/ explains, sometimes SpamAssassin will get a "false positive", resulting in tagged mails which are not actually spam at all.
 
-Since spammers don't usually highlight the fact that their mail is unwanted, unsolicited ads, SpamAssassin has to try to work it out -- and it's not always easy to do. And it's only a computer program, so it does get it wrong sometimes -- even humans do. 
+Since spammers don't usually highlight the fact that their mail is unwanted, unsolicited ads, SpamAssassin has to try to work it out -- and it's not always easy to do. And it's only a computer program, so it does get it wrong sometimes -- even humans do.
 
 We use a huge database of mail traffic, and analyse the hit rates of each rule to maintain quality and try to ensure that they only hit spam (as much as possible, at least). Rules that hit non-spam get very low scores.
 
-Tip: examine exactly which rules were triggered. Take careful note of the _points_ listed beside each rule name -- low-scoring rules do not make much of a difference; it's the ones with high scores that need to be avoided. 
+Tip: examine exactly which rules were triggered. Take careful note of the _points_ listed beside each rule name -- low-scoring rules do not make much of a difference; it's the ones with high scores that need to be avoided.
 
 If you are the mail sender, this may help: AvoidingFpsForSenders
 
 If you admin a SpamAssassin installation and suspect something in the configuration may be wrong, see here: AvoidingFpsForAdmins
 
-ManualWhitelist
+If you are the recipient, simply add that sender
+to your ManualWhitelist.
+(You could also change the score of the rules that were triggered. See WritingRules).
+
+
+== FORGED_JUNO_RCVD is broken ==
+
+I just now noticed that email from my friends who use Juno is being marked as spam.
+They hit the
+
+{{{
+2.8 FORGED_JUNO_RCVD       'From' juno.com does not match 'Received' headers
+2.4 OPT_HEADER             Headers include an "opt"ed phrase
+}}}
+
+rules, which is already 5.2 points.
+
+{{{
+Received: (from [[my friend at]]juno.com)
+ by webmail03.lax.untd.com (jqueuemail) id JN4CHC6U; Mon, 23 Feb 2004 09:05:53 PST
+Received: from [199.245.163.1] by webmail03.lax.untd.com with HTTP:
+	Mon, 23 Feb 2004 17:05:40 GMT
+X-Originating-IP: [199.245.163.1]
+Mime-Version: 1.0
+X-Original-From: "[[my friend at]]juno.com" <[[my friend at]]juno.com>
+Date: Mon, 23 Feb 2004 17:05:40 GMT
+To: [[DavidCary at]]ieee.org
+Subject: Bolivar
+X-Mailer: WebMail Version 2.0
+Content-Type: text/plain
+From: [[my friend at]]juno.com
+Message-Id: <20...@webmail03.lax.untd.com>
+X-ContentStamp: 2:2:815233092
+X-UCE-Filter-Settings: david_cary redirected to 90_OPT_OUT
+X-Scanned-By: IEEE UCE Filtering Service
+}}}
+
+Currently I work around this by setting
+{{{
+score FORGED_JUNO_RCVD 1
+score OPT_HEADER 0
+}}}
+
+but someone (?) really should fix the FORGED_JUNO_RCVD rule so it does *not* trigger on mail that truly does come from innocent Juno users.
+
+-- DavidCary
+
+
+
+----