You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by John Clements <ao...@brinckerhoff.org> on 2007/04/13 22:12:06 UTC
yahoo groups: Date: fields flagged as non-rfc-2822-compliant?
It appears to me that all mail coming through Yahoo groups is getting
at least 4.5 points because of yahoo's use of tiny fonts and of non-
compliant Date: formats. Here's the spamassassin analysis:
pts rule name description
---- ----------------------
--------------------------------------------------
2.2 INVALID_DATE Invalid Date: header (not RFC 2822)
0.1 HTML_90_100 BODY: Message is 90% to 100% HTML
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 BAYES_50 BODY: Bayesian spam probability is 40 to
60%
[score: 0.5000]
2.3 HTML_TINY_FONT RAW: body contains 1 or 0-point font
And below, here's a segment of the headers; I'm reluctant to post the
whole thing, because it's not my mail. I have included every one of
the "Date:" headers, though.
...
Received: from n20c.bullet.sp1.yahoo.com (n20c.bullet.sp1.yahoo.com
[69.147.64.135])
by penkwe.pair.com (Postfix) with SMTP id 9934261ED1
for <ao...@brinckerhoff.org>; Thu, 5 Apr 2007 08:05:40 -0400
(EDT)
Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=lima;
d=yahoogroups.com;
b=L8RGQYYJQzzj14LQLy04I7M37sr6NZrdaJlbusX3mPJeVXc9ATVUhGAalGuLy4DJa
+HamL/DpLAKac8J+Hgpk8AHzE/zr22UYsp8uxU0YJomaT+8NAlFujfGv+/UNDxs;
Received: from [216.252.122.219] by n20.bullet.sp1.yahoo.com with
NNFMP; 05 Apr 2007 12:05:39 -0000
Date: 05 Apr 2007 05:05:39 -0700
Received: from [66.218.69.6] by t4.bullet.sp1.yahoo.com with NNFMP;
05 Apr 2007 12:05:39 -0000
Date: 05 Apr 2007 05:05:39 -0700
Received: from [66.218.67.93] by t6.bullet.scd.yahoo.com with NNFMP;
05 Apr 2007 12:05:39 -0000
X-Yahoo-Newman-Id: 479767-m1695
Received: (qmail 36685 invoked by uid 7800); 5 Apr 2007 12:05:37 -0000
X-Sender: hgh@rcwm.com
X-Apparently-To: unison-users@yahoogroups.com
Received: (qmail 88523 invoked from network); 5 Apr 2007 11:45:21 -0000
Received: from unknown (66.218.67.34)
by m25.grp.scd.yahoo.com with QMQP; 5 Apr 2007 11:45:21 -0000
Received: from unknown (HELO bastion.rcwm.com) (24.153.175.131)
by mta8.grp.scd.yahoo.com with SMTP; 5 Apr 2007 11:45:21 -0000
...
MIME-Version: 1.0
Mailing-List: list unison-users@yahoogroups.com; contact unison-users-
owner@yahoogroups.com
Delivered-To: mailing list unison-users@yahoogroups.com
List-Id: <unison-users.yahoogroups.com>
Precedence: bulk
List-Unsubscribe: <ma...@yahoogroups.com>
Date: Thu, 05 Apr 2007 06:46:01 -0500
Subject: [unison-users] Why aren't my emails hitting the list or
being sent back to me as
a subscriber? {Scanned}
...
(The "..."s are inserted by me, of course.)
Now, I took a quick look at rfc 2822, and all of the Date fields in
this e-mail would appear to be compliant. So: is there a bug in
spamassassin's Date parsing, or is yahoo committing some subtle bug,
or is the mailer's original date somehow non-compliant?
Many thanks in advance,
John Clements
Re: yahoo groups: Date: fields flagged as non-rfc-2822-compliant?
Posted by Mark Martinec <Ma...@ijs.si>.
On Saturday April 14 2007 01:24:47 John Clements wrote:
> >> Date: 05 Apr 2007 05:05:39 -0700
> >> Date: 05 Apr 2007 05:05:39 -0700
> >> Date: Thu, 05 Apr 2007 06:46:01 -0500
> >> Now, I took a quick look at rfc 2822, and all of the Date fields
> >> in this e-mail would appear to be compliant.
Yes, the day-of-week with its comma is optional.
> >> So: is there a bug
> >> in spamassassin's Date parsing, or is yahoo committing some subtle
> >> bug, or is the mailer's original date somehow non-compliant?
> Yes, that's a wonderful question. Apparently, Yahoo feels the need
> to insert additional Date: headers as it remails things.
RFC 2822 section 3.6 mandates there must be exactly one Date
header field.
> Perhaps multiple Date: headers is the reason that spam assassin
> considers it non-compliant?
So it seems (and rightfully so).
Perhaps it would be better to have a separate rule for multiple
header fields which may appear at most once, in analogy with
a MISSING_DATE which covers for the lower bound - if need appears
to give them different scores.
Mark
Re: yahoo groups: Date: fields flagged as non-rfc-2822-compliant?
Posted by John Clements <ao...@brinckerhoff.org>.
On Apr 13, 2007, at 2:05 PM, mouss wrote:
> John Clements wrote:
>> It appears to me that all mail coming through Yahoo groups is
>> getting at least 4.5 points because of yahoo's use of tiny fonts
>> and of non-compliant Date: formats. Here's the spamassassin
>> analysis:
>>
>> And below, here's a segment of the headers; I'm reluctant to post
>> the whole thing, because it's not my mail. I have included every
>> one of the "Date:" headers, though.
>>
>> ...
>> Date: 05 Apr 2007 05:05:39 -0700
>> ...
>> Date: 05 Apr 2007 05:05:39 -0700
>> ...
>> Date: Thu, 05 Apr 2007 06:46:01 -0500
>> Subject: [unison-users] Why aren't my emails hitting the list or
>> being sent back to me as
>> a subscriber? {Scanned}
>> ...
>>
>> (The "..."s are inserted by me, of course.)
>>
>> Now, I took a quick look at rfc 2822, and all of the Date fields
>> in this e-mail would appear to be compliant. So: is there a bug
>> in spamassassin's Date parsing, or is yahoo committing some subtle
>> bug, or is the mailer's original date somehow non-compliant?
>>
>> Many thanks in advance,
>>
>> John Clements
>>
>>
>
> - why are there multiple Date headers?
> - the date fields look ok indeed.
Yes, that's a wonderful question. Apparently, Yahoo feels the need
to insert additional Date: headers as it remails things. Perhaps
multiple Date: headers is the reason that spam assassin considers it
non-compliant?
Many thanks,
John Clements
Re: yahoo groups: Date: fields flagged as non-rfc-2822-compliant?
Posted by mouss <mo...@netoyen.net>.
John Clements wrote:
> It appears to me that all mail coming through Yahoo groups is getting
> at least 4.5 points because of yahoo's use of tiny fonts and of
> non-compliant Date: formats. Here's the spamassassin analysis:
>
> pts rule name description
> ---- ----------------------
> --------------------------------------------------
> 2.2 INVALID_DATE Invalid Date: header (not RFC 2822)
> 0.1 HTML_90_100 BODY: Message is 90% to 100% HTML
> 0.0 HTML_MESSAGE BODY: HTML included in message
> 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
> [score: 0.5000]
> 2.3 HTML_TINY_FONT RAW: body contains 1 or 0-point font
>
>
> And below, here's a segment of the headers; I'm reluctant to post the
> whole thing, because it's not my mail. I have included every one of
> the "Date:" headers, though.
>
> ...
> Received: from n20c.bullet.sp1.yahoo.com (n20c.bullet.sp1.yahoo.com
> [69.147.64.135])
> by penkwe.pair.com (Postfix) with SMTP id 9934261ED1
> for <ao...@brinckerhoff.org>; Thu, 5 Apr 2007 08:05:40
> -0400 (EDT)
> Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys
> DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=lima;
> d=yahoogroups.com;
> b=L8RGQYYJQzzj14LQLy04I7M37sr6NZrdaJlbusX3mPJeVXc9ATVUhGAalGuLy4DJa+HamL/DpLAKac8J+Hgpk8AHzE/zr22UYsp8uxU0YJomaT+8NAlFujfGv+/UNDxs;
>
> Received: from [216.252.122.219] by n20.bullet.sp1.yahoo.com with
> NNFMP; 05 Apr 2007 12:05:39 -0000
> Date: 05 Apr 2007 05:05:39 -0700
> Received: from [66.218.69.6] by t4.bullet.sp1.yahoo.com with NNFMP; 05
> Apr 2007 12:05:39 -0000
> Date: 05 Apr 2007 05:05:39 -0700
> Received: from [66.218.67.93] by t6.bullet.scd.yahoo.com with NNFMP;
> 05 Apr 2007 12:05:39 -0000
> X-Yahoo-Newman-Id: 479767-m1695
> Received: (qmail 36685 invoked by uid 7800); 5 Apr 2007 12:05:37 -0000
> X-Sender: hgh@rcwm.com
> X-Apparently-To: unison-users@yahoogroups.com
> Received: (qmail 88523 invoked from network); 5 Apr 2007 11:45:21 -0000
> Received: from unknown (66.218.67.34)
> by m25.grp.scd.yahoo.com with QMQP; 5 Apr 2007 11:45:21 -0000
> Received: from unknown (HELO bastion.rcwm.com) (24.153.175.131)
> by mta8.grp.scd.yahoo.com with SMTP; 5 Apr 2007 11:45:21 -0000
> ...
> MIME-Version: 1.0
> Mailing-List: list unison-users@yahoogroups.com; contact
> unison-users-owner@yahoogroups.com
> Delivered-To: mailing list unison-users@yahoogroups.com
> List-Id: <unison-users.yahoogroups.com>
> Precedence: bulk
> List-Unsubscribe: <ma...@yahoogroups.com>
> Date: Thu, 05 Apr 2007 06:46:01 -0500
> Subject: [unison-users] Why aren't my emails hitting the list or being
> sent back to me as
> a subscriber? {Scanned}
> ...
>
> (The "..."s are inserted by me, of course.)
>
> Now, I took a quick look at rfc 2822, and all of the Date fields in
> this e-mail would appear to be compliant. So: is there a bug in
> spamassassin's Date parsing, or is yahoo committing some subtle bug,
> or is the mailer's original date somehow non-compliant?
>
> Many thanks in advance,
>
> John Clements
>
>
- why are there multiple Date headers?
- the date fields look ok indeed.