You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Alex <my...@gmail.com> on 2016/10/09 19:38:59 UTC
whitelist_auth and how to test
Hi all,
I've been experimenting with penalizing bulk mailers with points, but
there's a bulk email that was quarantined that apparently the users
actually want, so I'd like to just whitelist it.
I've added a whitelist_auth entry with the sender, but testing the
email afterwards doesn't show it's been whitelisted.
It's also unclear from the docs whether the From: address can be used,
or the more difficult MAILFROM address must be used, considering it
would be SPF that's used to authenticate it.
I've pasted the header here:
http://pastebin.com/ysq4A1nU
The whitelist entry I've created is:
whitelist_auth board@azhdi.com
The email passes SPF, but DKIM apparently isn't fully authenticated,
as it doesn't contain the DKIM_VALID_AU.
The sender is sendgrid.net, using an Envelope-From that contains a
random ID, making it impossible to use the whole address for the
whitelist_auth entry.
It's probably not a good idea to penalize sendgrid.net with 1.5
points, but I'm more interested in how to properly whitelist mails
like this for now.
Perhaps there's a better way to deal with bulk mailers like sendgrid
you might recommend?
Re: whitelist_auth and how to test
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 10 Oct 2016, at 8:42, David Jones wrote:
> UCE is different from spam and users should be able to unsubscribe
> from UCE.
The precise definition of "spam" has been a matter of debate among
knowledgeable, thoughtful, and well-intentioned people for over 20
years. There are a handful of times per year when an unsolicited email
sent to me for commercial purposes is absolutely not spam, even though
there's no formal mechanism to "unsubscribe" from it. That would be due
to the fact that it is not in any sense "bulk" or more importantly
"broadcast" mail, but rather mail sent specifically and intentionally to
me. There are also addresses on systems I help run which are heavily
targeted by unsolicited non-commercial email that is unequivocally
"spam" and that is mostly rejected at RCPT because its senders make no
attempt to obfuscate their identities, being US entities exempt from
most of CAN-SPAM.
Anyway, for many mail systems the fact that spam-for-hire shops like
SendGrid or MailChimp or Constant Contact or Marketo provide and/or
mandate functional unsub systems for all customers is not an adequate
basis for exempting them from filtering generally or even from being
relegated to a default-reject class of senders.
Re: whitelist_auth and how to test
Posted by David Jones <dj...@ena.com>.
>I suppose it depends on definition of "trustworthy".
>I had the experience with SendGrid, of them adding new servers without
>rDNS information. I called in and astoundingly enough, their "technical" person
>explained to me DNS didn't matter, and he had no interest in addressing it.
This is mail sending 101. Pretty stupid but not untrustworthy. That will
cause their email to get rejected for sure so they would have to fix that
pretty quickly or risk going out of business since sending email is their
primary function.
Hopefully you just got a level 1 support on the phone and their
level 3 mail engineers would know better and get that fixed fast.
> A trustworthy operation, always takes care of the plumbing.
Trustworthy from a spam perspective:
1. Reliable unsubscribe/opt-out process
2. Polices their outbound mail and takes action on abuse reports and
compromised accounts or bad customers/senders.
3. Keeps their mail servers off RBLs and a high senderscore.org score.
4. Doesn't send spam/malware/viruses/phishing. UCE is different
from spam and users should be able to unsubscribe from UCE. If
the unsubscribe process just harvests/confirms the email address,
then it is spam.
Re: whitelist_auth and how to test
Posted by Vincent Fox <vb...@ucdavis.edu>.
I suppose it depends on definition of "trustworthy".
I had the experience with SendGrid, of them adding new servers without
rDNS information. I called in and astoundingly enough, their "technical" person
explained to me DNS didn't matter, and he had no interest in addressing it.
A trustworthy operation, always takes care of the plumbing.
________________________________
From: David Jones <dj...@ena.com>
Sent: Sunday, October 9, 2016 1:03:42 PM
To: Alex; SA Mailing list
Subject: Re: whitelist_auth and how to test
>The sender is sendgrid.net, using an Envelope-From that contains a
>random ID, making it impossible to use the whole address for the
>whitelist_auth entry.
>It's probably not a good idea to penalize sendgrid.net with 1.5
>points, but I'm more interested in how to properly whitelist mails
>like this for now.
>Perhaps there's a better way to deal with bulk mailers like sendgrid
>you might recommend?
Sendgrid.net is trustworthy and has a valid unsubscribe process so
they should be whitelisted safely with whitelist_auth. Let your users
decide for themselves if they want to unsubscribe from any email
sent by sendgrid.net.
whitelist_auth *@sendgrid.net
There are many safe bulk senders like this. It comes down to good
reputation with a valid opt-out process.
Re: whitelist_auth and how to test
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 9 Oct 2016, at 16:03 +0400, David Jones wrote:
>> The sender is sendgrid.net, using an Envelope-From that contains a
>> random ID,
In my logs and mail corpus, there's strong indication that SendGrid
Envelope-Froms are not random at all. For a constant target address and
RFC5322From domain tuple, the Envelope-From appears to remain constant
over periods at least as long as 3 years.
>> making it impossible to use the whole address for the
>> whitelist_auth entry.
>
>> It's probably not a good idea to penalize sendgrid.net with 1.5
>> points, but I'm more interested in how to properly whitelist mails
>> like this for now.
>
>> Perhaps there's a better way to deal with bulk mailers like sendgrid
>> you might recommend?
>
> Sendgrid.net is trustworthy and has a valid unsubscribe process so
> they should be whitelisted safely with whitelist_auth.
That's highly debatable. If I did that on my own system, >90% of the
mail accepted from SendGrid would be spam, with a significant fraction
of that being aimed at the address I ONLY use for this mailing list and
even more aimed at a handful of traps that haven't accepted any mail in
>5 years.
> Let your users
> decide for themselves if they want to unsubscribe from any email
> sent by sendgrid.net.
>
> whitelist_auth *@sendgrid.net
Or for the specific case in question, with this envelope sender:
bounces+3673796-4681-darrell.cranford=example.com@sendgrid.net
A narrow exemption for the specific individual target user:
whitelist_auth bounces+*-darrell.cranford@sendgrid.net
Also, it appears that this would let all mailings from the same SendGrid
customer through:
whitelist_auth bounces+3673796-*@sendgrid.net
And to let through just one list to anyone, this MAY work:
whitelist_auth bounces+3673796-4681-*@sendgrid.net
These are based on non-spam SendGrid mail. The first number is
definitely a customer ID; 2 addresses receiving different mailings from
the same SendGrid customer have the same value there. The second seems
to be a list ID, although I suppose it could be a recipient ID to
supplement the obvious target address VERP'ed into the Envelope-From.
Also important to note: The Envelope-From domain is not always
sendgrid.net, although as far as I can tell it is constant per SendGrid
customer.
> There are many safe bulk senders like this. It comes down to good
> reputation with a valid opt-out process.
Opinions vary greatly on the critical factors for what constitutes a
"safe" bulk sender-for-hire. If I were asked to name one I could just
barely do so, but I suppose there could be some who are so good that I'm
unaware of their existence. For the sites I help manage, a "good
reputation" is worthless, since a fair bit of that seems to be based on
social interactions at M3AAWG events. A valid opt-out process is an
absolute must, not giving new customers a clear pass on imported lists
is important, and being willing to "fire customers" reliably is helpful.
Re: whitelist_auth and how to test
Posted by David Jones <dj...@ena.com>.
>The sender is sendgrid.net, using an Envelope-From that contains a
>random ID, making it impossible to use the whole address for the
>whitelist_auth entry.
>It's probably not a good idea to penalize sendgrid.net with 1.5
>points, but I'm more interested in how to properly whitelist mails
>like this for now.
>Perhaps there's a better way to deal with bulk mailers like sendgrid
>you might recommend?
Sendgrid.net is trustworthy and has a valid unsubscribe process so
they should be whitelisted safely with whitelist_auth. Let your users
decide for themselves if they want to unsubscribe from any email
sent by sendgrid.net.
whitelist_auth *@sendgrid.net
There are many safe bulk senders like this. It comes down to good
reputation with a valid opt-out process.
Re: whitelist_auth and how to test
Posted by Alex <my...@gmail.com>.
Hi,
>> The whitelist entry I've created is:
>> whitelist_auth board@azhdi.com
>>
>> The email passes SPF, but DKIM apparently isn't fully authenticated,
>> as it doesn't contain the DKIM_VALID_AU.
>>
>> The sender is sendgrid.net, using an Envelope-From that contains a
>> random ID, making it impossible to use the whole address for the
>> whitelist_auth entry.
>>
>> It's probably not a good idea to penalize sendgrid.net with 1.5
>> points, but I'm more interested in how to properly whitelist mails
>> like this for now.
>>
>> Perhaps there's a better way to deal with bulk mailers like sendgrid
>> you might recommend?
>
> whitelist_from_dkim board@azhdi.com sendgrid.net
>
> Mail::SpamAssassin::Plugin::DKIM
Thanks guys for your help. I've removed sendgrid from my list and also
added the whitelist_from_dkim entry for this specific sender.
Re: whitelist_auth and how to test
Posted by bOnK <li...@nospam.webmeneer.net>.
On 9-10-2016 21:38, Alex wrote:
> Hi all,
>
> I've been experimenting with penalizing bulk mailers with points, but
> there's a bulk email that was quarantined that apparently the users
> actually want, so I'd like to just whitelist it.
>
> I've added a whitelist_auth entry with the sender, but testing the
> email afterwards doesn't show it's been whitelisted.
>
> It's also unclear from the docs whether the From: address can be used,
> or the more difficult MAILFROM address must be used, considering it
> would be SPF that's used to authenticate it.
>
> I've pasted the header here:
> http://pastebin.com/ysq4A1nU
>
> The whitelist entry I've created is:
> whitelist_auth board@azhdi.com
>
> The email passes SPF, but DKIM apparently isn't fully authenticated,
> as it doesn't contain the DKIM_VALID_AU.
>
> The sender is sendgrid.net, using an Envelope-From that contains a
> random ID, making it impossible to use the whole address for the
> whitelist_auth entry.
>
> It's probably not a good idea to penalize sendgrid.net with 1.5
> points, but I'm more interested in how to properly whitelist mails
> like this for now.
>
> Perhaps there's a better way to deal with bulk mailers like sendgrid
> you might recommend?
whitelist_from_dkim board@azhdi.com sendgrid.net
Mail::SpamAssassin::Plugin::DKIM
--
b.