You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Kris Deugau <kd...@vianet.ca> on 2022/09/28 22:13:15 UTC
More Sendgrid trouble?
Is anyone else seeing intermittent FNs on mail sent through Sendgrid
where the nominal sender has a default welcomelist_* entry?
Today's spample is a Mcafee scam email, pretty clearly sent through
Intuit's Sendgrid account based on the rDNS. On testing in my sandbox
it was only allowed through due to the stock welcomelist entry for Intuit.
Not 100% sure whether this is a Sendgrid issue, or an Intuit issue -
I've reported the message to both of them, for whatever good it will do.
-kgd
Re: More Sendgrid trouble?
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 2022-09-29 at 13:26:45 UTC-0400 (Thu, 29 Sep 2022 13:26:45 -0400)
Greg Troxel <gd...@lexort.com>
is rumored to have said:
> Kris Deugau <kd...@vianet.ca> writes:
>
>> The Bayes result is not great, but the USER_IN_DEF_*_WL hits between
>> them account for most of that negative score anyway.
>
> With dkim-signed spam, I think the only two paths forward are:
> - hope they fix their apparently compromised system
> - take them out the default WL (locally now, and via a rule update in
> a few weeks)
Or a few days...
# svn commit -m "Intuit reported as spamming on Users ML" 60_welcomelist_auth.cf
Authentication realm: <https://svn.apache.org:443> ASF Committers
Password for 'billcole': ***************
Sending 60_welcomelist_auth.cf
Transmitting file data .done
Committing transaction...
Committed revision 1904337.
I believe that means it will be gone before Monday.
--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not Currently Available For Hire
Re: More Sendgrid trouble?
Posted by Andrew C Aitchison <sp...@aitchison.me.uk>.
On Thu, 8 May 2025, Michael Orlitzky wrote:
> On 2025-05-08 08:11:18, Marc wrote:
>>
>> I used a greylist where emails get a 4xx message with a link that
>> allows the email through so 'regular' users can get past it. Problem
>> is, these fucked up networks are not even notifying users about 5xx
>> and 4xx notifications.
>
> With sendgrid, it depends on the 4xx message, but they often just
> silently delete the message. It turns out that, even though the RFCs
> explicitly forbid you from doing it, this multi-billion dollar company
> has a list of hand-written regexes that they use to "parse" each
> rejection message. If the regex decides that a retry is unlikely to
> succeed, they delete it.
>
> Most interestingly, they apparently delete messages that get a
> connection refused. In the past this was easy to test: turn off your
> mail server, do something on Github, turn it back on. The
> notifications would never arrive.
>
> They're a spam company whose massive marketing department has tricked
> people into thinking they're good for sending transactional email. But
> caveat emptor, they treat your password resets and order receipts like
> spam too.
If I thought that many users had them enabled,
I would suggest requesting Mail Delivery Reports.
Perhaps I should consider enabling them.
--
Andrew C. Aitchison Kendal, UK
andrew@aitchison.me.uk
Re: More Sendgrid trouble?
Posted by Michael Orlitzky <mi...@orlitzky.com>.
On 2025-05-08 08:11:18, Marc wrote:
>
> I used a greylist where emails get a 4xx message with a link that
> allows the email through so 'regular' users can get past it. Problem
> is, these fucked up networks are not even notifying users about 5xx
> and 4xx notifications.
With sendgrid, it depends on the 4xx message, but they often just
silently delete the message. It turns out that, even though the RFCs
explicitly forbid you from doing it, this multi-billion dollar company
has a list of hand-written regexes that they use to "parse" each
rejection message. If the regex decides that a retry is unlikely to
succeed, they delete it.
Most interestingly, they apparently delete messages that get a
connection refused. In the past this was easy to test: turn off your
mail server, do something on Github, turn it back on. The
notifications would never arrive.
They're a spam company whose massive marketing department has tricked
people into thinking they're good for sending transactional email. But
caveat emptor, they treat your password resets and order receipts like
spam too.
Re: More Sendgrid trouble?
Posted by Vincent Lefevre <vi...@vinc17.net>.
On 2025-05-09 11:46:14 +0200, Matija Nalis wrote:
> Today, if the e-mail you're sending is important, you'll follow it up
> with IM or voice call to verify if it has reached the recipient.
No, at least for me, there is too much mail that is regarded as
important, and it would be a waste of time. For some of important
mail, the recipient would normally reply (by mail), but one may
also forget to check.
> Nobody today _expects_ that every e-mail will get delivered at all
> (or that anyone would notified on failure to deliver), much less that
> it would happen in reasonable time. Which is a shame.
Not also that mail may get delivered but fall in some spam folder
or get forgotten when one receives too much mail.
> DSN's were an elegant solution... for a more civilized age.
Perhaps DSN should be changed to a read notification sent by the MUA,
and requiring the user's confirmation (a bit like a reply by mail,
but lighter and in a standard form).
--
Vincent Lefèvre <vi...@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)
Re: More Sendgrid trouble?
Posted by Matija Nalis <mn...@voyager.hr>.
On Fri, May 09, 2025 at 02:15:15PM -0700, jdow wrote:
> On 20250509 06:14:59, Matija Nalis wrote:
> > While I'm not familiar with RBBS specifically, other BBS software I
> > used (like PCBoard) did guarantee message delivery. Only way a
>
> Or the recipient could never get around to reading it.
Of course, but that is not what we were talking about.
The issue was whether the message was delivered to recipient mailbox;
NOT whether they've opened it, or whether they've read it, or whether
they've understood the content, or whether they've acted upon the
content in a way that sender wished,
> I will give you one thing, the post office supposedly always delivers. But,
> they don't.
Well, post office around here definitely does not always deliver, not
even in theory. There is even add-on for registered mail with return
receipt which you may decide to pay extra for; post office then must
deliver a signature proof of recipient where recipient identified
with their national ID card, or a proof of non-delivery. Without
that, it is just best-effort. YMMV.
> Thieves get into mailboxes.
Sure, and cyber-criminals can hack your computer and delete/encrypt
your mailbox (or more likely your whole hard drive) after you've
downloaded messages too, but before you could get a chance to
actually read it.
But whether your mailbox was read (or deleted) by someone (authorized
or not) other than intended recipient, is yet another different
subject, better suited for some other list.
> And recognized spam finds its way into the trash "received" but
> unread.
Sure, but how is that related? You've configured your system to
classify something as spam, and you may (or may not) decide to read
(or at least skim) your spam folder (if it exists) occasionally for
FP. What you decided to do (manually or automatically) with that
e-mail is separate from fact that the e-mail was in fact delivered to
your server (IOW, after your server confirmed SMTP with '200 Ok',
it becomes fully your responsibility)
This being spamassassin-users list, I'll assume most of us here are
in control of what happens to incoming messages classified (or
missclassified) as spam.
If you want confirmation that the the e-mail was indicated as
actually OPENED by the user, sender and recipient MUAs should support
MDNs as defined by e.g. RFC 8098 (STD 85). That should give you
more-or-less equivalent of registered postal mail with return
receipt.
That RFC also mentions limitations (which should be obvious, but
better to spell it out) of e.g. disposition-type = "displayed"
by saying it means:
"The message has been displayed by the MUA to someone
reading the recipient's mailbox. There is no guarantee that the
content has been read or understood.",
as well as other issues related to it (like possible forgeries,
privacy issues, non-repudiation, mail bombing, etc.)
> things could go wrong. Do you presume PCBoard had no bugs or is
> that a demonstrated fact?
PCBoard certainly had bugs, but even after many years of using it I
have never experienced such a bug leading to submitted message not
being delivered, nor have I ever heard of that happening to other
sysops or users in the country, or even wider.
Thus, lacking any evidence to the contrary, I'll presume there wasn't
one (or at the very least, that if it existed it was extremely rare
occurance).
Contrast that to e-mail, where anybody who has been using it for a
month will likely be well aware of delivery issues by personal
experience.
> 'nuf said on my part. Take your parting shot if you will.
Anyway, it is getting too off-topic, so while I'd like to chat up
about good old days where much more love and care seem to have gone
into writing software and checking it actually works, I'll drop the
subject here not to bore other users.
Please contact me directly via E-mail (ha!) if you feel the need to
respond, and it is not related to spamassassin.
Thanks for your understanding.
--
Opinions above are GNU-copylefted.
Re: More Sendgrid trouble?
Posted by jdow <jd...@earthlink.net>.
On 20250509 06:14:59, Matija Nalis wrote:
> On Fri, May 09, 2025 at 03:32:58AM -0700, jdow wrote:
>> On 20250509 02:46:14, Matija Nalis wrote:
>>> Not only did people fully expect that e-mail they sent would be
>>> delivered, they would expected it would be delivered promptly.
>>>
>>> If it even got delayed by few hours, that was considered a serious
>>> problem, and a reason to call up the postmaster on another side and
>>> inform them to fix their system.
>> Please excuse me, but what world do you live in? Since day one email
> Earth, more precisely Europe. And you?
That's debatable. I was brought up on Earth.
>> delivery has been best effort and not guaranteed, even on (some) RBBS
>> systems running on the likes of CP/M on 8080s before ARPANET and all that
>> fuzz.
> Didn't ARPANET predate 8080 processors but good half a decade?
About. But, curiosity led me to some old documentation.
> While I'm not familiar with RBBS specifically, other BBS software I
> used (like PCBoard) did guarantee message delivery. Only way a
> message could be lost if there was total system crash (usually
> hardware loss), and in that case (I've lived through few), you'd
> still get a prominent system board notice about the loss next time
> you logged on, or inability to log on (if the BSS went out of service
> permanently). So you'd know your message wasn't delivered in any
> case.
Or the recipient could never get around to reading it.
I will give you one thing, the post office supposedly always delivers. But, they
don't. Thieves get into mailboxes. And recognized spam finds its way into the
trash "received" but unread. Any email system is very likely to suffer this same
problem as thieves improve their hacking techniques. That's just one way things
could go wrong. Do you presume PCBoard had no bugs or is that a demonstrated fact?
'nuf said on my part. Take your parting shot if you will.
{^_^}
Re: More Sendgrid trouble?
Posted by Matija Nalis <mn...@voyager.hr>.
On Fri, May 09, 2025 at 03:32:58AM -0700, jdow wrote:
> On 20250509 02:46:14, Matija Nalis wrote:
> > Not only did people fully expect that e-mail they sent would be
> > delivered, they would expected it would be delivered promptly.
> >
> > If it even got delayed by few hours, that was considered a serious
> > problem, and a reason to call up the postmaster on another side and
> > inform them to fix their system.
>
> Please excuse me, but what world do you live in? Since day one email
Earth, more precisely Europe. And you?
> delivery has been best effort and not guaranteed, even on (some) RBBS
> systems running on the likes of CP/M on 8080s before ARPANET and all that
> fuzz.
Didn't ARPANET predate 8080 processors but good half a decade?
While I'm not familiar with RBBS specifically, other BBS software I
used (like PCBoard) did guarantee message delivery. Only way a
message could be lost if there was total system crash (usually
hardware loss), and in that case (I've lived through few), you'd
still get a prominent system board notice about the loss next time
you logged on, or inability to log on (if the BSS went out of service
permanently). So you'd know your message wasn't delivered in any
case.
But I was talking about e-mail (i.e. RFC822 messages over RFC821
protocol), not any kind of message-exchanging system.
And I expressed my historical experiences with E-mail, circa 1992.
There were a lot less e-mails then, and people here did read all
e-mails they received back here back then. Something that is nigh
impossible (nor wanted) today, due to proliferation of e-mails for
all kinds of purposes, only small percentage of which is wanted
person-to-person communication.
If yours experience differ, that is fine. But we digress from this
mailing list purpose.
> Perhaps cooling off, despite being on a splendid roll there, would let your
> mind wander enough to better real solutions to your problems. (Which
> probably include me. But, I just could not permit that whopper to float by
> without comment.)
Perhaps you misread; I was not the one having problems with 4xx/5xx
SMTP error codes handling, nor soliciting solutions for them here.
Nor would I include you among "my problems", despite your (uncalled for)
perkiness.
--
Opinions above are GNU-copylefted.
Re: More Sendgrid trouble?
Posted by jdow <jd...@earthlink.net>.
On 20250509 02:46:14, Matija Nalis wrote:
> On Thu, May 08, 2025 at 05:22:32PM -0400, John Levine wrote:
>> It appears that Marc<Ma...@f1-outsourcing.eu> said:
>>>> Yeah, at this point, if I get anything from Outlook, Yahoo, Google,
>>>> Mailchimp, Mailgun, OVH, or Sendgrid and it’s not a explicitly a
>>>> whitelisted entry, I bounce it.
>>> I used a greylist where emails get a 4xx message with a link that allows the email through ...
>> Why would a mail system tell senders about a 4xx reply? That means to try again, not to bounce it.
> In a good old times, people had expectations of computer systems that
> they will perform their function.
>
> Not only did people fully expect that e-mail they sent would be
> delivered, they would expected it would be delivered promptly.
>
> If it even got delayed by few hours, that was considered a serious
> problem, and a reason to call up the postmaster on another side and
> inform them to fix their system.
Please excuse me, but what world do you live in? Since day one email delivery
has been best effort and not guaranteed, even on (some) RBBS systems running on
the likes of CP/M on 8080s before ARPANET and all that fuzz.
Perhaps cooling off, despite being on a splendid roll there, would let your mind
wander enough to better real solutions to your problems. (Which probably include
me. But, I just could not permit that whopper to float by without comment.)
{^_^} Joanne - who was there with modem then.
Re: More Sendgrid trouble?
Posted by Matija Nalis <mn...@voyager.hr>.
On Thu, May 08, 2025 at 05:22:32PM -0400, John Levine wrote:
> It appears that Marc <Ma...@f1-outsourcing.eu> said:
> >> Yeah, at this point, if I get anything from Outlook, Yahoo, Google,
> >> Mailchimp, Mailgun, OVH, or Sendgrid and it’s not a explicitly a
> >> whitelisted entry, I bounce it.
> >
> >I used a greylist where emails get a 4xx message with a link that allows the email through ...
>
> Why would a mail system tell senders about a 4xx reply? That means to try again, not to bounce it.
In a good old times, people had expectations of computer systems that
they will perform their function.
Not only did people fully expect that e-mail they sent would be
delivered, they would expected it would be delivered promptly.
If it even got delayed by few hours, that was considered a serious
problem, and a reason to call up the postmaster on another side and
inform them to fix their system.
> I realize that old versions of sendmail sent those annoying "your message has been delayed, retrying"
> reports but I hope we all realize those are a mistake, at least for any mail system in this millenium.
Yeah. Since then, Internet has over-commercialized, spammers emerged,
faked from fields become the norm, SpamAssasin came into existence,
backscatter spam made useful features annoying, etc.
Today, if the e-mail you're sending is important, you'll follow it up
with IM or voice call to verify if it has reached the recipient.
Nobody today _expects_ that every e-mail will get delivered at all
(or that anyone would notified on failure to deliver), much less that
it would happen in reasonable time. Which is a shame.
DSN's were an elegant solution... for a more civilized age.
https://xkcd.com/297/
--
Opinions above are GNU-copylefted.
Re: More Sendgrid trouble?
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>> >> Yeah, at this point, if I get anything from Outlook, Yahoo, Google,
>> >> Mailchimp, Mailgun, OVH, or Sendgrid and it’s not a explicitly a
>> >> whitelisted entry, I bounce it.
>> >
>> >I used a greylist where emails get a 4xx message with a link that
>> allows the email through ...
>>
>> Why would a mail system tell senders about a 4xx reply? That means to
>> try again, not to bounce it.
>>
>> I realize that old versions of sendmail sent those annoying "your
>> message has been delayed, retrying"
On 09.05.25 12:22, Marc wrote:
>Sendmail as opposed to the "it is to difficult for me to configure sendmail so I use other" smtp servers?
just a note - sendmail did not do this after single 4xx message but after
configured time, I think the default was 4 hours.
in postfix this is by default off.
>> reports but I hope we all realize those are a mistake, at least for any
>> mail system in this millenium.
>>
>
>Yes makes sense, don't read what is in a dsn. What idiot ever designed such architecture.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
10 GOTO 10 : REM (C) Bill Gates 1998, All Rights Reserved!
RE: More Sendgrid trouble?
Posted by Marc <Ma...@f1-outsourcing.eu>.
> >> Yeah, at this point, if I get anything from Outlook, Yahoo, Google,
> >> Mailchimp, Mailgun, OVH, or Sendgrid and it’s not a explicitly a
> >> whitelisted entry, I bounce it.
> >
> >I used a greylist where emails get a 4xx message with a link that
> allows the email through ...
>
> Why would a mail system tell senders about a 4xx reply? That means to
> try again, not to bounce it.
>
> I realize that old versions of sendmail sent those annoying "your
> message has been delayed, retrying"
Sendmail as opposed to the "it is to difficult for me to configure sendmail so I use other" smtp servers?
> reports but I hope we all realize those are a mistake, at least for any
> mail system in this millenium.
>
Yes makes sense, don't read what is in a dsn. What idiot ever designed such architecture.
Re: More Sendgrid trouble?
Posted by John Levine <jo...@taugh.com>.
It appears that Marc <Ma...@f1-outsourcing.eu> said:
>> Yeah, at this point, if I get anything from Outlook, Yahoo, Google,
>> Mailchimp, Mailgun, OVH, or Sendgrid and it’s not a explicitly a
>> whitelisted entry, I bounce it.
>
>I used a greylist where emails get a 4xx message with a link that allows the email through ...
Why would a mail system tell senders about a 4xx reply? That means to try again, not to bounce it.
I realize that old versions of sendmail sent those annoying "your message has been delayed, retrying"
reports but I hope we all realize those are a mistake, at least for any mail system in this millenium.
R's,
John
RE: More Sendgrid trouble?
Posted by Marc <Ma...@f1-outsourcing.eu>.
>
>
>
> > On Sep 29, 2022, at 11:26 AM, Greg Troxel <gd...@lexort.com> wrote:
> >
> >
> > Kris Deugau <kd...@vianet.ca> writes:
> >
> >> The Bayes result is not great, but the USER_IN_DEF_*_WL hits between
> >> them account for most of that negative score anyway.
> >
> > With dkim-signed spam, I think the only two paths forward are:
> > - hope they fix their apparently compromised system
> > - take them out the default WL (locally now, and via a rule update in
> > a few weeks)
> >
>
>
> Yeah, at this point, if I get anything from Outlook, Yahoo, Google,
> Mailchimp, Mailgun, OVH, or Sendgrid and it’s not a explicitly a
> whitelisted entry, I bounce it.
I used a greylist where emails get a 4xx message with a link that allows the email through so 'regular' users can get past it. Problem is, these fucked up networks are not even notifying users about 5xx and 4xx notifications.
Re: More Sendgrid trouble?
Posted by Philip Prindeville via users <us...@spamassassin.apache.org>.
> On Sep 29, 2022, at 11:26 AM, Greg Troxel <gd...@lexort.com> wrote:
>
>
> Kris Deugau <kd...@vianet.ca> writes:
>
>> The Bayes result is not great, but the USER_IN_DEF_*_WL hits between
>> them account for most of that negative score anyway.
>
> With dkim-signed spam, I think the only two paths forward are:
> - hope they fix their apparently compromised system
> - take them out the default WL (locally now, and via a rule update in
> a few weeks)
>
Yeah, at this point, if I get anything from Outlook, Yahoo, Google, Mailchimp, Mailgun, OVH, or Sendgrid and it’s not a explicitly a whitelisted entry, I bounce it.
Re: More Sendgrid trouble?
Posted by Greg Troxel <gd...@lexort.com>.
Kris Deugau <kd...@vianet.ca> writes:
> The Bayes result is not great, but the USER_IN_DEF_*_WL hits between
> them account for most of that negative score anyway.
With dkim-signed spam, I think the only two paths forward are:
- hope they fix their apparently compromised system
- take them out the default WL (locally now, and via a rule update in
a few weeks)
Re: More Sendgrid trouble?
Posted by Kris Deugau <kd...@vianet.ca>.
(Please keep followups onlist)
Greg Troxel wrote:
>
> Kris Deugau <kd...@vianet.ca> writes:
>
>> Is anyone else seeing intermittent FNs on mail sent through Sendgrid
>> where the nominal sender has a default welcomelist_* entry?
>>
>> Today's spample is a Mcafee scam email, pretty clearly sent through
>> Intuit's Sendgrid account based on the rDNS. On testing in my sandbox
>> it was only allowed through due to the stock welcomelist entry for
>> Intuit.
>>
>> Not 100% sure whether this is a Sendgrid issue, or an Intuit issue -
>> I've reported the message to both of them, for whatever good it will do.
>
> very interesting. was this DKIM signed?
Yes:
Return-Path:
<bo...@e.notification.intuit.com>
Received: from o4.e.notification.intuit.com (o4.e.notification.intuit.com
[167.89.82.160]) by mx1.vianet.ca (Postfix) with ESMTPS id E4302E2772 for
<so...@vianet.ca>; Wed, 28 Sep 2022 14:24:06 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=notification.intuit.com;
h=content-type:from:mime-version:subject:reply-to:to:cc; s=s1;
bh=cem614y7LjhCakVm2PClbzzDPtLgkUnWZufjB4BFAXo=;
b=BTa5rYwH+gyMfdKhDMQ15X9iFaAdLBFhAiRCJwzxBvx42ZmbqQCbfC30ql1u51jxZKiT
iUpIb/ARRtec87L/7Nz48dT74BcDdyAN/mPL7swD+9XPcY0guTmM5ZavQrJ7AH/prFYObp
4qJkZw9vDxi5Yjr8NFs3uHLyT7cJvim6WYLLGOU06/9Ua24RnakigWgAMiUp0xvsQEK4FJ
mtMP+z/XF1q2gBY0iR7YGbMuUqoiv8b5tEdUdb8GjGV1Vz2qUA9z38wlUHDPpibwRbQC7l
nIQNREZFjtewsE9oWo9aMeZUApLDsgA7YUlLAgllMoMmZyLBnq+6/kgxS6Hns4fQ==
Received: by filterdrecv-5df9649458-lk4n8 with SMTP id
filterdrecv-5df9649458-lk4n8-1-63349146-3 2022-09-28
18:24:06.106760561 +0000
UTC m=+74162.886769780
Received: from Mjg3ODI0ODM (unknown) by geopod-ismtpd-2-0 (SG) with HTTP id
JJelQZe8RUWAZNkCxHBvWQ Wed, 28 Sep 2022 18:24:05.991 +0000 (UTC)
spamd/main[22469]: spamd: result: . -18.593 -
BAYES_00,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,EXCESSIVE_BASE64_TEXT,HTML_MESSAGE,RCVD_IN_BL_SPAMCOP_NET,SPF_HELO_NONE,SPF_PASS,T_REMOTE_IMAGE,USER_IN_DEF_DKIM_WL,USER_IN_DEF_SPF_WL
(I've patched spamd to show more numeric precision in several fields for
easier log analysis.)
The Bayes result is not great, but the USER_IN_DEF_*_WL hits between
them account for most of that negative score anyway.
-kgd
Re: More Sendgrid trouble?
Posted by Greg Troxel <gd...@lexort.com>.
Kris Deugau <kd...@vianet.ca> writes:
> Is anyone else seeing intermittent FNs on mail sent through Sendgrid
> where the nominal sender has a default welcomelist_* entry?
>
> Today's spample is a Mcafee scam email, pretty clearly sent through
> Intuit's Sendgrid account based on the rDNS. On testing in my sandbox
> it was only allowed through due to the stock welcomelist entry for
> Intuit.
>
> Not 100% sure whether this is a Sendgrid issue, or an Intuit issue -
> I've reported the message to both of them, for whatever good it will do.
very interesting. was this DKIM signed?