Lotus Notes

[Ron McKeating <R....@lboro.ac.uk>]

Has anybody noticed a high proportion of false positives from clients
using lotus notes ?

Ron
-- 
Ron McKeating
Senior IT Services Specialist
Internet Services and Software Solutions
Loughborough University
01509 222329

Re: Lotus Notes

[Tom Meunier <to...@mvps.org>]

Max wrote:

> Hi
> This is a header of a mail sent via Lotus Notes and I noticed no false 
> positives from Lotus Notes
> I running Spamassassin 2.63 with some ruleset from SARE and Amavisd-new
> / Max
>
> X-Mailer: Lotus Notes Release 5.0.12   February 13, 2003
>
> X-Spam-Status: No, hits=-5.7 tagged_above=-50.0 required=6.5 tests=AWL,
>  BAYES_00, KD_MVH, NO_REAL_NAME
> X-Spam-Level:



That's Notes 5.x, plus I had someone send me one from Notes 6.x and it 
scored NO_REAL_NAME and BAYES_00 for -4.6 points.  It's not Notes.  My 
money is on accidental blacklist.

I think the original poster has a correspondent with a broken story.   
Raise the auto-delete threshold temporarily and view the headers.  
Taking wild stabs at possible solutions isn't going to help anyone.

-- 
-tom

Re: Lotus Notes

[Max <ma...@kringdata.se>]

Hi
This is a header of a mail sent via Lotus Notes and I noticed no false positives from Lotus Notes
I running Spamassassin 2.63 with some ruleset from SARE and Amavisd-new
/ Max

X-Mailer: Lotus Notes Release 5.0.12   February 13, 2003
Message-ID: <OF...@xxxx.xxx>
From: xxxx.xxxxx@xxxx.xxx
Date: Fri, 10 Sep 2004 13:44:08 +0200
X-MIMETrack: Serialize by Router on XXX02/XXXXX/XX(Release 5.0.12  |February 13, 2003) at
  2004-09-10 13:44:10
MIME-Version: 1.0
Content-type: text/plain; charset=iso-8859-1
Content-transfer-encoding: quoted-printable
X-Virus-Scanned: by Cleanmail at kringdata.net
X-Spam-Status: No, hits=-5.7 tagged_above=-50.0 required=6.5 tests=AWL,
  BAYES_00, KD_MVH, NO_REAL_NAME
X-Spam-Level:

> On Tue, 2004-09-14 at 13:02, Kevin Peuhkurinen wrote:
> 
>>Would you care to share an example with SA headers?
>>
>>
> 
> Sadly not possible as these emails are getting rejected, we reject
> anything with a spam score over 10. So no I don't have the headers, but
> they are all happening to the same organisation and they are all lotus
> notes users.
> 
> Ron
> 
>>Ron McKeating wrote:
>>
>>
>>>Has anybody noticed a high proportion of false positives from clients
>>>using lotus notes ?
>>>
>>>Ron
>>> 
>>>

Re: Lotus Notes

[Matt Kettler <mk...@evi-inc.com>]

At 09:45 AM 9/14/2004, Ron McKeating wrote:
>Sadly not possible as these emails are getting rejected, we reject
>anything with a spam score over 10. So no I don't have the headers, but
>they are all happening to the same organisation and they are all lotus
>notes users.

When your MTA rejects the email, does it by any chance log the hits in the 
maillog?

Is there any way to make your integration tool do this?

If not, why are you still using the tool? :)
(slight humor intended here, but really, a decent tool should be able to 
detail in the log why it rejected an email. Otherwise you run into problems 
like this one where you have no real idea why email is being rejected.)

If you can't make your tool log, can you add a whitelist_from on a 
temporary basis and then get the hits from the message headers of a message 
that got through? (basically if you ignore the USER_IN_WHITELIST, you can 
look at the other rules to figure out why it's scoring so high and figure 
out what to do to correct it).

 From the looks of the emails I have it is probably something non-lotus 
related, as I've got a large number of messages from lotus notes users, and 
the worst rule that seems to be hitting on them is NO_REAL_NAME.

Any chance that organization's mailserver is listed in some RBLs you use?

Do you use Razor 2.61 or Surbl? if so, do they have a footer with a 
web-link which might be listed? (Razor 2.61's e8 is url oriented like SURBL is)

Do you use any add on rulesets? (if you use sa-blacklist.cf double check to 
make sure they aren't in it!)

Re: Lotus Notes

[Kevin Peuhkurinen <ke...@hepcoe.com>]

Well, a search through my most recent 20,000 spam emails shows only 4 
with "X-Mailer: Lotus Notes", all of which are definately spam.  I'm 
using 2.64 with Razor, DCC, SURBL and:

70_sare_adult.cf
70_sare_bayes_poison_nxm.cf
70_sare_html0.cf
70_sare_random.cf
99_sare_adult.cf
99_sare_spoof.cf
Obfu1.cf
antidrug.cf
header_abuse.cf
myrules.cf
ratware.cf
spamcop_uri.cf
virusbounce.cf

As they are all from the same company, you may want to 
WHITELIST_FROM_RCVD them.

Kevin



Ron McKeating wrote:

>On Tue, 2004-09-14 at 13:02, Kevin Peuhkurinen wrote:
>  
>
>>Would you care to share an example with SA headers?
>>
>>
>>    
>>
>Sadly not possible as these emails are getting rejected, we reject
>anything with a spam score over 10. So no I don't have the headers, but
>they are all happening to the same organisation and they are all lotus
>notes users.
>
>Ron
>  
>
>>Ron McKeating wrote:
>>
>>    
>>
>>>Has anybody noticed a high proportion of false positives from clients
>>>using lotus notes ?
>>>
>>>Ron
>>> 
>>>
>>>      
>>>

Re: Lotus Notes

[Ron McKeating <R....@lboro.ac.uk>]

On Tue, 2004-09-14 at 13:02, Kevin Peuhkurinen wrote:
> Would you care to share an example with SA headers?
> 
> 
Sadly not possible as these emails are getting rejected, we reject
anything with a spam score over 10. So no I don't have the headers, but
they are all happening to the same organisation and they are all lotus
notes users.

Ron
> Ron McKeating wrote:
> 
> >Has anybody noticed a high proportion of false positives from clients
> >using lotus notes ?
> >
> >Ron
> >  
> >
-- 
Ron McKeating
Senior IT Services Specialist
Internet Services and Software Solutions
Loughborough University
01509 222329

Re: Lotus Notes

[Kevin Peuhkurinen <ke...@hepcoe.com>]

Would you care to share an example with SA headers?


Ron McKeating wrote:

>Has anybody noticed a high proportion of false positives from clients
>using lotus notes ?
>
>Ron
>  
>