You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Mark Christoph <md...@gmail.com> on 2004/10/29 19:26:17 UTC
false positives from HELO_DYNAMIC_HCC and HELO_DYNAMIC_IPADDR rules
We are running SA 3.0.1 site wide at my company and I had some false
positives due to HELO_DYNAMIC_HCC and HELO_DYNAMIC_IPADDR. They are
probably useful rules, but I am surprised that their default scores
are so high. Here are the headers of the message and the scores it
got:
Received: from a80-127-206-219.adsl.xs4all.nl (a80-127-206-219.adsl.xs4all.nl [8
0.127.206.219])
by lassen.graebel.com (Postfix) with SMTP id A95FA120CB5
for <kb...@graebel.com>; Fri, 29 Oct 2004 05:40:10 -0600 (MDT)
Received: from gwsevil-Message_Server by a80-127-206-219.adsl.xs4all.nl
with Novell_GroupWise; Fri, 29 Oct 2004 13:40:10 +0200
Message-Id: <s1...@a80-127-206-219.adsl.xs4all.nl>
X-Mailer: Novell GroupWise 5.5.5
Date: Fri, 29 Oct 2004 13:39:53 +0200
From: "Sender" <se...@othercompany.com>
To: <us...@company.com>
Subject: Betr.: Re: Mr. ABC
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
I changed the from and to addresses, but left the other headers alone.
Here are the scores:
Content analysis details: (-98.8 points, 6.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.5 HELO_DYNAMIC_HCC Relay HELO'd using suspicious hostname (HCC)
0.5 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr 1)
-100 USER_IN_WHITELIST From: address is in the user's white-list
1.0 MY_GAPPY_BODY BODY: MY: contains G.a.p.p.y-T.e.x.t
1.8 URG_BIZ BODY: Contains urgent matter
-2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
[score: 0.0000]
As a result, I lowered the scores for HELO_DYNAMIC_HCC and HELO_DYNAMIC_IPADDR.
I also forced bayes to relearn the email as ham, etc. The other
problem is that the sender of the message informed me that it is not a
dynamically assigned address. It is an ADSL connection from the
Netherlands with a fixed IP address.
Mark
Re: false positives from HELO_DYNAMIC_HCC and HELO_DYNAMIC_IPADDR
rules
Posted by Raymond Dijkxhoorn <ra...@prolocation.net>.
Hi!
> Here are the scores:
> Content analysis details: (-98.8 points, 6.0 required)
>
> pts rule name description
> ---- ---------------------- --------------------------------------------------
> 0.5 HELO_DYNAMIC_HCC Relay HELO'd using suspicious hostname (HCC)
> 0.5 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr 1)
> -100 USER_IN_WHITELIST From: address is in the user's white-list
> 1.0 MY_GAPPY_BODY BODY: MY: contains G.a.p.p.y-T.e.x.t
> 1.8 URG_BIZ BODY: Contains urgent matter
> -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> [score: 0.0000]
>
> As a result, I lowered the scores for HELO_DYNAMIC_HCC and HELO_DYNAMIC_IPADDR.
> I also forced bayes to relearn the email as ham, etc. The other
> problem is that the sender of the message informed me that it is not a
> dynamically assigned address. It is an ADSL connection from the
> Netherlands with a fixed IP address.
If he runs a consumer link, sure, thats the things he pays for. He might
be better of with other services xs4all runs. Then he can change reverse
for his line and everybody is happy. Another solution for him is to relay
his mail on his ISPs mailservers.
Bye,
Raymond.
Re: false positives from HELO_DYNAMIC_HCC and
HELO_DYNAMIC_IPADDR rules
Posted by Matt Kettler <mk...@evi-inc.com>.
At 01:26 PM 10/29/2004, Mark Christoph wrote:
>As a result, I lowered the scores for HELO_DYNAMIC_HCC and
>HELO_DYNAMIC_IPADDR.
>I also forced bayes to relearn the email as ham, etc. The other
>problem is that the sender of the message informed me that it is not a
>dynamically assigned address. It is an ADSL connection from the
>Netherlands with a fixed IP address.
Well, the HELO_DYNAMIC_HCC is just picking up on the RDNS name containing
"adsl", nothing more.
The HELO_DYNAMIC_IPADDR is picking up on the fact that the RDNS hostname is
just
If the IP is a truly fixed, and truly intended for having a mailserver
running on it by the ISP, the ISP should be able to provide custom RDNS
mappings. I'd suggest that user request a mapping which matches the MX
entries for that server, or at least the same domain.
RE: false positives from HELO_DYNAMIC_HCC and HELO_DYNAMIC_IPADDR rules
Posted by marti <ma...@ntlworld.com>.
-----Original Message-----
From: Mark Christoph [mailto:mdchristoph@gmail.com]
Sent: 29 October 2004 18:26
To: users@spamassassin.apache.org
Subject: false positives from HELO_DYNAMIC_HCC and HELO_DYNAMIC_IPADDR rules
We are running SA 3.0.1 site wide at my company and I had some false
positives due to HELO_DYNAMIC_HCC and HELO_DYNAMIC_IPADDR. They are
probably useful rules, but I am surprised that their default scores are so
high. Here are the headers of the message and the scores it
got:
<SNIP>
Content analysis details: (-98.8 points, 6.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
0.5 HELO_DYNAMIC_HCC Relay HELO'd using suspicious hostname (HCC)
0.5 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr
1)
-100 USER_IN_WHITELIST From: address is in the user's white-list
1.0 MY_GAPPY_BODY BODY: MY: contains G.a.p.p.y-T.e.x.t
1.8 URG_BIZ BODY: Contains urgent matter
-2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
[score: 0.0000]
As a result, I lowered the scores for HELO_DYNAMIC_HCC and
HELO_DYNAMIC_IPADDR.
I also forced bayes to relearn the email as ham, etc. The other problem is
that the sender of the message informed me that it is not a dynamically
assigned address. It is an ADSL connection from the Netherlands with a
fixed IP address.
Mark
--------------------------------
There was no need to relearn it to bayes, it already said it was ham with
-2.6 points, so even with the 1 point for dynamic hello its still ham.
Your friend could configure his mailserver better by giving it a static
names using something like dyndns.org and then it wouldn't hit that rule,
the fact his is static isnt what the rule really looks for, which is dynamic
style hostname.
Martin