You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Robert Menschel <Ro...@Menschel.net> on 2004/06/03 15:42:02 UTC
Re: Marking unwanted bounces as spam
Hello Nick,
--lint is your friend. Use
> spamassassin --lint
to see problems in your rules syntax.
Thursday, June 3, 2004, 5:52:46 AM, you wrote:
NG> A couple of people on this list have suggested rules such as the
NG> following, but they don't seem to match any incoming messages. Can
NG> anyone see why these rules don't work? (I've attached a zip of some
NG> sample bounces messages I've received).
NG> body __NICK_FAKE_BOUNCE_SUB1 /From\:\s.{0,30}\s*<nick\@nickgilbert\.com>/i
"From" is not part of the body. This will only match if the bounce you're
checking has text matching this pattern.
NG> header __NICK_BOUNCE_FROM From /postmaster\@.*/i
The proper syntax for this would be
> header __NICK_BOUNCE_FROM From =~ /postmaster\@/i
^^
Bob Menschel
Re[2]: Marking unwanted bounces as spam
Posted by Robert Menschel <Ro...@Menschel.net>.
Hello Nick,
Thursday, June 3, 2004, 10:56:29 AM, you wrote:
NG> OK - I've fixed the rules file (attached) and it now correctly scores
NG> all messages which are being generated by spammers/virues using my
NG> domain name to send from as spam, whilst sending me legitimate bounce
NG> messages.
NG> BUT the scoring looks a little weird:
NG> ...
NG> * -10.0 AWL AWL: Auto-whitelist adjustment
NG> What's the -10 AWL score? I don't remember ever having whitelisted
NG> anyone so what causes this very large negative score against this
NG> message?
Check the AWL page on the Wiki. It's an automatic adjustment (positive
or negative) based on the apparent sender's spam/ham record. If
you@yourdom.ain has a history of sending ham, then other emails coming
from that (sometimes forged) address will get a negative adjustment. If
garbage@anydom.ain has a history of sending spam, then other emails
coming from that address will get a positive adjustment.
Bob Menschel
Re: Marking unwanted bounces as spam
Posted by Nick Gilbert <ni...@nickgilbert.com>.
OK - I've fixed the rules file (attached) and it now correctly scores
all messages which are being generated by spammers/virues using my
domain name to send from as spam, whilst sending me legitimate bounce
messages.
BUT the scoring looks a little weird:
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11)
X-Spam-Report:
* 2.7 STRONG_BUY BODY: Tells you about a strong buy
* -4.9 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
* [score: 0.0000]
* 20 NICK_SPOOF_BOUNCE "Bounce from spoofed address"
* -10.0 AWL AWL: Auto-whitelist adjustment
X-Spam-Status: Yes, hits=7.8 required=5.0 tests=AWL,BAYES_00,
NICK_SPOOF_BOUNCE,STRONG_BUY autolearn=no version=2.63
X-Spam-Level: *******
What's the -10 AWL score? I don't remember ever having whitelisted
anyone so what causes this very large negative score against this message?
Nick...
Re: Marking unwanted bounces as spam
Posted by Nick Gilbert <ni...@nickgilbert.com>.
I've modified my rule and made sure it lints (attached as nick.cf) but
it still doesn't match messages like the one below! Can anyone see why?
Nick....
---
From - Thu Jun 03 16:12:21 2004
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <>
Delivered-To: nick-ngcom-dfdfdfdf@nickgilbert.com
Received: (qmail 28507 invoked for bounce); 3 Jun 2004 15:11:06 -0000
Date: 3 Jun 2004 15:11:06 -0000
From: MAILER-DAEMON@red.x-rm.com
To: dfdfdfdf@nickgilbert.com
Subject: failure notice
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on red.x-rm.com
X-Spam-Status: No, hits=-4.7 required=5.0 tests=BAYES_00,NO_REAL_NAME
autolearn=no version=2.63
X-Spam-Level:
Hi. This is the qmail-send program at red.x-rm.com.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.
<lk...@x-rm.com>:
195.166.37.20 does not like recipient.
Remote host said: 550 <lk...@x-rm.com>, Recipient unknown
Giving up on 195.166.37.20.
--- Below this line is a copy of the message.
Return-Path: <df...@nickgilbert.com>
Received: (qmail 28505 invoked from network); 3 Jun 2004 15:11:05 -0000
Received: from neon.staging.x-rm.com (HELO ?127.0.0.1?) (195.166.37.20)
by 0 with SMTP; 3 Jun 2004 15:11:05 -0000
Message-ID: <40...@nickgilbert.com>
Date: Thu, 03 Jun 2004 16:11:58 +0100
From: Nick Gilbert <df...@nickgilbert.com>
User-Agent: Mozilla Thunderbird 0.6+ (Windows/20040527)
X-Accept-Language: en
MIME-Version: 1.0
To: lkjlkjlkj@x-rm.com
Subject: test
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
test