You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Luis Daniel Lucio Quiroz <lu...@gmail.com> on 2009/11/13 02:53:26 UTC
Relation bettwen MAIL FROM: <> and From:
Hi All,
I'm wondering if some know is this is possible to stop using SA. Look.
[root@cyrus postfix]# telnet localhost 25
Trying 127.0.0.1...
Connected to cyrus.sat.gob.mx (127.0.0.1).
Escape character is '^]'.
220 mx2.sat.gob.mx ESMTP Postfix
EHLO brandmauer.insys-corp.com.mx
250-mx2.sat.gob.mx
250-PIPELINING
250-SIZE 10240000
250-ETRN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
MAIL FROM: <ra...@insys-corp.com.mx>
250 2.1.0 Ok
RCPT TO: <sa...@sat.gob.mx>
250 2.1.5 Ok
DATA
354 End data with <CR><LF>.<CR><LF>
From: Samuel Flores <sa...@sat.gob.mx>
To: SAS <sa...@sat.gob.mx>
Date: Thu, 12 Nov 2009 18:40:06 -0600
MIME-Version: 1.0
Content-Type: Text/Plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
Message-Id: <20...@sat.gob.mx>
Status: RO
X-Status: RS
X-KMail-EncryptionState:
X-KMail-SignatureState:
X-KMail-MDN-Sent:
Subject: t2
Mensaje
.
250 2.0.0 Ok: queued as CA5426B837
QUIT
221 2.0.0 Bye
Connection closed by foreign host.
As you see, MAIL FROM (SMTP protocol) and From (DATA) are different, and
Amavis+SA+Postfix is acceptiont this. Is this a SA task or Amavis or Postfix,
Here are my logs:
--------------
Nov 12 19:31:51 cyrus postfix/smtpd[7412]: CA5426B837:
client=cyrus.sat.gob.mx[127.0.0.1]
Nov 12 19:34:02 cyrus postfix/cleanup[8795]: CA5426B837: message-
id=<20...@sat.gob.mx>
Nov 12 19:34:02 cyrus postfix/qmgr[1488]: CA5426B837: from=<raulr@insys-
corp.com.mx>, size=582, nrcpt=1 (queue active)
Nov 12 19:34:03 cyrus postfix/lmtp[8896]: CA5426B837: to=<sa...@sat.gob.mx>,
relay=127.0.0.1[127.0.0.1]:10025, delay=161, delays=160/0.03/0/0.4, dsn=2.0.0,
status=sent (250 2.0.0 Ok: queued as 583096B9A1)
Nov 12 19:34:03 cyrus postfix/qmgr[1488]: CA5426B837: removed
[root@cyrus postfix]# grep 583096B9A1 /var/log/mail/info.log
Nov 12 19:34:03 cyrus postfix/smtpd[8853]: 583096B9A1:
client=cyrus.sat.gob.mx[127.0.0.1]:unknown
Nov 12 19:34:03 cyrus postfix/cleanup[8796]: 583096B9A1: message-
id=<20...@sat.gob.mx>
Nov 12 19:34:03 cyrus postfix/qmgr[1488]: 583096B9A1: from=<raulr@insys-
corp.com.mx>, size=1163, nrcpt=1 (queue active)
Nov 12 19:34:03 cyrus amavis[6486]: (06486-11) Passed CLEAN, MYNETS LOCAL
[127.0.0.1] [127.0.0.1] <ra...@insys-corp.com.mx> -> <sa...@sat.gob.mx>,
Message-ID: <20...@sat.gob.mx>, mail_id: h2ruWAjex7lV, Hits:
-2.394, size: 582, queued_as: 583096B9A1, 400 ms
Nov 12 19:34:03 cyrus postfix/lmtp[8896]: CA5426B837: to=<sa...@sat.gob.mx>,
relay=127.0.0.1[127.0.0.1]:10025, delay=161, delays=160/0.03/0/0.4, dsn=2.0.0,
status=sent (250 2.0.0 Ok: queued as 583096B9A1)
Nov 12 19:34:03 cyrus postfix/smtp[8302]: 583096B9A1: to=<sa...@sat.gob.mx>,
relay=10.10.60.10[10.10.60.10]:25, delay=0.07, delays=0.01/0.04/0.01/0.01,
dsn=2.0.0, status=sent (250 OK: <07...@sat.gob.mx>)
Nov 12 19:34:03 cyrus postfix/qmgr[1488]: 583096B9A1: removed
Best Regards,
LD
Re: Relation bettwen MAIL FROM: <> and From:
Posted by Luis Daniel Lucio Quiroz <lu...@gmail.com>.
Le jeudi 12 novembre 2009 20:28:51, David B Funk a écrit :
> If you search the archives of this list you will find a long-winded
> discussion of this idea and an explanation of why it is a bad idea.
>
> To make a long story short, you will block lots of legitimate mail
> including almost every mail-list type message.
> For example, check the Header-From and Envelope-From addresses of
> any message that you get from this list.
>
> A similar argument applies to the Header-To and Envelope-recipient
> addresses.
>
> The SMTP protocol provided for seperate header VS envelope addresses
> with good reason, trying to block that feature only leads to trouble.
>
> On Thu, 12 Nov 2009, Luis Daniel Lucio Quiroz wrote:
> > Hi All,
> >
> > I'm wondering if some know is this is possible to stop using SA. Look.
> >
> > [root@cyrus postfix]# telnet localhost 25
> > Trying 127.0.0.1...
> > Connected to cyrus.sat.gob.mx (127.0.0.1).
> > Escape character is '^]'.
> > 220 mx2.sat.gob.mx ESMTP Postfix
> > EHLO brandmauer.insys-corp.com.mx
> > 250-mx2.sat.gob.mx
> > 250-PIPELINING
> > 250-SIZE 10240000
> > 250-ETRN
> > 250-ENHANCEDSTATUSCODES
> > 250-8BITMIME
> > 250 DSN
> > MAIL FROM: <ra...@insys-corp.com.mx>
> > 250 2.1.0 Ok
> > RCPT TO: <sa...@sat.gob.mx>
> > 250 2.1.5 Ok
> > DATA
> > 354 End data with <CR><LF>.<CR><LF>
> > From: Samuel Flores <sa...@sat.gob.mx>
>
> [snip..]
>
> > As you see, MAIL FROM (SMTP protocol) and From (DATA) are different, and
> > Amavis+SA+Postfix is acceptiont this. Is this a SA task or Amavis or
> > Postfix,
>
> [snip..]
>
Many many thanx
Re: Relation bettwen MAIL FROM: <> and From:
Posted by David B Funk <db...@engineering.uiowa.edu>.
If you search the archives of this list you will find a long-winded
discussion of this idea and an explanation of why it is a bad idea.
To make a long story short, you will block lots of legitimate mail
including almost every mail-list type message.
For example, check the Header-From and Envelope-From addresses of
any message that you get from this list.
A similar argument applies to the Header-To and Envelope-recipient
addresses.
The SMTP protocol provided for seperate header VS envelope addresses
with good reason, trying to block that feature only leads to trouble.
On Thu, 12 Nov 2009, Luis Daniel Lucio Quiroz wrote:
> Hi All,
>
> I'm wondering if some know is this is possible to stop using SA. Look.
>
> [root@cyrus postfix]# telnet localhost 25
> Trying 127.0.0.1...
> Connected to cyrus.sat.gob.mx (127.0.0.1).
> Escape character is '^]'.
> 220 mx2.sat.gob.mx ESMTP Postfix
> EHLO brandmauer.insys-corp.com.mx
> 250-mx2.sat.gob.mx
> 250-PIPELINING
> 250-SIZE 10240000
> 250-ETRN
> 250-ENHANCEDSTATUSCODES
> 250-8BITMIME
> 250 DSN
> MAIL FROM: <ra...@insys-corp.com.mx>
> 250 2.1.0 Ok
> RCPT TO: <sa...@sat.gob.mx>
> 250 2.1.5 Ok
> DATA
> 354 End data with <CR><LF>.<CR><LF>
> From: Samuel Flores <sa...@sat.gob.mx>
[snip..]
>
> As you see, MAIL FROM (SMTP protocol) and From (DATA) are different, and
> Amavis+SA+Postfix is acceptiont this. Is this a SA task or Amavis or Postfix,
>
[snip..]
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: Relation bettwen MAIL FROM: <> and From:
Posted by Matt Kettler <mk...@verizon.net>.
Luis Daniel Lucio Quiroz wrote:
>
> Hi All,
>
> I'm wondering if some know is this is possible to stop using SA. Look.
>
MAIL FROM and From: are commonly mismatched in legitimate mail.
For example, every message that you receive from this list (and every
other sanely configured mailing list) will have an apache.org address in
the MAIL FROM, and the sender in the From:. That's because apache is
remailing, and should receive all DSN's, but they are not the originator
of the message.
There's quite a few other scenarios where mismatches occur outside of
spam. Perhaps you should look more closely at your nonspam email.