You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by cyflhn <ch...@made-in-china.com> on 2019/05/14 09:44:22 UTC
SpamAssassin Scoring For MDAEMON_DNSBL
It has happened many times that the emails from our server were identified as
spam. I have checked the emails which were not identified as spam. But I
found that the SpamAssassin Scoring For MDAEMON_DNSBL is quite high, the
score of MDAEMON_DNSBL is always 4. I also checked the logs of SpamAssassin
and here are some messages:
Performing DNS-BL lookup
* zen.spamhaus.org - passed
* bl.spamcop.net - passed
* bad.psky.me - failed - 198.54.117.200
* 1.6 BAYES_50 BODY: Bayes spam probability is 40 to 60%
* [score: 0.5000]
* 4.0 MDAEMON_DNSBL MDaemon: marked by MDaemon\'s DNSBL
* 2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
The email sender has set up SPF record. I still don't know what's reason for
such a high score for MDAEMON_DNSBL and why FREEMAIL_FORGED_REPLYTO got
2.1 score?
--
Sent from: http://spamassassin.1065346.n5.nabble.com/SpamAssassin-Users-f3.html
Re: SpamAssassin Scoring For MDAEMON_DNSBL
Posted by nektarios <ne...@mail.nektarioskatakis.xyz>.
On Tue, 14 May 2019 05:49:24 -0700 (MST)
cyflhn <ch...@made-in-china.com> wrote:
> Thank you for your reply. But are you sure that it was caused by
> bad.psky.me? I could not find any useful information about
> bad.psky.me. It seems that it has been already shutdown.
>
>
>
> --
> Sent from:
> http://spamassassin.1065346.n5.nabble.com/SpamAssassin-Users-f3.html
Actually if you cannot remove your server from bad.psky.me service then
you need to actually contact the server that blocked to inform them
about the unreliable BL. No way round it.
Re: SpamAssassin Scoring For MDAEMON_DNSBL
Posted by cyflhn <ch...@made-in-china.com>.
Thank you for your reply. But are you sure that it was caused by bad.psky.me?
I could not find any useful information about bad.psky.me. It seems that it
has been already shutdown.
--
Sent from: http://spamassassin.1065346.n5.nabble.com/SpamAssassin-Users-f3.html
Re: SpamAssassin Scoring For MDAEMON_DNSBL
Posted by RW <rw...@googlemail.com>.
On Tue, 14 May 2019 10:18:35 -0400
Kris Deugau wrote:
> Matus UHLAR - fantomas wrote:
> > On 14.05.19 06:18, cyflhn wrote:
> >> but what about this one "FREEMAIL_FORGED_REPLYTO". why it got 2.1
> As for the score, it's autogenerated based on statistical analysis of
> a large corpus of mail along with most of the other stock rules:
> https://wiki.apache.org/spamassassin/NightlyMassCheck
My understanding is that scores in 50_scores.cf haven't been optimized
for 10 years since the very fast perceptron fell-off and they had to
revert to the extremely slow genetic algorithm. The autogenerated
scores for a minority of the rules are in 72_scores.
This isn't entirely accurate because some rules are scored in both
files, but it gives a rough indication of the scale of problem.
$ grep -E '^\s*score' 50_scores.cf| wc -l
662
$ grep -E '^\s*score' 72_scores.cf| wc -l
210
Re: SpamAssassin Scoring For MDAEMON_DNSBL
Posted by Kris Deugau <kd...@vianet.ca>.
Matus UHLAR - fantomas wrote:
> On 14.05.19 06:18, cyflhn wrote:
>> but what about this one "FREEMAIL_FORGED_REPLYTO". why it got 2.1 score?
>
> this is standard rule where mail predenting to come from one freemail
> service really comes from another freemail service.
Actually, unless I misread the rule, it's a message with a Reply-To
pointing to a freemail service, where the message did not come from that
specific service. The actual origin could be anything from another
freemail service to a small community ISP to a corporate groupware system.
As for the score, it's autogenerated based on statistical analysis of a
large corpus of mail along with most of the other stock rules:
https://wiki.apache.org/spamassassin/NightlyMassCheck
-kgd
Re: SpamAssassin Scoring For MDAEMON_DNSBL
Posted by RW <rw...@googlemail.com>.
On Tue, 14 May 2019 15:35:43 +0200
Matus UHLAR - fantomas wrote:
> On 14.05.19 06:18, cyflhn wrote:
> >but what about this one "FREEMAIL_FORGED_REPLYTO". why it got 2.1
> >score?
>
> this is standard rule where mail pretending to come from one freemail
> service really comes from another freemail service.
It's based on a freemail Reply-To with a *non*-freemail From address.
It's a common pattern seen in fraud spams where a disposable account is
used for receiving replies.
Re: SpamAssassin Scoring For MDAEMON_DNSBL
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 14.05.19 06:18, cyflhn wrote:
>but what about this one "FREEMAIL_FORGED_REPLYTO". why it got 2.1 score?
this is standard rule where mail predenting to come from one freemail
service really comes from another freemail service.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Silvester Stallone: Father of the RISC concept.
Re: SpamAssassin Scoring For MDAEMON_DNSBL
Posted by cyflhn <ch...@made-in-china.com>.
but what about this one "FREEMAIL_FORGED_REPLYTO". why it got 2.1 score?
--
Sent from: http://spamassassin.1065346.n5.nabble.com/SpamAssassin-Users-f3.html
Re: SpamAssassin Scoring For MDAEMON_DNSBL
Posted by Axb <ax...@gmail.com>.
MDAEMON_DNSBL is not a stock SA rule.
This is a custom rule added by Alt-N/MDAEMON which uses SA.
You will need to contact them for further help
On 5/14/19 11:44 AM, cyflhn wrote:
> It has happened many times that the emails from our server were identified as
> spam. I have checked the emails which were not identified as spam. But I
> found that the SpamAssassin Scoring For MDAEMON_DNSBL is quite high, the
> score of MDAEMON_DNSBL is always 4. I also checked the logs of SpamAssassin
> and here are some messages:
>
> Performing DNS-BL lookup
> * zen.spamhaus.org - passed
> * bl.spamcop.net - passed
> * bad.psky.me - failed - 198.54.117.200
>
> * 1.6 BAYES_50 BODY: Bayes spam probability is 40 to 60%
> * [score: 0.5000]
> * 4.0 MDAEMON_DNSBL MDaemon: marked by MDaemon\'s DNSBL
> * 2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
>
> The email sender has set up SPF record. I still don't know what's reason for
> such a high score for MDAEMON_DNSBL and why FREEMAIL_FORGED_REPLYTO got
> 2.1 score?
>
>
>
> --
> Sent from: http://spamassassin.1065346.n5.nabble.com/SpamAssassin-Users-f3.html
>
Re: SpamAssassin Scoring For MDAEMON_DNSBL
Posted by Dave Warren <dw...@thedave.ca>.
On 2019-05-14 09:17, John Hardin wrote:
> On Tue, 14 May 2019, cyflhn wrote:
>
>> It has happened many times that the emails from our server were
>> identified as
>> spam. I have checked the emails which were not identified as spam. But I
>> found that the SpamAssassin Scoring For MDAEMON_DNSBL is quite high, the
>> score of MDAEMON_DNSBL is always 4. I also checked the logs of
>> SpamAssassin
>> and here are some messages:
>
> Is this a local SA install, or some third party testing service? If the
> latter, who?
>
>> Performing DNS-BL lookup
>> * zen.spamhaus.org - passed
>> * bl.spamcop.net - passed
>> * bad.psky.me - failed - 198.54.117.200
>
> That doesn't appear to be SA related. Is that just informational related
> data?
>
>> * 1.6 BAYES_50 BODY: Bayes spam probability is 40 to 60%
>> * [score: 0.5000]
>> * 4.0 MDAEMON_DNSBL MDaemon: marked by MDaemon\'s DNSBL
>> * 2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
>
>> I still don't know what's reason for such a high score for MDAEMON_DNSBL
>
> That rule is not in the base SA ruleset so we can't help you analyze it.
> I suggest you contact MDaemon to see why you're listed.
I've been aware on a family matter, but I can provide a bit of context
about this particular rule. I previously worked with MDaemon (then Alt-N
Technologies) and although this was some years ago I'm still familiar
with the product and can help off-list if needed, feel free to reach out
on or off list as applicable.
The "Performing DNS-BL lookup" header (above) shows the DNS-BLs which
are configured in MDaemon and the results for each. bad.psky.me has not
(to my knowledge) ever been a default in MDaemon.
Normally you should only use DNS-BLs for outright blocking at this stage
(and let SpamAssassin's own DNS-BL functionality score) as this feature
provides pre-DATA message rejection, but if you choose to accept
messages that hit MDaemon's DNS-BL then you can pass points into
SpamAssassin via the MDAEMON_DNSBL rule.
There are a few reasons for this, but mainly it comes down to the fact
that MDaemon's DNS-BL implementation predated SpamAssassin being
supported by MDaemon, and in the initial implementation there were a
number of issues with SpamAssassin's implementation when running under
Windows. These issues are long since resolved, but there is no incentive
to remove the integration.
Removing the IP from bad.psky.me will cause the rule in SpamAssassin to
disappear. Since bad.psky.me seems to be in a "list the world" phase the
MDaemon administrator should completely remove this DNS-BL from the
MDaemon configuration.
There is nothing a sender can do, only the receiving MDaemon server's
administrator can make changes here.
Re: SpamAssassin Scoring For MDAEMON_DNSBL
Posted by John Hardin <jh...@impsec.org>.
On Tue, 14 May 2019, cyflhn wrote:
> It has happened many times that the emails from our server were identified as
> spam. I have checked the emails which were not identified as spam. But I
> found that the SpamAssassin Scoring For MDAEMON_DNSBL is quite high, the
> score of MDAEMON_DNSBL is always 4. I also checked the logs of SpamAssassin
> and here are some messages:
Is this a local SA install, or some third party testing service? If the
latter, who?
> Performing DNS-BL lookup
> * zen.spamhaus.org - passed
> * bl.spamcop.net - passed
> * bad.psky.me - failed - 198.54.117.200
That doesn't appear to be SA related. Is that just informational related
data?
> * 1.6 BAYES_50 BODY: Bayes spam probability is 40 to 60%
> * [score: 0.5000]
> * 4.0 MDAEMON_DNSBL MDaemon: marked by MDaemon\'s DNSBL
> * 2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
> I still don't know what's reason for such a high score for MDAEMON_DNSBL
That rule is not in the base SA ruleset so we can't help you analyze it. I
suggest you contact MDaemon to see why you're listed.
> and why FREEMAIL_FORGED_REPLYTO got 2.1 score?
The answer to that question for base SA rules is always: because it looks
like a fairly good spam sign based on the masscheck corpora.
If those are emails you are generating, then why are you using a freemail
address for the Reply-To: address them but not the From: address?
Providing the headers from such a message would make it easier for us to
provide a more substantive analysis.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Are you a mildly tech-literate politico horrified by the level of
ignorance demonstrated by lawmakers gearing up to regulate online
technology they don't even begin to grasp? Cool. Now you have a
tiny glimpse into a day in the life of a gun owner. -- Sean Davis
-----------------------------------------------------------------------
Today: the 71st anniversary of Israel's independence