You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Kamen TOMOV <ka...@cybuild.com> on 2006/12/07 14:34:22 UTC
false positives
Hi,
I constantly have problems with spamcop these days. Could you tell me
what's wrong with my messages so that I can fix it?
Thanks,
--
Камен
Re: false positives
Posted by Kamen TOMOV <ka...@cybuild.com>.
On четвъртък, Декември 07 2006, Sietse van Zanen wrote:
> off-topic) spamcop =?windows-1251?B?4vrv8O7x6A==?=
>
> Was that really your subject, did you type that? I think the
> =?windows-1251?B?4vrv8O7x6A==?= is the double encoded part.
No, my subject was:
(off-topic) spamcop проблеми
> Your problem might be the result of some incompatibility between
> slavic - european character sets. But I'm not suchh an smtp
> expert. Other people probably can elaborate more on this.
Anybody?
> SPF is Sender Policy Framework. More information can be found here:
> http://www.openspf.org/ It validates that the mail servers sending
> are really mail servers responsible for the domain they send mail
> for. So SPF matches are a good thing.
Yeah, I have an idea, but what's wrong with my mail servers?
> More info on the AWL can be found here:
> http://wiki.apache.org/spamassassin/AutoWhitelist
Thanks.
>
> From: Kamen TOMOV
> Sent: Thu 07-Dec-06 18:00
> To: users@spamassassin.apache.org
> Subject: Re: false positives
>
>
> On четвъртък, Декември 07 2006, Sietse van Zanen wrote:
>
>> They contain too little information.
>
> All right - here is more information. I sent a message to a group and
> I got it classified as spam. Here is the report:
>
> * 1.7 SUBJECT_ENCODED_TWICE Subject: MIME encoded twice
>
> Here is how the subject looks like when I sent it:
>
> (off-topic) spamcop =?windows-1251?B?4vrv8O7x6A==?=
>
> It looks to me that it is not encoded twice. However, here is the
> subject of the message that was received in the list:
>
> [SPAM] =?windows-1251?q?=5BSPAM=5D_=28off-topic=29_spamcop_=E2?=
> =?windows-1251?b?+u/w7vHo?=
>
> .., which might have been encoded twice. So is that a problem of the
> mail-list?
>
> * -0.0 SPF_HELO_PASS SPF: HELO matches SPF record
> * 0.1 FORGED_RCVD_HELO Received: contains a forged HELO
>
> Can anybody tell me what does "HELO matches SPF record" mean?
>
> * -0.0 SPF_PASS SPF: sender matches SPF record
> * 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
> * [score: 0.4115]
> * 0.2 MIME_BASE64_NO_NAME RAW: base64 attachment does not have a file
> * name
>
> What attachments? I haven't attached anything to my message. It looks
> like spamassassin took the hole message as an attachment just because
> it is base64 - encoded.
>
> * 1.9 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding
>
> I don't understand why base64 encoded message is classified as
> disguised? My mail agent had just decided to encode the message in
> base64 encoding as it contains cp1251 characters so what's wrong with
> that?
>
> * 0.4 AWL AWL: From: address is in the auto white-list
>
> Can anybody tell me what does "From: address is in the auto
> white-list" mean? If it is in a white list why the coefficient is >0?
>
> --
> Камен
RE: false positives
Posted by Sietse van Zanen <si...@wizdom.nu>.
off-topic) spamcop =?windows-1251?B?4vrv8O7x6A==?=
Was that really your subject, did you type that? I think the =?windows-1251?B?4vrv8O7x6A==?= is the double encoded part.
Your problem might be the result of some incompatibility between slavic - european character sets. But I'm not suchh an smtp expert. Other people probably can elaborate more on this.
SPF is Sender Policy Framework. More information can be found here: http://www.openspf.org/
It validates that the mail servers sending are really mail servers responsible for the domain they send mail for. So SPF matches are a good thing.
More info on the AWL can be found here: http://wiki.apache.org/spamassassin/AutoWhitelist
-Sietse
From: Kamen TOMOV
Sent: Thu 07-Dec-06 18:00
To: users@spamassassin.apache.org
Subject: Re: false positives
On четвъртък, Декември 07 2006, Sietse van Zanen wrote:
> They contain too little information.
All right - here is more information. I sent a message to a group and
I got it classified as spam. Here is the report:
* 1.7 SUBJECT_ENCODED_TWICE Subject: MIME encoded twice
Here is how the subject looks like when I sent it:
(off-topic) spamcop =?windows-1251?B?4vrv8O7x6A==?=
It looks to me that it is not encoded twice. However, here is the
subject of the message that was received in the list:
[SPAM] =?windows-1251?q?=5BSPAM=5D_=28off-topic=29_spamcop_=E2?=
=?windows-1251?b?+u/w7vHo?=
.., which might have been encoded twice. So is that a problem of the
mail-list?
* -0.0 SPF_HELO_PASS SPF: HELO matches SPF record
* 0.1 FORGED_RCVD_HELO Received: contains a forged HELO
Can anybody tell me what does "HELO matches SPF record" mean?
* -0.0 SPF_PASS SPF: sender matches SPF record
* 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
* [score: 0.4115]
* 0.2 MIME_BASE64_NO_NAME RAW: base64 attachment does not have a file
* name
What attachments? I haven't attached anything to my message. It looks
like spamassassin took the hole message as an attachment just because
it is base64 - encoded.
* 1.9 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding
I don't understand why base64 encoded message is classified as
disguised? My mail agent had just decided to encode the message in
base64 encoding as it contains cp1251 characters so what's wrong with
that?
* 0.4 AWL AWL: From: address is in the auto white-list
Can anybody tell me what does "From: address is in the auto
white-list" mean? If it is in a white list why the coefficient is >0?
--
Камен
Re: false positives
Posted by Kamen TOMOV <ka...@cybuild.com>.
On четвъртък, Декември 07 2006, Sietse van Zanen wrote:
> They contain too little information.
All right - here is more information. I sent a message to a group and
I got it classified as spam. Here is the report:
* 1.7 SUBJECT_ENCODED_TWICE Subject: MIME encoded twice
Here is how the subject looks like when I sent it:
(off-topic) spamcop =?windows-1251?B?4vrv8O7x6A==?=
It looks to me that it is not encoded twice. However, here is the
subject of the message that was received in the list:
[SPAM] =?windows-1251?q?=5BSPAM=5D_=28off-topic=29_spamcop_=E2?=
=?windows-1251?b?+u/w7vHo?=
.., which might have been encoded twice. So is that a problem of the
mail-list?
* -0.0 SPF_HELO_PASS SPF: HELO matches SPF record
* 0.1 FORGED_RCVD_HELO Received: contains a forged HELO
Can anybody tell me what does "HELO matches SPF record" mean?
* -0.0 SPF_PASS SPF: sender matches SPF record
* 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
* [score: 0.4115]
* 0.2 MIME_BASE64_NO_NAME RAW: base64 attachment does not have a file
* name
What attachments? I haven't attached anything to my message. It looks
like spamassassin took the hole message as an attachment just because
it is base64 - encoded.
* 1.9 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding
I don't understand why base64 encoded message is classified as
disguised? My mail agent had just decided to encode the message in
base64 encoding as it contains cp1251 characters so what's wrong with
that?
* 0.4 AWL AWL: From: address is in the auto white-list
Can anybody tell me what does "From: address is in the auto
white-list" mean? If it is in a white list why the coefficient is >0?
--
Камен
RE: false positives
Posted by Sietse van Zanen <si...@wizdom.nu>.
They contain too little information.
-Sietse
From: Kamen TOMOV
Sent: Thu 07-Dec-06 14:34
To: users@spamassassin.apache.org
Subject: false positives
Hi,
I constantly have problems with spamcop these days. Could you tell me
what's wrong with my messages so that I can fix it?
Thanks,
--
Камен