You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Screaming Eagle <te...@gmail.com> on 2006/06/26 19:55:11 UTC
outlook email is beeing flag as spam...
Does any one know how to handle this?:
-1.8 ALL_TRUSTED Passed through trusted hosts only via SMTP
-0.2 BAYES_40 BODY: Bayesian spam probability is 20 to 40%
[score: 0.3371]
0.1 HTML_90_100 BODY: Message is 90% to 100% HTML
1.8 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words
1.0 HTML_MESSAGE BODY: HTML included in message
1.7 MSGID_DOLLARS Message-Id has pattern used in spam
1.9 RATWARE_MS_HASH Bulk email fingerprint (msgid ms hash) found
2.8 RATWARE_OUTLOOK_NONAME Bulk email fingerprint (Outlook no name)
found
I cuold adjust ALL_TRUSTED so this won't be mark as spam, but what about
other email being sent by outlook from outside? Any idea?
Thanks.
Re: outlook email is beeing flag as spam...
Posted by Screaming Eagle <te...@gmail.com>.
Wow,
I did not know this can break so many aspects of spamasassin, thank you for
the information. I have set trusted_network on my local.cf file, I have set
all except one network which have a netmask of 255.255.255.192, how should I
handle this? Should it be like <network ip>/255.255.255.192? I have set it
like so and have not seen any errors in log file.
Re: outlook email is beeing flag as spam...
Posted by Loren Wilton <lw...@earthlink.net>.
I suggested before that you had a problem with your trusted_hosts configuration. The headers below confirms that you have a problem with your trusted_hosts configuration.
The solution isn't to adjust the score on ALL_TRUSTED. The solution is to correctly set trusted_hosts so that the rule doesn't trigger for mail that comes from non-trusted hosts.
This will also "fix" a number of other score-related problems you are probably seeing. A LOT of stuff breaks in SA if the trust path is wrong.
Loren
----- Original Message -----
From: Screaming Eagle
To: spam mailling list
Sent: Monday, June 26, 2006 10:55 AM
Subject: outlook email is beeing flag as spam...
Does any one know how to handle this?:
-1.8 ALL_TRUSTED Passed through trusted hosts only via SMTP
-0.2 BAYES_40 BODY: Bayesian spam probability is 20 to 40%
[score: 0.3371]
0.1 HTML_90_100 BODY: Message is 90% to 100% HTML
1.8 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words
1.0 HTML_MESSAGE BODY: HTML included in message
1.7 MSGID_DOLLARS Message-Id has pattern used in spam
1.9 RATWARE_MS_HASH Bulk email fingerprint (msgid ms hash) found
2.8 RATWARE_OUTLOOK_NONAME Bulk email fingerprint (Outlook no name)
found
I cuold adjust ALL_TRUSTED so this won't be mark as spam, but what about other email being sent by outlook from outside? Any idea?
Thanks.
Re: outlook email is beeing flag as spam...
Posted by Benny Pedersen <me...@junc.org>.
> Does any one know how to handle this?:
> found I cuold adjust ALL_TRUSTED so this won't be mark as spam, but what about
> other email being sent by outlook from outside? Any idea?
http://www.mozilla.com/thunderbird/
Re: outlook email is beeing flag as spam...
Posted by Loren Wilton <lw...@earthlink.net>.
Its still hard to believe that those are all of the headers. If so, you have more serious problems than getting a few rule hits. What about headers like
From:
To:
Subject:
X-Priority:
X-MSMail-Priority:
X-Mailer:
X-MimeOLE:
I *KNOW* you don't have one of those headers. I'm pretty sure that you have at least four others of them. But not all of them.
Guessing gets boring rapidly.
Loren
----- Original Message -----
From: Screaming Eagle
To: Bret Miller
Cc: users@spamassassin.apache.org
Sent: Monday, June 26, 2006 2:48 PM
Subject: Re: outlook email is beeing flag as spam...
here u go, hope this shed some lights...:
Received: from deskandys (192-168-240-205..... [192.168.240.205])
by smtpserver..... (8.11.6/8.11.6) with ESMTP id k5QGgDN01015;
Mon, 26 Jun 2006 12:42:13 -0400
Date: Mon, 26 Jun 2006 12:42:00 -0400
.......
Message-Id: <00...@deskandys>
X-Spam-Virus: No
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.3 (2006-06-01) on smtpserver.....
X-Spam-Level: *******
X-Spam-Status: Yes, score=7.6 required=7.0 tests=ALL_TRUSTED,BAYES_50,
HTML_90_100,HTML_IMAGE_ONLY_28,HTML_MESSAGE,MSGID_DOLLARS,
RATWARE_MS_HASH,RATWARE_OUTLOOK_NONAME autolearn=no version=3.1.3
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_44A00E6A.133D516C"
Status: RO
Content-Length: 13240
Lines: 318
This is a multi-part message in MIME format.
------------=_44A00E6A.133D516C
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Re: outlook email is beeing flag as spam...
Posted by Screaming Eagle <te...@gmail.com>.
here u go, hope this shed some lights...:
Received: from deskandys (192-168-240-205..... [192.168.240.205])
by smtpserver..... (8.11.6/8.11.6) with ESMTP id k5QGgDN01015;
Mon, 26 Jun 2006 12:42:13 -0400
Date: Mon, 26 Jun 2006 12:42:00 -0400
.......
Message-Id: <00...@deskandys>
X-Spam-Virus: No
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.3 (2006-06-01) on smtpserver.....
X-Spam-Level: *******
X-Spam-Status: Yes, score=7.6 required=7.0 tests=ALL_TRUSTED,BAYES_50,
HTML_90_100,HTML_IMAGE_ONLY_28,HTML_MESSAGE,MSGID_DOLLARS,
RATWARE_MS_HASH,RATWARE_OUTLOOK_NONAME autolearn=no version=3.1.3
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_44A00E6A.133D516C"
Status: RO
Content-Length: 13240
Lines: 318
This is a multi-part message in MIME format.
------------=_44A00E6A.133D516C
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
RE: outlook email is beeing flag as spam...
Posted by Bret Miller <br...@wcg.org>.
> On Monday 26 June 2006 22:17, Screaming Eagle took the
> opportunity to write:
> > header info:
> > Date: Mon, 26 Jun 2006 12:42:00 -0400
> > X-Spam-Virus: No
> > X-Spam-Flag: YES
> > X-Spam-Checker-Version: SpamAssassin 3.1.3 (2006-06-01) on ...
> > X-Spam-Level: *******
> > X-Spam-Status: Yes, score=7.6 required=7.0
> tests=ALL_TRUSTED,BAYES_50,
> > HTML_90_100,HTML_IMAGE_ONLY_28,HTML_MESSAGE,MSGID_DOLLARS,
> > RATWARE_MS_HASH,RATWARE_OUTLOOK_NONAME autolearn=no
> version=3.1.3
>
> All of them, please. You've already posted the rules hit;
> those lines don't add any information.
Message-ID:?
Received:?
This can't be all the headers...
Bret
Re: outlook email is beeing flag as spam...
Posted by Magnus Holmgren <ho...@lysator.liu.se>.
On Monday 26 June 2006 22:17, Screaming Eagle took the opportunity to write:
> header info:
> Date: Mon, 26 Jun 2006 12:42:00 -0400
> X-Spam-Virus: No
> X-Spam-Flag: YES
> X-Spam-Checker-Version: SpamAssassin 3.1.3 (2006-06-01) on ...
> X-Spam-Level: *******
> X-Spam-Status: Yes, score=7.6 required=7.0 tests=ALL_TRUSTED,BAYES_50,
> HTML_90_100,HTML_IMAGE_ONLY_28,HTML_MESSAGE,MSGID_DOLLARS,
> RATWARE_MS_HASH,RATWARE_OUTLOOK_NONAME autolearn=no version=3.1.3
All of them, please. You've already posted the rules hit; those lines don't
add any information.
--
Magnus Holmgren holmgren@lysator.liu.se
(No Cc of list mail needed, thanks)
Re: outlook email is beeing flag as spam...
Posted by Screaming Eagle <te...@gmail.com>.
header info:
Date: Mon, 26 Jun 2006 12:42:00 -0400
X-Spam-Virus: No
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.3 (2006-06-01) on ...
X-Spam-Level: *******
X-Spam-Status: Yes, score=7.6 required=7.0 tests=ALL_TRUSTED,BAYES_50,
HTML_90_100,HTML_IMAGE_ONLY_28,HTML_MESSAGE,MSGID_DOLLARS,
RATWARE_MS_HASH,RATWARE_OUTLOOK_NONAME autolearn=no version=3.1.3
Please ignore ALL_TRUSTED, i am working on setting up trusted_network
parameters.
Thanks.
RE: outlook email is beeing flag as spam...
Posted by Bret Miller <br...@wcg.org>.
> Any pointers on this: "real solution is to find what's causing
> the rule to fire and fix the Outlook setup so it doesn't trigger
> it"?. Thanks.
How about posting the message headers. The last three rules that fired
(MSID_DOLLARS, RATWARE_MS_HASH, and RATWARE_OUTLOOK_NONAME) all indicate
a problem with the message ID format in combination with another header.
If you have something in your path removing headers from messages,
that'll cause this.
SA relies on the headers being preserved to get an accurate assessment
of what's going on. Cleaning them out before calling SA is just asking
for trouble.
Bret
Re: outlook email is beeing flag as spam...
Posted by Screaming Eagle <te...@gmail.com>.
Any pointers on this: "real solution is to find what's causing the rule to
fire and fix the Outlook setup so it doesn't trigger it"?. Thanks.
RE: outlook email is beeing flag as spam...
Posted by Steve Thomas <li...@sthomas.net>.
> -1.8 ALL_TRUSTED Passed through trusted hosts only via SMTP
> -0.2 BAYES_40 BODY: Bayesian spam probability is 20 to 40%
> [score: 0.3371]
> 0.1 HTML_90_100 BODY: Message is 90% to 100% HTML
> 1.8 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of
> words
> 1.0 HTML_MESSAGE BODY: HTML included in message
> 1.7 MSGID_DOLLARS Message-Id has pattern used in spam
> 1.9 RATWARE_MS_HASH Bulk email fingerprint (msgid ms hash) found
> 2.8 RATWARE_OUTLOOK_NONAME Bulk email fingerprint (Outlook no name)
> found
FWIW, I just sent myself a test message using Outlook and these are the
only rules that fired:
-1.8 ALL_TRUSTED
-2.6 BAYES_00
-0.0 AWL
I'm using Outlook 2003 (11.8010.6568) SP2 and SA 3.1.0.
Re: outlook email is beeing flag as spam...
Posted by Loren Wilton <lw...@earthlink.net>.
2.8 RATWARE_OUTLOOK_NONAME Bulk email fingerprint (Outlook no name)
Something has removed the X-Mailer line from the messages.
Loren
----- Original Message -----
From: Bret Miller
To: spam mailling list
Sent: Monday, June 26, 2006 11:10 AM
Subject: RE: outlook email is beeing flag as spam...
Honestly, those Outlook rules should be firing on a normal Outlook user, or they're scored way to high. I use Outlook every day and AFAIK, I've never had my e-mail rejected or tagged with those rules.
It's probably time to look at what is being generated by these specific problem users that trigger those rules.
Of course, you could always adjust the scores:
score RATWARE_MS_HASH 0.01
score RATWARE_OUTLOOK_NONAME 0.01
But then realize that your users generating those message are going to be flagged as spam by a lot of other systems running SA, so the real solution is to find what's causing the rule to fire and fix the Outlook setup so it doesn't trigger it.
Bret
----------------------------------------------------------------------------
From: Screaming Eagle [mailto:tekion@gmail.com]
Sent: Monday, June 26, 2006 10:55 AM
To: spam mailling list
Subject: outlook email is beeing flag as spam...
Does any one know how to handle this?:
-1.8 ALL_TRUSTED Passed through trusted hosts only via SMTP
-0.2 BAYES_40 BODY: Bayesian spam probability is 20 to 40%
[score: 0.3371]
0.1 HTML_90_100 BODY: Message is 90% to 100% HTML
1.8 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words
1.0 HTML_MESSAGE BODY: HTML included in message
1.7 MSGID_DOLLARS Message-Id has pattern used in spam
1.9 RATWARE_MS_HASH Bulk email fingerprint (msgid ms hash) found
2.8 RATWARE_OUTLOOK_NONAME Bulk email fingerprint (Outlook no name)
found
I cuold adjust ALL_TRUSTED so this won't be mark as spam, but what about other email being sent by outlook from outside? Any idea?
Thanks.
RE: outlook email is beeing flag as spam...
Posted by Bret Miller <br...@wcg.org>.
Honestly, those Outlook rules should be firing on a normal Outlook user,
or they're scored way to high. I use Outlook every day and AFAIK, I've
never had my e-mail rejected or tagged with those rules.
It's probably time to look at what is being generated by these specific
problem users that trigger those rules.
Of course, you could always adjust the scores:
score RATWARE_MS_HASH 0.01
score RATWARE_OUTLOOK_NONAME 0.01
But then realize that your users generating those message are going to
be flagged as spam by a lot of other systems running SA, so the real
solution is to find what's causing the rule to fire and fix the Outlook
setup so it doesn't trigger it.
Bret
_____
From: Screaming Eagle [mailto:tekion@gmail.com]
Sent: Monday, June 26, 2006 10:55 AM
To: spam mailling list
Subject: outlook email is beeing flag as spam...
Does any one know how to handle this?:
-1.8 ALL_TRUSTED Passed through trusted hosts only via SMTP
-0.2 BAYES_40 BODY: Bayesian spam probability is 20 to 40%
[score: 0.3371]
0.1 HTML_90_100 BODY: Message is 90% to 100% HTML
1.8 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of
words
1.0 HTML_MESSAGE BODY: HTML included in message
1.7 MSGID_DOLLARS Message-Id has pattern used in spam
1.9 RATWARE_MS_HASH Bulk email fingerprint (msgid ms hash) found
2.8 RATWARE_OUTLOOK_NONAME Bulk email fingerprint (Outlook no name)
found
I cuold adjust ALL_TRUSTED so this won't be mark as spam, but what about
other email being sent by outlook from outside? Any idea?
Thanks.