List Admin: bounce handling problem? RE: warning from users@spamassassin.apache.org

[Charles Gregory <cg...@hwcn.org>]

Is the 'bounce handler' for this list a little confused?
I received this notice yesterday for a temporary mailbox overflow
condition that occurred nearly two weeks ago (Aug 4). Now, according to 
the list processor, because I received this e-mail, all is well, but 
still, why would it be generating this message so late? I reveiwed my mail 
logs and Aug 4 was the LAST day I had any bounces at all!

- Charles, HWCN

On Sun, 16 Aug 2009, users-help@spamassassin.apache.org wrote:
> Date: 16 Aug 2009 07:51:39 -0000
> From: users-help@spamassassin.apache.org
> To: cgregory@hwcn.org
> Subject: [-1004.0] warning from users@spamassassin.apache.org
> 
>
> Hi! This is the ezmlm program. I'm managing the
> users@spamassassin.apache.org mailing list.
>
>
> Messages to you from the users mailing list seem to
> have been bouncing. I've attached a copy of the first bounce
> message I received.
>
> If this message bounces too, I will send you a probe. If the probe bounces,
> I will remove your address from the users mailing list,
> without further notice.
>
>
> I've kept a list of which messages from the users mailing list have
> bounced from your address.
>
> Copies of these messages may be in the archive.
> To retrieve a set of messages 123-145 (a maximum of 100 per request),
> send a short message to:
>   <us...@spamassassin.apache.org>
>
> To receive a subject and author list for the last 100 or so messages,
> send a short message to:
>   <us...@spamassassin.apache.org>
>
> Here are the message numbers:
>
>   81951
>   81952
>   81953
>   81954
>   81955
>   81956
>
> --- Enclosed is a copy of the bounce message I received.
>
> Return-Path: <>
> Received: (qmail 42321 invoked by uid 99); 4 Aug 2009 11:06:01 -0000
> Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136)
>    by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 04 Aug 2009 11:06:01 +0000
> X-ASF-Spam-Status: No, hits=0.0 required=10.0
> 	tests=
> X-Spam-Check-By: apache.org
> Received: from [199.212.94.76] (HELO barton.hwcn.org) (199.212.94.76)
>    by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 04 Aug 2009 11:05:49 +0000
> Received: by barton.hwcn.org (Postfix)
> 	id 28400F3F01; Tue,  4 Aug 2009 07:02:27 -0400 (EDT)
> Date: Tue,  4 Aug 2009 07:02:27 -0400 (EDT)
> From: MAILER-DAEMON@hwcn.org (Mail Delivery System)
> Subject: Undelivered Mail Returned to Sender
> To: users-return-81951-cgregory=hwcn.org@spamassassin.apache.org
> MIME-Version: 1.0
> Content-Type: multipart/report; report-type=delivery-status;
> 	boundary="DCB31F3EFD.1249383747/barton.hwcn.org"
> Message-Id: <20...@barton.hwcn.org>
> X-Virus-Checked: Checked by ClamAV on apache.org
>
> This is a MIME-encapsulated message.
>
> --DCB31F3EFD.1249383747/barton.hwcn.org
> Content-Description: Notification
> Content-Type: text/plain
>
> This is the Postfix program at host barton.hwcn.org.
>
> I'm sorry to have to inform you that your message could not
> be delivered to one or more recipients. It's attached below.
>
> For further assistance, please send mail to <postmaster>
>
> If you do so, please include this problem report. You can
> delete your own text from the attached returned message.
>
> 			The Postfix program
>
> <cg...@hwcn.org>: can't create user output file
>
> --DCB31F3EFD.1249383747/barton.hwcn.org
> Content-Description: Delivery report
> Content-Type: message/delivery-status
>
> Reporting-MTA: dns; barton.hwcn.org
> X-Postfix-Queue-ID: DCB31F3EFD
> X-Postfix-Sender: rfc822; users-return-81951-cgregory=hwcn.org@spamassassin.apache.org
> Arrival-Date: Tue,  4 Aug 2009 07:02:26 -0400 (EDT)
>
> Final-Recipient: rfc822; cgregory@hwcn.org
> Action: failed
> Status: 5.0.0
> Diagnostic-Code: X-Postfix; can't create user output file
>
> --DCB31F3EFD.1249383747/barton.hwcn.org
> Content-Description: Undelivered Message
> Content-Type: message/rfc822
>
> Received: by barton.hwcn.org (Postfix, from userid 110)
> 	id DCB31F3EFD; Tue,  4 Aug 2009 07:02:26 -0400 (EDT)
> X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on barton.hwcn.org
> X-Spam-Level:
> X-Spam-Status: No, hits=-2004.0 required=10.0 autolearn=disabled
> 	tests=LOC_SAUSERS_RCVD_WL=-1000,LOC_SAUSERS_TO_WL=-1000,RCVD_IN_DNSWL_MED=-4
> Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
>    by barton.hwcn.org with SMTP id riwjxgtyjhyrkvf3ej3kwf9hka;
>    for cgregory@hwcn.org;
>    Tue, 04 Aug 2009 07:02:11 -0400 (EDT)
>    (envelope-from users-return-81951-cgregory=hwcn.org@spamassassin.apache.org)
> Received-SPF: Pass; receiver=barton.hwcn.org; client-ip=140.211.11.3;
>    envelope-from=<us...@spamassassin.apache.org>;
>    helo=mail.apache.org; mechanism=a:mail.apache.org
> X-Avenger: version=0.7.9; receiver=barton.hwcn.org; client-ip=140.211.11.3;
>    client-port=63482; syn-fingerprint=65535:54:1:60:M1460,N,W3,S,T;
>    data-bytes=0; network-path=208.65.246.17 208.72.120.5 74.205.221.2
>    38.104.159.125 38.20.41.69 154.54.27.245 154.54.25.70 154.54.5.10
>    4.68.101.94 4.69.140.190 4.69.140.190 4.69.132.53 4.69.132.61
>    63.211.200.246 207.98.64.177 0.0.0.0 207.98.64.177;
>    network-path-time=1249383730
> Received: (qmail 39962 invoked by uid 500); 4 Aug 2009 11:04:56 -0000
> Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm
> Precedence: bulk
> list-help: <ma...@spamassassin.apache.org>
> list-unsubscribe: <ma...@spamassassin.apache.org>
> List-Post: <ma...@spamassassin.apache.org>
> List-Id: <users.spamassassin.apache.org>
> Delivered-To: mailing list users@spamassassin.apache.org
> Received: (qmail 39954 invoked by uid 99); 4 Aug 2009 11:04:56 -0000
> Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230)
>    by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 04 Aug 2009 11:04:56 +0000
> X-ASF-Spam-Status: No, hits=-0.0 required=10.0
> 	tests=SPF_HELO_PASS,SPF_PASS
> Received-SPF: pass (nike.apache.org: domain of uhlar@fantomas.sk designates 195.168.3.66 as permitted sender)
> Received: from [195.168.3.66] (HELO fantomas.fantomas.sk) (195.168.3.66)
>    by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 04 Aug 2009 11:04:44 +0000
> Received: from fantomas.fantomas.sk (uhlar@localhost [127.0.0.1])
> 	by fantomas.fantomas.sk (8.14.3/8.14.3/Debian-5) with ESMTP id n74B4Ndw002699
> 	for <us...@spamassassin.apache.org>; Tue, 4 Aug 2009 13:04:23 +0200
> Received: (from uhlar@localhost)
> 	by fantomas.fantomas.sk (8.14.3/8.14.3/Submit) id n74B4NQ3002698
> 	for users@spamassassin.apache.org; Tue, 4 Aug 2009 13:04:23 +0200
> X-Authentication-Warning: fantomas.fantomas.sk: uhlar set sender to uhlar@fantomas.sk using -f
> Date: Tue, 4 Aug 2009 13:04:23 +0200
> From: Matus UHLAR - fantomas <uh...@fantomas.sk>
> To: users@spamassassin.apache.org
> Subject: Re: Bayes training
> Message-ID: <20...@fantomas.sk>
> Mail-Followup-To: users@spamassassin.apache.org
> References: <55...@mail.gmail.com>
> MIME-Version: 1.0
> Content-Type: text/plain; charset=us-ascii
> Content-Disposition: inline
> In-Reply-To: <55...@mail.gmail.com>
> User-Agent: Mutt/1.5.18 (2008-05-17)
> X-Virus-Checked: Checked by ClamAV on apache.org
>
> On 03.08.09 23:17, MySQL Student wrote:
>> We have accumulated quite a large list of whitelisted users, primarily
>> because they were previously tagged incorrectly. I've extracted a copy
>> of all whitelisted mail into a separate mbox.
>>
>> Certainly there is some spam in there as well, but assuming I only
>> learn the ham, would it make sense to train bayes using the emails
>> from this folder?
>
> if you'll separate the spam, yes.
>
>> It's all business-related, but I'm concerned that it
>> may have things in the email that caused it to be tagged in the first
>> place, like excessive HTML, sent from a host with no reverse DNS, etc.
>> -- all the reasons for it being whitelisted in the first place.
>
> If you only do whitelisting, and don't advise users to take care of why
> their mail was marked as spam, many things may occur. However it may be
> worth it.
>
>> Looking at the logs before the addresses were added to the whitelist,
>> I see quite a few that were BAYES_99, probably because they resemble
>> mailing lists, such as those from networkworld, for example.
>
> do you train mailing list mail as spam? Or do you mean spamming lists?
>
>> IOW, I
>> wouldn't want to whitelist an email from networkworld.com, but one of
>> the company's partners could send the company an email that had many
>> of those characteristics.
>>
>> Someone may also send them a one-line email with a small GIF as an
>> attachment, such as their corporate logo in their signature. This
>> would be a valid email, but also very much resembles the
>> characteristics of a typical spam.
>>
>> This is all being done to hopefully train bayes to better recognize
>> corporate email, and hopefully cut down on the number of whitelisted
>> senders that must be added in the future (or, corporate email that
>> gets tagged then must be whitelisted).
>
> Just do the training, altogether with advising users to get reverse DNS,
> send html+text instead of html only etc. I think you are not the only one
> who marks their mail as spam...
>
> -- 
> Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
> Warning: I wish NOT to receive e-mail advertising to this address.
> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
> There's a long-standing bug relating to the x86 architecture that
> allows you to install Windows.   -- Matthew D. Fuller
>
> --DCB31F3EFD.1249383747/barton.hwcn.org--
>