You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by codger <li...@pmbx.net> on 2004/03/19 16:45:32 UTC
Kodak Easy Share Problem
It seems that email sent from Kodak's Easy Share software ALWAYS ends
up with high marks and ends up in our spambucket.
> 0.2 NO_REAL_NAME From: does not include a real name
> 0.6 J_CHICKENPOX_12 BODY: {1}Letter - punctuation - {2}Letter
> 0.1 HTML_FONTCOLOR_UNSAFE BODY: HTML font color not in safe 6x6x6
> palette
> 0.1 HTML_LINK_CLICK_HERE BODY: HTML link text says "click here"
> 0.2 HTML_TAG_BALANCE_A BODY: HTML has excess "a" close tags
> 0.1 HTML_MESSAGE BODY: HTML included in message
> 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to
> 100%
> [score: 1.0000]
> 1.0 RCVD_IN_SORBS RBL: SORBS: sender is listed in SORBS
> [172.167.147.128 listed in dnsbl.sorbs.net]
> 0.1 RCVD_IN_NJABL RBL: Received via a relay in
> dnsbl.njabl.org
> [172.167.147.128 listed in dnsbl.njabl.org]
> 1.0 L_SUBJ_GRATUITOUS_ENCODING Subject is encoded unnecessarily
> 0.0 UPPERCASE_25_50 message body is 25-50% uppercase
> 0.1 CLICK_BELOW Asks you to click below
>
They have particular problems with ChickenPox and HTML and Gratuitous
encoding as shown above. A lot of our folks seem to get Kodak EasyShare
email to send pictures and I was wondering if there was an easy way to
down the score for this type of email. Here's the headers also:
> Received: from [63.240.114.196] (HELO snj-us-pcwp-701.kodak.com)
> by pmbx.net (CommuniGate Pro SMTP 4.1.8)
> with ESMTP id 10101384 for *********************; Wed, 17 Mar 2004
> 22:29:58 -0500
> Received: from picturecd.kodak.com (ACA79380.ipt.aol.com
> [172.167.147.128])
> by snj-us-pcwp-701.kodak.com (8.11.7p2/8.11.7) with SMTP id
> i2I2HvB05813;
> Thu, 18 Mar 2004 02:17:57 GMT
> Message-Id: <20...@snj-us-pcwp-701.kodak.com>
> From: ****************
> To: **********************************
> Date: Wed, 17 Mar 2004 20:24:22 -0600
> MIME-Version: 1.0
> Content-Type: multipart/mixed; boundary=1_boundary
> Subject: =?ISO-8859-1?B?UGljdHVyZXMgZm9yIHlvdQ==?=
Re: Kodak Easy Share Problem
Posted by Kris Deugau <kd...@webhart.net>.
Kris Deugau wrote:
> If you can find some sort of consistent sender address, whitelist or
> whitelist_from_rcvd that. I've done that on the ISP filter server I
> run.
(For other similar automated or listmail.)
-kgd
--
"Sendmail administration is not black magic. There are legitimate
technical reasons why it requires the sacrificing of a live chicken."
- Unknown
Re: Kodak Easy Share Problem
Posted by Kris Deugau <kd...@webhart.net>.
codger wrote:
[snip details on Kodak mail]
> They have particular problems with ChickenPox and HTML and Gratuitous
> encoding as shown above. A lot of our folks seem to get Kodak
> EasyShare email to send pictures and I was wondering if there was an
> easy way to down the score for this type of email.
If you can find some sort of consistent sender address, whitelist or
whitelist_from_rcvd that. I've done that on the ISP filter server I
run.
Bounce copies of some of these to Kodak, let them know that *their*
customers are getting messages tagged. Sometimes that alone can get a
company to change things at least a little. That ISO-encoded subject,
for instance, shouldn't really be necessary- unless there are
international users sending mail with non-7bit-ASCII characters in their
subject lines through this service. :/ (A fairly high possibility.)
> > 5.4 BAYES_99 BODY: Bayesian spam probability is 99
> > to 100%
Feed a few of these back to Bayes as ham! Dropping this down even as
far as BAYES_60 (~1.6) would bring it back under the default threshold
of 5. Without Bayes you're "only" scoring 3.5 or so on your example.
-kgd
--
"Sendmail administration is not black magic. There are legitimate
technical reasons why it requires the sacrificing of a live chicken."
- Unknown