You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Joseph Brennan <br...@columbia.edu> on 2007/10/30 20:27:01 UTC
Myspace's mail headers
Excerpt, headers from a generated message from myspace (I have folded
lines for legibility) :
Received: from vmta17.myspace.com (vmta17.myspace.com [204.16.33.80])
by cayenne.cc.columbia.edu (8.14.1/8.14.1) with ESMTP id l9U3N5he001961
for <xx...@columbia.edu>; Mon, 29 Oct 2007 23:23:10 -0400 (EDT)
Received: from els2mwebnet1425 (10.44.128.43) by vmta17.myspace.com
(PowerMTA(TM) v3.2r17) id h4qhps0f2do3 for <xx...@columbia.edu>;
Mon, 29 Oct 2007 20:23:05 -0700 (envelope-from
<04...@message.myspace.com>)
mime-version: 1.0
from: "=?iso-8859-1?Q?MySpace Admin?="
<04...@message.myspace.com>
to: xxxx@columbia.edu
reply-to: "=?iso-8859-1?Q?MySpace Admin?="
<04...@message.myspace.com>
date: 29 Oct 2007 20:23:04 -0700
subject: MySpace account cancellation request - please confirm
content-type: text/plain; charset=utf-8
content-transfer-encoding: base64
Notice the all-lower-case field names, which do not conform to the
RFC 2822 field names that they almost match. That is, a "from:"
header is not the same as a "From:" header!
It looks like the FROM ends up undefined in Spamassasssin, and so
this cannot be whitelisted. I'm not necessarily saying Spamassassin
is wrong either. Any opinions?
I sent mail to postmaster@myspace.com this morning. It would be
nice if they change this.
Joseph Brennan
Columbia University IT
Re: Myspace's mail headers
Posted by Matt Kettler <mk...@verizon.net>.
Joseph Brennan wrote:
>
>
> Excerpt, headers from a generated message from myspace (I have folded
> lines for legibility) :
>
> Received: from vmta17.myspace.com (vmta17.myspace.com [204.16.33.80])
> by cayenne.cc.columbia.edu (8.14.1/8.14.1) with ESMTP id l9U3N5he001961
> for <xx...@columbia.edu>; Mon, 29 Oct 2007 23:23:10 -0400 (EDT)
> Received: from els2mwebnet1425 (10.44.128.43) by vmta17.myspace.com
> (PowerMTA(TM) v3.2r17) id h4qhps0f2do3 for <xx...@columbia.edu>;
> Mon, 29 Oct 2007 20:23:05 -0700 (envelope-from
> <04...@message.myspace.com>)
> mime-version: 1.0
> from: "=?iso-8859-1?Q?MySpace Admin?="
> <04...@message.myspace.com>
> to: xxxx@columbia.edu
> reply-to: "=?iso-8859-1?Q?MySpace Admin?="
> <04...@message.myspace.com>
> date: 29 Oct 2007 20:23:04 -0700
> subject: MySpace account cancellation request - please confirm
> content-type: text/plain; charset=utf-8
> content-transfer-encoding: base64
>
>
>
> Notice the all-lower-case field names, which do not conform to the
> RFC 2822 field names that they almost match. That is, a "from:"
> header is not the same as a "From:" header!
>
> It looks like the FROM ends up undefined in Spamassasssin, and so
> this cannot be whitelisted. I'm not necessarily saying Spamassassin
> is wrong either. Any opinions?
Works for me, at least using SA 3.2.3 it does.
>From spamassassin -tLD < testmessage.txt
------------------
[6091] dbg: eval: all '*From' addrs:
04.15.0.64763231393140636F6C756D6269612E656
475@message.myspace.com suffer@melodymail-munged-.com
------------------
Re: Myspace's mail headers
Posted by Bart Schaefer <ba...@gmail.com>.
On Oct 30, 2007 12:27 PM, Joseph Brennan <br...@columbia.edu> wrote:
>
> Notice the all-lower-case field names, which do not conform to the
> RFC 2822 field names that they almost match. That is, a "from:"
> header is not the same as a "From:" header!
It's *supposed* to be the same. RFC *822 does not specify case for
field names. See RFC 2234 where the ABNF format is defined, section
2.3.
if SA is not finding the from-address as a result of lower-casing
"from:", then SA has a bug. If SA is *intentionally* ignoring "from:"
because lower-casing is a spam-sign, then that's a somewhat different
matter ... but probably still wrong.