Plain text spam not scoring

[Patrick Sneyers <cg...@bulckens.com>]

These don't hit very much in my setup. They get caught with the new  
Reverse-Check feature in CommuniGate.
I've been getting wuite a few of these plain text spams lately.

Source below.

Patrick Sneyers
Belgium



Return-Path: <Bu...@gmail.com>
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on www.deca.be
X-Spam-Status: No, score=1.7 required=5.0 tests=SARE_SPEC_XXGEOCITIES2,
         UNPARSEABLE_RELAY autolearn=no version=3.1.0
X-Reverse-Check: address rejected with reverse-check
Received: from [66.148.69.196] (HELO DM)
   by deca.be (CommuniGate Pro SMTP 5.0.8)
   with SMTP id 2025221 for xxx@cineclub.be; Tue, 21 Feb 2006  
12:42:23 +0100
Received: from gmail.com (8.8.8/8.8.8) id XAA61962; Tue, 21 Feb 2006  
05:42:25 -0600
Message-Id: <10...@gmail.com>
From: "Lucio Drake" <Bu...@gmail.com>
To: xxx@cineclub.be
Subject: Regarding Account Summary
X-Mailer: Opera/6.05 (Windows 2000; U) [fi]
Date: Tue, 21 Feb 2006 05:42:25 -0600


Kirsten Dumas,

Account Summary - http://au.geocities.com/penal15101/

Lucio Drake, Account Rep. l3757

Re: Plain text spam not scoring

[Patrick von der Hagen <pa...@wudika.de>]

Patrick Sneyers wrote:
> 
> Op 21-feb-06, om 16:08 heeft Matt Kettler het volgende geschreven:
> 
>> Patrick Sneyers wrote:
>>> These don't hit very much in my setup. They get caught with the new
>>> Reverse-Check feature in CommuniGate.
>> Do you know what this test does?
>>> I've been getting wuite a few of these plain text spams lately.
>>>
>> If you had SPF support, this would have caught SPF_NEUTRAL (gmail does
>> publish a SPF record).
>>
>> Also, Do you use regular RBL's? This should have hit the XBL check
>> (although there's a chance it wasn't listed at the time you got it)
>>
> 
> This test connects to the return-path domain's primary mx, and expects a 
> 250 response. If not, it retries/rejects (4xx/5xx) or adds a header.
> Kind of link this:
> http://www.dnsreport.com/tools/mail.ch?domain=mkettler_sa%40comcast.net
> 
> Basicly, a "mail you cannot reply to is suspicious" thingy.
Just for the record: I once added such a test to spamassassin doing 
exactly such a callout using Mail::Checkuser. It was quite easy, but my 
suggestion to add such a test to spamassassin received little positive 
response, so it was never published.
Meanwhile I have exim perform such a callout to the envelope-from and 
add a header to each mail if this callout fails. Much more efficient, 
espacially since exim caches callout-results and I using that 
information in spamassassin is just a simple header-check.

Re: Plain text spam not scoring

[Patrick Sneyers <cg...@bulckens.com>]

Op 21-feb-06, om 16:08 heeft Matt Kettler het volgende geschreven:

> Patrick Sneyers wrote:
>> These don't hit very much in my setup. They get caught with the new
>> Reverse-Check feature in CommuniGate.
> Do you know what this test does?
>> I've been getting wuite a few of these plain text spams lately.
>>
> If you had SPF support, this would have caught SPF_NEUTRAL (gmail does
> publish a SPF record).
>
> Also, Do you use regular RBL's? This should have hit the XBL check
> (although there's a chance it wasn't listed at the time you got it)
>

This test connects to the return-path domain's primary mx, and  
expects a 250 response. If not, it retries/rejects (4xx/5xx) or adds  
a header.
Kind of link this:
http://www.dnsreport.com/tools/mail.ch?domain=mkettler_sa%40comcast.net

Basicly, a "mail you cannot reply to is suspicious" thingy.

It's not perfect. slow DNS can cause FP's. Since only the primary is  
checked, I had some FP's with poorly configured domains of regulars  
(their primary is always down...).
Also a few ligit mailing lists, heck even SN Brussels Airlines online  
booking system sends confirmations with a "unkown-user" return-path.
So I use "add header", and only on a real 'fail' I drop them in a  
mailbox for checking. A failed reverse-check-message is either a FP,  
or one SA has missed.

But all in all I like the feature, but it should check at other MX's  
if the primary fails.

Maybe I should do the check before SA, and and add some score if the  
header is there.


I'm not too comfortable with SPF and should dig deeper to fully  
understand the consequences.

I use sbl-xbl and a few others.
It's there now. 66.148.69.196]((host name is unknown)) is Blacklisted  
by sbl-xbl.spamhaus.org

Re: Plain text spam not scoring

[Matt Kettler <mk...@comcast.net>]

Patrick Sneyers wrote:
> These don't hit very much in my setup. They get caught with the new
> Reverse-Check feature in CommuniGate.
Do you know what this test does?
> I've been getting wuite a few of these plain text spams lately.
>
If you had SPF support, this would have caught SPF_NEUTRAL (gmail does
publish a SPF record).

Also, Do you use regular RBL's? This should have hit the XBL check
(although there's a chance it wasn't listed at the time you got it)