You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Stefan Jakobs <st...@localside.net> on 2011/02/25 09:59:44 UTC
webmail message, false positiv
Hi list,
I received a message from a friend, fetched the message by using POP3 and
passed it to spamassassin. It marked the message as spam.
I know this is not the intended use of spamassassin, but is there any chance
that I can circumvent this kind of false positives?
Here are the headers:
Received: from web.de by mxint02.web.de with esmtp (WEB.DE 4.110 #2)
id 1PshFE-0003cY-00
for AAAAAA@web.de; Thu, 24 Feb 2011 20:53:00 +0100
Received: from mwmweb019 ( [172.20.18.28])
by fmmailgate06.web.de (Postfix) with ESMTP id 24649899FC4
for <AA...@web.de>; Thu, 24 Feb 2011 20:53:00 +0100 (CET)
Received: from [78.55.199.104] by mwmweb019 with HTTP; Thu
Feb 24 20:53:00 CET 2011
Message-ID: <42...@mwmweb019>
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_Part_230494_250017406.1298577089175"
Date: Thu, 24 Feb 2011 20:53:00 +0100 (CET)
From: "afried" <BB...@web.de>
To: AAAAAA@web.de
Subject: Zeugnisse
And here's the result from spamassassin:
Inhaltsanalyse im Detail: (6.4 Punkte, 5.0 benötigt)
Pkte Regelname Beschreibung
---- ---------------------- --------------------------------------------------
3.3 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
[78.55.199.104 listed in zen.spamhaus.org]
0.0 RCVD_IN_SORBS_DUL RBL: SORBS: Senderechner nur temporär mit Internet
verbunden
[78.55.199.104 listed in dnsbl.sorbs.net]
1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[78.55.199.104 listed in bb.barracudacentral.org]
0.5 RCVD_IN_SEMBLACK RBL: Received from an IP listed by SEM-BLACK
[78.55.199.104 listed in bl.spameatingmonkey.net]
0.0 FREEMAIL_FROM Sender email is freemail (BBBBBB[at]web.de)
-1.9 BAYES_00 BODY: Spamwahrscheinlichkeit nach Bayes-Test: 0-1%
[score: 0.0000]
1.4 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words
0.0 HTML_MESSAGE BODY: Nachricht enthält HTML
0.7 MIME_HTML_ONLY BODY: MIME-Nachricht besteht nur aus HTML
-0.3 AWL AWL: From: address is in the auto white-list
0.8 RDNS_NONE Delivered to internal network by a host with no
rDNS
0.4 HTML_MIME_NO_HTML_TAG Nachricht besteht nur aus HTML, hat aber kein
"html"-Element
0.0 T_REMOTE_IMAGE Message contains an external image
0.0 T_TO_NO_BRKTS_FREEMAIL T_TO_NO_BRKTS_FREEMAIL
0.0 T_FREEMAIL_DOC_PDF MS document or PDF attachment, from freemail
Thanks for your help.
Stefan
Re: webmail message, false positiv
Posted by Stefan Jakobs <st...@localside.net>.
On Friday 25 February 2011 10:29:08 Ned Slider wrote:
<snip>
> > 3.3 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
> >
> > [78.55.199.104 listed in zen.spamhaus.org]
>
> That looks to be your main problem right there - don't deep parse
> Received headers against Spamhaus PBL, only check lastexternal
> addresses, as this will cause a large number of false positives.
It's the default ruleset and it checks only the lastexternal address. See:
# /var/lib/spamassassin/3.003001> grep -R RCVD_IN_PBL *
updates_spamassassin_org/20_dnsbl_tests.cf:header RCVD_IN_PBL
eval:check_rbl('zen-lastexternal', 'zen.spamhaus.org.', '127.0.0.1[01]')
But thanks for the hint. I didn't know before that such a option exists.
Regards
Stefan
Re: webmail message, false positiv
Posted by Ned Slider <ne...@unixmail.co.uk>.
On 25/02/11 08:59, Stefan Jakobs wrote:
>
> Hi list,
>
> I received a message from a friend, fetched the message by using POP3 and
> passed it to spamassassin. It marked the message as spam.
> I know this is not the intended use of spamassassin, but is there any chance
> that I can circumvent this kind of false positives?
>
> Here are the headers:
> Received: from web.de by mxint02.web.de with esmtp (WEB.DE 4.110 #2)
> id 1PshFE-0003cY-00
> for AAAAAA@web.de; Thu, 24 Feb 2011 20:53:00 +0100
> Received: from mwmweb019 ( [172.20.18.28])
> by fmmailgate06.web.de (Postfix) with ESMTP id 24649899FC4
> for<AA...@web.de>; Thu, 24 Feb 2011 20:53:00 +0100 (CET)
> Received: from [78.55.199.104] by mwmweb019 with HTTP; Thu
> Feb 24 20:53:00 CET 2011
> Message-ID:<42...@mwmweb019>
> MIME-Version: 1.0
> Content-Type: multipart/mixed;
> boundary="----=_Part_230494_250017406.1298577089175"
> Date: Thu, 24 Feb 2011 20:53:00 +0100 (CET)
> From: "afried"<BB...@web.de>
> To: AAAAAA@web.de
> Subject: Zeugnisse
>
> And here's the result from spamassassin:
> Inhaltsanalyse im Detail: (6.4 Punkte, 5.0 benötigt)
>
> Pkte Regelname Beschreibung
> ---- ---------------------- --------------------------------------------------
> 3.3 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
> [78.55.199.104 listed in zen.spamhaus.org]
That looks to be your main problem right there - don't deep parse
Received headers against Spamhaus PBL, only check lastexternal
addresses, as this will cause a large number of false positives.
Re: webmail message, false positiv
Posted by RW <rw...@googlemail.com>.
On Fri, 25 Feb 2011 09:59:44 +0100
"Stefan Jakobs" <st...@localside.net> wrote:
>
> Hi list,
>
> I received a message from a friend, fetched the message by using POP3
> and passed it to spamassassin. It marked the message as spam.
> I know this is not the intended use of spamassassin,
Actually it's fine to use SA this way. The problem is that SA can't
work out that this particular mail is internal to web.de. The following
header doesn't look like an authenticated submission, so SA thinks it's
an external mail server
> Received: from [78.55.199.104] by mwmweb019 with HTTP;...
The canonical solution to this is to put all the wmwebXXX ip addresses
in msa_networks, but you shouldn't include the MX servers, so you
have to be careful about using address blocks. It's more difficult
because all the addresses are private and you can't get them from dns
lookups.
If you don't get a lot of of local spam on web.de it might be easier to
whitelist. Or write a rule that take 10 points or so off local webmail.
Something like:
header LOCAL_WEBMAIL X-Spam-Relays-Untrusted =~ /^[^\]]+ by=mwmweb/