14 Oct
2013
14 Oct
'13
2:52 p.m.
Hello,
Since I am both lazy and stupid:-
Is there a way to exclude e-mails received from certain (external)
senders from the spamd check?
Am using the BitFolk spamd service from my Debian vps, and it works
really fine with just one exception. Every time I get an e-mail from
DPD about a scheduled delivery, it is marked as spam by the spamd
service. And since I am not checking the spam account every day I
don't see this until it is too late.
Is the a prefered way to "whitelist" the e-mail sender
yourdelivery(a)dpd.co.uk somewhow? So those emails are never sent to
spamassasin and filtered out as spam?
In /etc/mail/spamassassin/spamc.conf?
Or /etc/postfix/master.cf?
Or is the only method to change the shell script communicating with
spamd: /usr/local/bin/spamchk.sh? That is a quick fix, but it is
not a clean solution IMHO...
Thanks,
__
/ony
14 Oct
14 Oct
4:02 p.m.
On 14/10/13 15:52, BitFolkList(a)tony-andersson.com wrote:
[snip]
Is the a prefered way to "whitelist" the
e-mail sender
yourdelivery(a)dpd.co.uk somewhow? So those emails are never sent to
spamassasin and filtered out as spam?
How are you invoking spamassassin in the first place?
I've done this in the past by means of rules in .procmailrc. First
check for a particular sender, then invoke spamc, then on to all the
rest of the processing.
Of course, if you're invoking the spamassassin check on a global basis
before the mail is routed to individual users then this won't help.
I'd be intrigued to know what's so badly put together about DPD's
e-mails that they fall foul of SA. It might be worth telling them.
John
5:49 p.m.
Thanks for the suggestion John. Don't have a .procmailrc though, and
am reluctant to add yet another config file. :-)
Spamassasin is called from /etc/postfix/master.cf via a script,
/usr/local/bin/spamchk.sh, and then the configuration is read from
/etc/mail/spamassassin/spamc.conf. Ideally I'd like to set some known
and supported parameter in the spamc.conf file. To make it global for
the server and make sure it is in a place where I am likely to find it
again, when I have forgotten all about it in a months time, but need
to change it. If I vaguely can remember the idea I could then
Google for it. Sysadmin by Googling - that's me! ;-)
__
/ony
-------
Monday, October 14, 2013, 5:02:19 PM, John wrote:
On 14/10/13 15:52, BitFolkList(a)tony-andersson.com
wrote:
[snip]
> Is the a prefered way to "whitelist" the e-mail sender
> yourdelivery(a)dpd.co.uk somewhow? So those emails are never sent to
> spamassasin and filtered out as spam?
How are you invoking spamassassin in the first place?
I've done this in the past by means of rules in
.procmailrc. First
check for a particular sender, then invoke spamc, then on to all the
rest of the processing.
Of course, if you're invoking the spamassassin
check on a global basis
before the mail is routed to individual users then this won't help.
I'd be intrigued to know what's so badly put
together about DPD's
e-mails that they fall foul of SA. It might be worth telling them.
John
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
6:47 p.m.
Hi Tony,
On Mon, October 14, 2013 6:49 pm, Tony Andersson wrote:
Spamassasin is called from /etc/postfix/master.cf via
a script,
/usr/local/bin/spamchk.sh
Check how the script is called in master.cf; it'll contain any arguments
that indicate what is passed e.g.
argv=<path to script>/spamchk.sh -f ${sender} ${recipient}
In the script you can then check for ${sender} (by examining $1) and exit
prematurely (and positively) if the address matches your DPD source.
Ideally I'd like to set some known
and supported parameter in the spamc.conf file. To make it global for
the server and make sure it is in a place where I am likely to find it
I'd be surprised if there was such a configuration as spamc's job is to
submit a message for spam checking. To then abandon that check reflects
that it shouldn't have been called in the first place.
I'd echo the suggestion of finding out why the e-mails are being
incorrectly marked as making manually exceptions isn't ideal.
Mathew
15 Oct
15 Oct
7:48 a.m.
Not sure if the list allows for attachments, if so one example is
attached, and its corresponding headers.
Looking at the spam classification in the headers:-
* -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
* trust
* [65.55.34.153 listed in list.dnswl.org]
* -0.0 SPF_PASS SPF: sender matches SPF record
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
* 2.0 MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required MIME
* headers
It seems the biggest single error is that there's no MIME Content-Type
specified. Second one is that there's no reverse DNS.
No dnswl trust in sender does not help either.
The first two errors might be because the message is forwarded from
hotmail to my domain. Maybe the white list one is as well...
I can indeed change the spamchk.sh script, but first I wanted to be
sure there's no recommended standardised way of creating this type of
local white list. :-)
Cheers,
__
/ony
-------
Monday, October 14, 2013, 7:47:20 PM, Mathew wrote:
Hi Tony,
On Mon, October 14, 2013 6:49 pm, Tony Andersson
wrote:
> Spamassasin is called from /etc/postfix/master.cf
via a script,
> /usr/local/bin/spamchk.sh
Check how the script is called in master.cf; it'll
contain any arguments
that indicate what is passed e.g.
argv=<path to script>/spamchk.sh -f ${sender}
${recipient}
In the script you can then check for ${sender} (by
examining $1) and exit
prematurely (and positively) if the address matches your DPD source.
> Ideally I'd like to set some known
> and supported parameter in the spamc.conf file. To make it global for
> the server and make sure it is in a place where I am likely to find it
I'd be surprised if there was such a configuration
as spamc's job is to
submit a message for spam checking. To then abandon that check reflects
that it shouldn't have been called in the first place.
I'd echo the suggestion of finding out why the
e-mails are being
incorrectly marked as making manually exceptions isn't ideal.
Mathew
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
8:01 a.m.
Whilst it's cheating a bit you could always try increasing your spam
threshold to 5 as you may find it works around the problem without any
unwanted side-effects as 'real' spam all too often scores way higher.
This may prove more reliable than letting messages through based on the
source address as courier firms are commonly spoofed to send malware
disguised as delivery notices.
Mathew
On Tue, October 15, 2013 8:48 am, Tony Andersson wrote:
Not sure if the list allows for attachments, if so
one example is
attached, and its corresponding headers.
Looking at the spam classification in the headers:-
* -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
* trust
* [65.55.34.153 listed in list.dnswl.org]
* -0.0 SPF_PASS SPF: sender matches SPF record
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
* 2.0 MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required MIME
* headers
8:04 a.m.
Actually, I've just checked your sample headers attachment and see that
the threshold is set to 5 already so howcome you are seeing them marked as
spam? Are you sure you've picked a representative sample?
Mathew
On Tue, October 15, 2013 9:01 am, Mathew Newton wrote:
Whilst it's cheating a bit you could always try
increasing your spam
threshold to 5 as you may find it works around the problem without any
unwanted side-effects as 'real' spam all too often scores way higher.
This may prove more reliable than letting messages through based on the
source address as courier firms are commonly spoofed to send malware
disguised as delivery notices.
Mathew
On Tue, October 15, 2013 8:48 am, Tony Andersson wrote:
Not sure if the list allows for attachments, if
so one example is
attached, and its corresponding headers.
Looking at the spam classification in the headers:-
* -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/,
no
* trust
* [65.55.34.153 listed in list.dnswl.org]
* -0.0 SPF_PASS SPF: sender matches SPF record
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
* 2.0 MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required
MIME
* headers
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
8:19 a.m.
Am indeed. :-) My local policy is set to 4, the classification header
you see in there is what BitFolk's spamd has set as a threshold. The
local spam handler here reads the score, not the classification.
__
/ony
-------
Tuesday, October 15, 2013, 9:04:46 AM, Mathew wrote:
Actually, I've just checked your sample headers
attachment and see that
the threshold is set to 5 already so howcome you are seeing them marked as
spam? Are you sure you've picked a representative sample?
Mathew
> On Tue, October 15, 2013 9:01 am, Mathew Newton wrote:
>> Whilst it's cheating a bit you could always try increasing your spam
>> threshold to 5 as you may find it works around the problem without any
>> unwanted side-effects as 'real' spam all too often scores way higher.
>>
>> This may prove more reliable than letting messages through based on the
>> source address as courier firms are commonly spoofed to send malware
>> disguised as delivery notices.
>>
> Mathew
>>
>> On Tue, October 15, 2013 8:48 am, Tony Andersson wrote:
>>> Not sure if the list allows for attachments, if so one example is
>>> attached, and its corresponding headers.
>>>
>>> Looking at the spam classification in the headers:-
>>> * -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/,
>>> no
>>> * trust
>>> * [65.55.34.153 listed in list.dnswl.org]
>>> * -0.0 SPF_PASS SPF: sender matches SPF record
>>> * 0.0 HTML_MESSAGE BODY: HTML included in message
>>> * 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
>>> * 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
>>> * 2.0 MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required
>>> MIME
>>> * headers
>>
>>
>>
>> _______________________________________________
>> users mailing list
>> users(a)lists.bitfolk.com
>> https://lists.bitfolk.com/mailman/listinfo/users
>>
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
8:16 a.m.
The default was 5, and I lowered it to 4 because too much spam went
through. :-) (Mainly because I have inherited a couple of domains that
had no spam control at all for years. They are now set up with spf and
some restrictions on the receiving end for the sender domain . Amazing
how little spam makes it through just with those basic checks!)
Not overly concerned about malware. That we can handle here with
common sense and antivirus software. (Probably should not say that!
Touch wood)
It is interesting that spamd classifies this as non-whitelisted, whilst
the mail server must be classifying this as non-blacklisted since it
is reaching me. The mail server is doing all sorts of checks before
accepting the incoming mail, and clearly the DPD mail passes all that.
But then again, maybe that is because it is forwarded from Hotmail...
Anyway, thanks for the suggestions! I'll go ahead and create my own white
list configuration.
Cheers,
__
/ony
-------
Tuesday, October 15, 2013, 9:01:41 AM, Mathew wrote:
Whilst it's cheating a bit you could always try
increasing your spam
threshold to 5 as you may find it works around the problem without any
unwanted side-effects as 'real' spam all too often scores way higher.
This may prove more reliable than letting messages
through based on the
source address as courier firms are commonly spoofed to send malware
disguised as delivery notices.
Mathew
On Tue, October 15, 2013 8:48 am, Tony Andersson
wrote:
> Not sure if the list allows for attachments, if so one example is
> attached, and its corresponding headers.
>
> Looking at the spam classification in the headers:-
> * -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
> * trust
> * [65.55.34.153 listed in list.dnswl.org]
> * -0.0 SPF_PASS SPF: sender matches SPF record
> * 0.0 HTML_MESSAGE BODY: HTML included in message
> * 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
> * 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
> * 2.0 MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required MIME
> * headers
_______________________________________________
users mailing list
users(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/users
3846
days inactive
3847
days old
8 comments
4 participants
participants (4)
-
BitFolkList＠tony-andersson.com -
John Winters -
Mathew Newton -
Tony Andersson