28 Mar
2022
28 Mar
'22
3:29 p.m.
I've just had a brief interchange with a small charity that uses
DigitalOcean for some of their systems. A password-change mail from
their website was binned by my exim instance, for a score of 8.8 given
to it by the Bitfolk SpamAssassin (5.0 of that for coming from Digital
Ocean).
Can anyone suggest how, if at all, I can whitelist mail from that
particular domain in my (Debian) exim4 config, given that I'm using
the Bitfolk SpamAssassin and therefore have no control over it?
Thanks,
Hugo.
--
Hugo Mills | No names... I want to remain anomalous.
hugo@... carfax.org.uk |
http://carfax.org.uk/ |
PGP: E2AB1DE4 |
28 Mar
28 Mar
3:55 p.m.
Hi,
I've just had a brief interchange with a small
charity that uses
DigitalOcean for some of their systems. A password-change mail from
their website was binned by my exim instance, for a score of 8.8 given
to it by the Bitfolk SpamAssassin (5.0 of that for coming from Digital
Ocean).
Can anyone suggest how, if at all, I can whitelist mail from that
particular domain in my (Debian) exim4 config, given that I'm using
the Bitfolk SpamAssassin and therefore have no control over it?
Do they sign their mail with DKIM?
Best wishes,
@ndy
--
andyjpb(a)ashurst.eu.org
http://www.ashurst.eu.org/
0x7EBA75FF
4:01 p.m.
On Mon, Mar 28, 2022 at 04:55:05PM +0100, Andy Bennett wrote:
Hi,
Yes:
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
valid
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
Hugo.
--
Hugo Mills | "I am the author. You are the audience. I outrank
hugo@... carfax.org.uk | you!"
http://carfax.org.uk/ | Franz Liebkind
PGP: E2AB1DE4 | The Producers
I've just had a brief interchange with a
small charity that uses
DigitalOcean for some of their systems. A password-change mail from
their website was binned by my exim instance, for a score of 8.8 given
to it by the Bitfolk SpamAssassin (5.0 of that for coming from Digital
Ocean).
Can anyone suggest how, if at all, I can whitelist mail from that
particular domain in my (Debian) exim4 config, given that I'm using
the Bitfolk SpamAssassin and therefore have no control over it?
Do they sign their mail with DKIM? 
4:18 p.m.
Hello,
On Mon, Mar 28, 2022 at 05:01:05PM +0100, Hugo Mills wrote:
On Mon, Mar 28, 2022 at 04:55:05PM +0100, Andy Bennett
wrote:
So if you want to let me know the domain name (from the From:
address) off-list then I will just add it to BitFolk's
whitelist_auth list.
A support ticket would be appropriate any time you or anyone else
wants something like that added. I will only do it for DKIM or
SPF+identifying envelope sender though.
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
Do they sign their mail with DKIM?
Yes:
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
4:24 p.m.
On Mon, Mar 28, 2022 at 04:18:28PM +0000, Andy Smith wrote:
Hello,
On Mon, Mar 28, 2022 at 05:01:05PM +0100, Hugo Mills wrote:
Thanks, Andy. Message sent off-list.
Hugo.
--
Hugo Mills | Your problem is that you've got too much taste to be
hugo@... carfax.org.uk | a web developer.
http://carfax.org.uk/ |
PGP: E2AB1DE4 | Steve Harris
On Mon, Mar 28, 2022 at 04:55:05PM +0100, Andy
Bennett wrote:
So if you want to let me know the domain name (from the From:
address) off-list then I will just add it to BitFolk's
whitelist_auth list.
A support ticket would be appropriate any time you or anyone else
wants something like that added. I will only do it for DKIM or
SPF+identifying envelope sender though. Do they sign their mail with DKIM?
Yes:
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
4:04 p.m.
Hello,
On Mon, Mar 28, 2022 at 04:29:00PM +0100, Hugo Mills wrote:
I've just had a brief interchange with a small
charity that uses
DigitalOcean for some of their systems. A password-change mail
from their website was binned by my exim instance, for a score of
8.8 given to it by the Bitfolk SpamAssassin (5.0 of that for
coming from Digital Ocean).
Does the email have a DKIM_VALID_AU report from BitFolk's
SpamAssassin? If so, I am happy to add the domain that's in the
From: address to the allowlist. This would indicate that the content
and source of the email are as intended by the domain owners.
Failing that, if it has an SPF_PASS report then I may be able to
allowlist *by envelope sender*, if the envelope sender also is
unique to them. That would indicate that the domain owner expects
emails with that envelope sender to come from that source.
As an aside, I think that even if one were to decide that mail from
Digital Ocean doesn't deserve to be scored, 3.8 points is still too
high for their email and there's probably something they could do
about that.
Can anyone suggest how, if at all, I can whitelist
mail from that
particular domain in my (Debian) exim4 config
If the email's envelope sender is unique to them, then you could add
a match for it to a file like /etc/exim4/local_sender_allowlist, and
then at the place where you consider an email's SA score you can
exempt senders that match local_sender_allowlist from consideration.
In Debian there is already in
/etc/exim4/conf.d/acl/20_exim4-config_local_deny_exceptions
machinery for checking the envelope sender against the file
CONFDIR/local_sender_whitelist so you could use or copy that
approach.
You'll probably have to look in the Received headers for the
envelope-from.
Depending upon how you have configured your Exim it may already be
checking that file before considering the SA score.
There is no way at the moment for a user to alter the way BitFolk's
SpamAssassin works so you either have to act upon its score or not.
I'm using the Bitfolk SpamAssassin and therefore
have no control
over it?
A big issue that we could possibly alleviate by somehow working out
how to do per-user SpamAssassin configuration. It's not something I
am keen to do as I would rather encourage people to run their own
anti-spam system (or sign up to a paid service that does that).
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
4:15 p.m.
On Mon, Mar 28, 2022 at 04:04:08PM +0000, Andy Smith wrote:
If the email's envelope sender is unique to them,
then you could add
a match for it to a file like /etc/exim4/local_sender_allowlist, and
then at the place where you consider an email's SA score you can
exempt senders that match local_sender_allowlist from consideration.
I should point out that if you do this, or if you do similar with
the Debian machinery for CONFDIR/local_sender_whitelist, then you
would of course be letting in any mail whose envelope sender matched
what you specified.
I personally tend not to do an allowlist based solely on sender,
instead preferring to modify the SpamAssassin config which can check
for DKIM and/or SPF to authenticate it. So that's another plus point
of running your own SpamAssassin. It's quite simple in SA, it's just
something like:
######################################################################
# Allowlisted senders with valid DKIM. This works against the From:
# header.
######################################################################
whitelist_auth *(a)bbc.co.uk
######################################################################
# Allowlisted senders with valid SPF. Note this needs to use the
# envelope sender. Instead use above whitelist_auth if mail passes
# DKIM.
######################################################################
whitelist_from_spf *(a)nanog.org
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
1032
days inactive
1032
days old
6 comments
3 participants
participants (3)
-
Andy Bennett -
Andy Smith -
Hugo Mills