did a little basic testing
New email from gmail from a whitelisted sender goes to notspam
If a whitelisted gmail user replies to one of my emails, it goes to okmail,
and shows info: found valid MSGID signature in [In-Reply-To:] - accept mail
And this makes sense now. It's right in the DoMsgIDSig
....If activated and a bounced mail from null sender or postmaster contains
no valid signature the configured action is taken.
If activated and any other mail contains a valid signature (eg. because it
is an answer/reply to a tagged mail), this mail will be flagged as
noprocessing and whitelisted !
So my question is why would we want this behavior? If I send a message and
someone replies, why wouldn't we want to add replies to notspam so their
content contributes to the corpus? I really like the rest of what
DoMsgIDsig does in terms of scoring negatively, but why noprocess replies /
put to okmail from whitelisted people?
On Sun, Jan 7, 2018 at 12:47 PM, K Post <nntp.p...@gmail.com> wrote:
> I've been having degraded bayesian and HMM results, lots of false
> positives recently, so I'm going through some mail manually in the corpus
> to do some bulk retraining. I do this periodically and find that it helps.
>
> One thing I noticed is some mail in OkMail that comes from a whitelisted @
> gmail.com address. I can't figure out why it's in OkMail and not
> notspam.
>
>
> Is this log line saying that the message became no processing because of a
> MSGID signature?? I don't understand-
> Jan-07-18 12:00:51 msg64450-01103 [Noprocessing] 209.85.215.50 <
> whitelistedgoog...@gmail.com> to: myu...@ourcharity.org info: found valid
> MSGID signature in [References:] - accept mail
>
>
> Everything else in the log, I would expect from a google SMTP server,
> no penalty box, no delaying, no blocking
> Jan-07-18 12:00:49 209.85.215.50 info: got STARTTLS request from
> 209.85.215.50
> Jan-07-18 12:00:50 msg64450-01103 209.85.215.50 <
> whitelistedgoog...@gmail.com> info: found message size announcement:
> 15.02 kByte
> Jan-07-18 12:00:50 msg64450-01103 209.85.215.50 <
> whitelistedgoog...@gmail.com> IP 209.85.215.50 matches noPB - with
> 209.85.128.0/17 FROMSPF: _netblocks.google.com
> Jan-07-18 12:00:50 msg64450-01103 209.85.215.50 <
> whitelistedgoog...@gmail.com> IP 209.85.215.50 matches noPBwhite - with
> 209.85.128.0/17 FROMSPF: _netblocks.google.com
> Jan-07-18 12:00:50 msg64450-01103 209.85.215.50 <
> whitelistedgoog...@gmail.com> IP 209.85.215.50 matches noDelay - with
> 209.85.128.0/17 FROMSPF: _netblocks.google.com
> Jan-07-18 12:00:50 msg64450-01103 209.85.215.50 <
> whitelistedgoog...@gmail.com> IP 209.85.215.50 matches noBlockingIPs -
> with 209.85.128.0/17 FROMSPF: _netblocks.google.com
> Jan-07-18 12:00:51 msg64450-01103 209.85.215.50 <
> whitelistedgoog...@gmail.com> to: myu...@ourcharity.org Whitelisted
> sender address: whitelistedgoog...@gmail.com for recipient
> myu...@ourcharity.org
> Jan-07-18 12:00:51 msg64450-01103 [Noprocessing] 209.85.215.50 <
> whitelistedgoog...@gmail.com> to: myu...@ourcharity.org info: found valid
> MSGID signature in [References:] - accept mail
> Jan-07-18 12:00:51 msg64450-01103 209.85.215.50 <
> whitelistedgoog...@gmail.com> to: myu...@ourcharity.org DKIM-Signature
> found
> Jan-07-18 12:00:51 msg64450-01103 209.85.215.50 <
> whitelistedgoog...@gmail.com> to: myu...@ourcharity.org IP 209.85.215.50
> matches noBlockingIPs - with 209.85.128.0/17 FROMSPF: _
> netblocks.google.com
> Jan-07-18 12:00:52 msg64450-01103 209.85.215.50 <
> whitelistedgoog...@gmail.com> to: myu...@ourcharity.org [Plugin] calling
> plugin ASSP_AFC
> Jan-07-18 12:00:52 msg64450-01103 209.85.215.50 <
> whitelistedgoog...@gmail.com> to: myu...@ourcharity.org message proxied
> without processing (no bad attachments)
> Jan-07-18 12:00:52 msg64450-01103 [MessageOK] 209.85.215.50 <
> whitelistedgoog...@gmail.com> to: myu...@ourcharity.org message ok -
> (noprocessing and whitelisted - found valid Message-ID signature) - [re
> subject] -> messages/okmail/re_subject--1134846.txt
> Jan-07-18 12:00:53 msg64450-01103 209.85.215.50 <
> whitelistedgoog...@gmail.com> to: myu...@ourcharity.org finished message
> - received DATA size: 15.18 kByte - sent DATA size: 15.85 kByte
> Jan-07-18 12:00:53 msg64450-01103 209.85.215.50 <
> whitelistedgoog...@gmail.com> to: myu...@ourcharity.org disconnected:
> session:3F7AE040 209.85.215.50 - processing time 4 seconds
>
>
>
> I did an analyze and don't see anything that suggests it would be no
> processing:
> • On Global Whitelist: 'whitelistedgoog...@gmail.com'
> • DKIM-check returned OK body altered - header passed - suspicious-OK
> • SPF-check returned OK for 209.85.215.50 -> whitelistedgoog...@gmail.com,
> mail-lf0-f50.google.com
> • Received-SPF: pass (gmail.com ... _spf.google.com: Sender is
> authorized to use 'whitelistedgoog...@gmail.com' in 'mfrom' identity
> (mechanism 'include:_netblocks.google.com' matched)) receiver=
> assp.ourcharity.org; identity=mailfrom; envelope-from="WhitelistedGoog
> l...@gmail.com"; helo=mail-lf0-f50.google.com; client-ip=209.85.215.50
> • URIBL check: 'OK'
> • Known Good HELO: 'mail-lf0-f50.google.com'
> • HELO Blacklist Ignore: 'mail-lf0-f50.google.com'
> • Valid Format of HELO: 'mail-lf0-f50.google.com'
> • IP in Helo check: 'OK'
> • AUTH would be disabled
> • IP 209.85.215.50 is in noPB IPs (209.85.128.0/17 FROMSPF: _
> netblocks.google.com)
> • RBLCheck returned OK for 209.85.215.50:
> • domain gmail.com (in Mail From: , From) has a valid MX record:
> gmail-smtp-in.l.google.com
> • domainMX gmail-smtp-in.l.google.com has a valid A record: 173.194.175.27
> • 209.85.215.50 PTR record via DNS: status=PTR OK -
> mail-lf0-f50.google.com
> • 209.85.215.50 SenderBase: status=not classified, data=[CN=US, ORG=DOT
> INTERNET, DOM=google.com, BLS=, HNM=Y, CIDR=17, HN=mail-lf0-f50]
> • IP 209.85.215.50 is in noDelay (209.85.128.0/17 FROMSPF: _
> netblocks.google.com)
> • IP 209.85.215.50 is in noBlockingIPs (209.85.128.0/17 FROMSPF: _
> netblocks.google.com)
>
>
> As always, any guidance would be appreciated.
>
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
