Hi,
A user [[email protected]] sends an e-mail [to
[email protected]] and receives an autoreply. Sending out
the e-mail adds the address to the autowhitelist if it wasn't already
there however the autoreply is marked as spam. Why?
>From ASSP's web interface > Whitelist test page:
[email protected],[email protected]
personal Whitelisted
[email protected] Whitelisted
Relevant part of maillog.txt:
Dec-21-16 14:04:32 m1-25472-10631 [Worker_2] 172.21.135.10
<[email protected]> info: found message size announcement:
14.76 kByte
Dec-21-16 14:04:32 [Worker_2]
[email protected],[email protected]
matches @euromar.at in whiteListedDomains
Dec-21-16 14:04:33 m1-25472-10631 [Worker_2] [MessageOK] 172.21.135.10
<[email protected]> to: [email protected]
message ok - (whiteListedDomains '@euromar.at') - [Re: DFSU278391-1
off-hire at CZPQEM] ->
/usr/share/assp/notspam/Re_DFSU278391-1_off-hire_at_CZPQEM--245053.mht
Dec-21-16 14:04:33 m1-25473-07170 [Worker_2] 81.189.127.194 info: found
message size announcement: 5.86 kByte
Dec-21-16 14:04:33 m1-25473-07170 [Worker_2] [isbounce] 81.189.127.194
bounce message detected
Dec-21-16 14:04:34 m1-25473-07170 [Worker_2] 81.189.127.194 to:
[email protected] info: found known good HELO
'mail.sbd.co.at' - weight is -2
Dec-21-16 14:04:34 m1-25473-07170 [Worker_2] 81.189.127.194 to:
[email protected] Message-Score: added -40 for
KnownGoodHelo, total score for this message is now -40
Dec-21-16 14:04:34 m1-25473-07170 [Worker_2] 81.189.127.194 to:
[email protected] [scoring] SPF: none (cache)
ip=81.189.127.194 [email protected] helo=mail.sbd.co.at
Dec-21-16 14:04:34 [Worker_2] Info: SenderBase found unknown Key and
Value: '56'=>'200' in DNS answer for '81.189.127.194' - please inform the
developement
Dec-21-16 14:04:34 [Worker_2] Info: SenderBase found unknown Key and
Value: '57'=>'1482210780' in DNS answer for '81.189.127.194' - please
inform the developement
Dec-21-16 14:04:34 m1-25473-07170 [Worker_2] 81.189.127.194 to:
[email protected] Message-Score: added -15 (pbwValencePB)
for In Penalty White Box, total score for this message is now -55
Dec-21-16 14:04:34 m1-25473-07170 [Worker_2] 81.189.127.194 to:
[email protected] Bayesian Check - Prob: 1.00000 -
Confidence: 0.00000 => doubtful.spam - answer/query relation: 100% of 156
Dec-21-16 14:04:34 m1-25473-07170 [Worker_2] 81.189.127.194 to:
[email protected] Message-Score: added 24 for Bayesian
Probability: 1.00000, total score for this message is now -31
Dec-21-16 14:04:34 m1-25473-07170 [Worker_2] [Bayesian][testmode]
81.189.127.194 to: [email protected] [spam found] and
possibly passing because testmode, otherwise blocked (Bayesian)
[Automatische Antwort: DFSU278391-1 off-hire at CZPQEM]
Dec-21-16 14:04:34 m1-25473-07170 [Worker_2] 81.189.127.194 to:
[email protected] spam found and passing [Automatische
Antwort: DFSU278391-1 off-hire at CZPQEM]
Dec-21-16 14:04:34 m1-25473-07170 [Worker_2] 81.189.127.194 to:
[email protected] [Plugin] calling plugin ASSP_Razor
I see a couple of things in the log that are interesting:
The remote domain is whitelisted.
I need to 'inform the development' which I considered to have done at this
point ;)
euromar.at resolves to 81.189.127.194 which resolves back to
mail.sbd.co.at which is not whitelisted.
The autoreply is not archived (we're using the ASSP_ARC Plugin to archive
ALL incoming and outgoing mail before it is processed).
Questions:
Should I whitelist sbd.co.at?
Why is the autoreply not archived?
Running ASSP version 2.5.1(16177) on Debian 8 (latest stable).
Thanks!
Martin
------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today.http://sdm.link/intel
_______________________________________________
Assp-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-user
