On 11/06/2012 10:59 AM, Jari Fredriksson wrote:
06.11.2012 11:47, Jari Fredriksson kirjoitti:
X-Spam-Report:
* -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at
http://www.dnswl.org/, low
* trust
* [208.99.185.53 listed in list.dnswl.org]
* -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover
relay
* domain
* -0.0 SPF_PASS SPF: sender matches SPF record
* 0.0 HTML_MESSAGE BODY: HTML included in message
* -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature
from author's
* domain
* -0.0 DKIM_VERIFIED DKIM_VERIFIED
* -0.1 DKIM_VALID Message has at least one valid DKIM or DK
signature
* 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not
necessarily
* valid
* 0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format
* 1.7 AXB_XMAILER_MIMEOLE_OL_4379D AXB_XMAILER_MIMEOLE_OL_4379D
* 2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS
Outlook
* 3.1 DOS_OE_TO_MX Delivered direct to MX with OE headers
This mail seems HAM to me, but Outlook traces seem to be invalid. I do
not want to publish this at least in unmangled format, so I though some
dev might be interest to analyze it.
If so, I can send off-list the mail for an analysis. The sample is
posted from Groups.ITtoolbox.com and the recipient apparenly has
subscribed to it, as I see lots of mail from that source to him.
The recipient is my Boss, and the servers in received headers are our
company servers, so I do not publish this to everyone.
Any volunteers?
The mail now passes as HAM (4.4 points) if I re-check it with current
settings. I guess masscheck has adjusted the score of those rules
triggered by this, as this false positive has been in my HAM corpus.
This is an old version which shouldn't show up in ham unless the user
has made a point of not updating his OS
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
