Re: [qmailtoaster] if cc'd then marked as spam

[Brent Gardner]

On 06/07/2013 10:20 AM, Jim Shupert wrote:
in effort to resolve
I am think about trying the following

in my /etc/mail/spamassassin/local.cf
i add
score FRT_PRICE 0

should I
 Test by running

   # sudo -u vpopmail -H spamassassin -D --lint

then do a
                svc -d /var/qmail/supervise/spamd 
/var/qmail/supervise/spamd/log
                svc -t /var/qmail/supervise/spamd 
/var/qmail/supervise/spamd/log
                svc -u /var/qmail/supervise/spamd 
/var/qmail/supervise/spamd/log

to stop & start

and a

   # qmailctl stop
   # qmailctl start

reckon I am wonder what others might make of my plan


On 6/6/2013 3:36 PM, Jim Shupert wrote:
I have an odd matterwhere mail seems to be marked as spam that should 
not.
and this has been observed to happen with Only 1 user.
allow me to try to explain.
if a person within my domain ( myUserA) , a valid usr corresponds 
with someone outside (outsideUser )
and they send several emails back and forth ( all is well at this 
point ) but then myUserA will send to the outsideUser and cc a second 
user in my domain ( myUserB)  then the email gets marked as spam ( 
***SPAM***).

It seems this oddity is tied to the account of myUserB
How can such a thing keep happening to one account?
can I "clean" something , short of deleting the account (myUserB) and 
starting over?

is theer a clue here
    *  3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
    *      [score: 1.0000]
    *  3.5 FRT_PRICE BODY: ReplaceTags: Price
    *  0.0 HTML_MESSAGE BODY: HTML included in message
    *  0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS
    * -2.3 AWL AWL: From: address is in the auto white-list
Received: from unknown (HELO outside.com) (198.63.36.143)
by sifter.pps-inc.com with SMTP; 30 May 2013 14:12:44 -0000
Received-SPF: none (sifter.pps-inc.com: domain at outside.com does 
not designate permitted sender hosts)
Received: (qmail 49745 invoked by uid 9359); 30 May 2013 14:12:40 -0000
Received: from unknown (HELO htcbs61) ([173.167.131.145])
          (envelope-sender<outsideu...@outside.com>)

=========

it seems intresting to me that we see this
    *  3.5 FRT_PRICE BODY: ReplaceTags: Price
( myUserB) real name is lastname = price

-----

does it matter that
the email is from the outside account of outsideu...@outside.com
but in the header we see Message-Id pointing to something slightly 
diffrent.
Message-ID: <6d62358e5e1b4835ae0f43c033ee3...@outsidecorporation.com>


here are 2 email examples a good & a bad

------------- a good email or NOT marked spam

Return-Path: <outsideu...@outside.com>
Delivered-To: myus...@mydom.com
Received: (qmail 21722 invoked by uid 89); 5 Jun 2013 13:03:16 -0000
Received: by simscan 1.3.1 ppid: 21715, pid: 21716, t: 1.0640s
scanners: attach: 1.3.1 clamav: 0.95.2
/m:51/d:9450 spam: 3.2.5
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on 
sifter.pps-inc.com
X-Spam-Level: ***
X-Spam-Status: No, score=3.6 required=4.0 tests=AWL,BAYES_60,FRT_PRICE,
    HTML_MESSAGE,RDNS_NONE autolearn=no version=3.2.5
Received: from unknown (HELO outside.com) (198.63.36.143)
by sifter.pps-inc.com with SMTP; 5 Jun 2013 13:03:15 -0000
Received-SPF: none (sifter.pps-inc.com: domain at outside.com does 
not designate permitted sender hosts)
Received: (qmail 10398 invoked by uid 9359); 5 Jun 2013 13:03:14 -0000
Received: from unknown (HELO htcbs61) ([173.167.131.145])
          (envelope-sender<outsideu...@outside.com>)
by 198.63.36.143 (qmail-ldap-1.03) with SMTP
for<ffleisch...@usbeefcorp.com>; 5 Jun 2013 13:03:14 -0000
From: "Janet Broline" <outsideu...@outside.com>
To: "'Preston Price'" <myus...@mydom.com>
Cc: "'Fred Fleischner'" <fflei...@usbeef.com>
References: 
<b49874ca5a074b698314d42bec2c1...@lunancorporation.com><003001ce61ec$960d6740$c22835c0$@myDom.com>
Subject: RE: BLT spots
Date: Wed, 5 Jun 2013 08:08:21 -0500
Message-ID: <9edbf437502d4cf58d9433c15d3b5...@lunancorporation.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_007E_01CE61C3.D8A82BE0"
X-Mailer: Microsoft Office Outlook 11
In-Reply-To: <003001ce61ec$960d6740$c22835c0$@myDom.com>
Thread-Index: AQKCxsDsuvQIqBE78YV3jUhRkhkFhZe+SXcQgAAEW8A=
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.6157
X-EsetId: B966E52FBAE17D69A660E57DB5B33832



----------------- a bad email or one that IS marked ***SPAM***


Return-Path: <outsideu...@outside.com>
Delivered-To: myus...@mydom.com
Received: (qmail 23296 invoked by uid 89); 30 May 2013 14:12:45 -0000
Received: by simscan 1.3.1 ppid: 23284, pid: 23289, t: 1.6524s
scanners: attach: 1.3.1 clamav: 0.95.2
/m:51/d:9450 spam: 3.2.5
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on 
sifter.pps-inc.com
X-Spam-Level: ****
X-Spam-Status: Yes, score=4.7 required=4.0 tests=AWL,BAYES_99,FRT_PRICE,
    HTML_MESSAGE,RDNS_NONE autolearn=no version=3.2.5
X-Spam-Report:
    *  3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
    *      [score: 1.0000]
    *  3.5 FRT_PRICE BODY: ReplaceTags: Price
    *  0.0 HTML_MESSAGE BODY: HTML included in message
    *  0.1 RDNS_NONE Delivered to trusted network by a host with no rDNS
    * -2.3 AWL AWL: From: address is in the auto white-list
Received: from unknown (HELO outside.com) (198.63.36.143)
by sifter.pps-inc.com with SMTP; 30 May 2013 14:12:44 -0000
Received-SPF: none (sifter.pps-inc.com: domain at outside.com does 
not designate permitted sender hosts)
Received: (qmail 49745 invoked by uid 9359); 30 May 2013 14:12:40 -0000
Received: from unknown (HELO htcbs61) ([173.167.131.145])
          (envelope-sender<outsideu...@outside.com>)
by 198.63.36.143 (qmail-ldap-1.03) with SMTP
for<dditt...@mydom.com>; 30 May 2013 14:12:40 -0000
From: "Janet Broline" <outsideu...@outside.com>
To: "'Preston Price'" <myus...@mydom.com>,
    "'Ross Currie'" <ross.cur...@conroymedi.com>,
<dtay...@mix2pix.com>
Cc: "'Dave Dittgen'" <dditt...@mydom.com>
References: 
<04ac5ac2d01939ef32c0f5ed3c016...@mail.gmail.com><006101ce5d36$60d2d4d0$22787e70$@myDom.com><c3cbe80cb44f45049fc073bc5a126...@mail.gmail.com><007301ce5d3f$08f638c0$1ae2aa40$@myDom.com>
Subject: ***SPAM*** RE: Arby's - July
Date: Thu, 30 May 2013 09:17:59 -0500
Message-ID: <6d62358e5e1b4835ae0f43c033ee3...@lunancorporation.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary="----=_NextPart_000_02AF_01CE5D16.948C7620"
X-Mailer: Microsoft Office Outlook 11
Thread-Index: AQHgRGoXSebCNIZk8UCLQi9s9N7tOAJqLbujAoW64e6Y0nLvoIAABXHg
In-Reply-To: <007301ce5d3f$08f638c0$1ae2aa40$@myDom.com>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.6157
X-Spam-Prev-Subject: RE: Arby's - July
X-EsetId: B966E52FBAE17D69A660E57DB2BA3D32


any assistance is welcomed.

thanks in advance!
jS


I'd be more concerned about the BAYES_99 hit than the FRT_PRICE.  If 
this mail is not spam then bayes shouldn't be tripping on it.

You can run these messages through the bayes training process to get the 
bayes score lowered.

You could also make a whitelist_from_rcvd entry in local.cf


Brent Gardner



---------------------------------------------------------------------
To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com
For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com