Re: Rule to detect non-standard headers that aren't X- prefixed

On 2022-05-10 at 20:20:14 UTC-0400 (Tue, 10 May 2022 18:20:14 -0600) Philip Prindeville is rumored to have said: On May 10, 2022, at 5:57 PM, Martin Gregorie wrote: On Tue, 2022-05-10 at 17:29 -0600, Philip Prindeville wrote: You're correct that they're different in every message

Unsubscribe

On May 10, 2022, at 9:16 PM, Bill Cole wrote: On 2022-05-10 at 18:10:23 UTC-0400 (Tue, 10 May 2022 16:10:23 -0600) Philip Prindeville is rumored to have said: > Anyone have a rule to detect the following nonsense headers seen in this > message I got? No, and complicating your

Re: Rule to detect non-standard headers that aren't X- prefixed

On 2022-05-10 at 18:10:23 UTC-0400 (Tue, 10 May 2022 16:10:23 -0600) Philip Prindeville is rumored to have said: Anyone have a rule to detect the following nonsense headers seen in this message I got? No, and complicating your circumstance: RFC6648 Here's the title & abstract:

Re: Rule to detect non-standard headers that aren't X- prefixed

Minicomputers-Exhume: sides Malthus-Films: 88976dea Parasitic-Homogeneity: db5da28ba3e69a Capitalizations-Grievously: oilers It looks like the pattern is /[A-Z][a-z]{1,20}-[A-Z][a-z]{1.20}\:\s{1,10}[\w\d]{3,20}/ or something close to that. Obviously it can mutate, but generally these are

Re: Rule to detect non-standard headers that aren't X- prefixed

> On May 10, 2022, at 5:57 PM, Martin Gregorie wrote: > > On Tue, 2022-05-10 at 17:29 -0600, Philip Prindeville wrote: >> >> You're correct that they're different in every message received. >> > So write a rule that fires on any header name that *doesn't* match > anything in the list of

Re: Rule to detect non-standard headers that aren't X- prefixed

> On May 10, 2022, at 5:57 PM, Martin Gregorie wrote: > > On Tue, 2022-05-10 at 17:29 -0600, Philip Prindeville wrote: >> >> You're correct that they're different in every message received. >> > So write a rule that fires on any header name that *doesn't* match > anything in the list of

Re: Rule to detect non-standard headers that aren't X- prefixed

On Tue, 2022-05-10 at 17:29 -0600, Philip Prindeville wrote: > > You're correct that they're different in every message received. > So write a rule that fires on any header name that *doesn't* match anything in the list of legit headers as defined in the relevant RFCs. Of course you may need to

Re: Rule to detect non-standard headers that aren't X- prefixed

> On May 10, 2022, at 4:58 PM, Kevin A. McGrail wrote: > > On 5/10/2022 6:10 PM, Philip Prindeville wrote: >> Anyone have a rule to detect the following nonsense headers seen in this >> message I got? > > Interesting. Those look more like something that Bayesian learning would be > best to

Re: DMARC fails for valid record?

I believe this is a bug and fixed in trunk. On 5/10/2022 1:55 PM, Bill Cole wrote: Looks like a bug. It should not be possible to hit DKIM_VALID_AU and also DMARC_REJECT and/or KAM_DMARC_REJECT -- Kevin A. McGrail kmcgr...@apache.org Member, Apache Software Foundation Chair Emeritus Apache

Re: Rule to detect non-standard headers that aren't X- prefixed

On 5/10/2022 6:10 PM, Philip Prindeville wrote: Anyone have a rule to detect the following nonsense headers seen in this message I got? Interesting. Those look more like something that Bayesian learning would be best to handle. But, have you built a corpora of spam and ham?  Do a list of

Re: DMARC fails for valid record?

On 2022-05-10 20:39, Matus UHLAR - fantomas wrote: On Monday, May 9th, 2022 at 20:35, Alex wrote: I'm trying to understand why this email from a bank fails DMARC when mxlookup says the DMARC record is just fine. https://pastebin.com/0T4Gjn3v * 1.8 DMARC_REJECT DMARC reject policy * 6.0

Rule to detect non-standard headers that aren't X- prefixed

Anyone have a rule to detect the following nonsense headers seen in this message I got? Return-Path: Received: from cp24.deluxehosting.com (cp24.deluxehosting.com [207.55.244.13]) by mail (envelope-sender ) (MIMEDefang) with ESMTP id 23C2ch8H717309 for ; Mon, 11 Apr 2022

Re: DMARC fails for valid record?

On Monday, May 9th, 2022 at 20:35, Alex wrote: I'm trying to understand why this email from a bank fails DMARC when mxlookup says the DMARC record is just fine. https://pastebin.com/0T4Gjn3v * 1.8 DMARC_REJECT DMARC reject policy * 6.0 KAM_DMARC_REJECT DKIM has Failed or SPF has failed on

Re: DMARC fails for valid record?

On 2022-05-09 at 14:35:58 UTC-0400 (Mon, 9 May 2022 14:35:58 -0400) Alex is rumored to have said: > Hi, > > I'm trying to understand why this email from a bank fails DMARC when > mxlookup says the DMARC record is just fine. > > https://pastebin.com/0T4Gjn3v > > * 1.8 DMARC_REJECT DMARC reject

Re: DMARC fails for valid record?

On 2022-05-09 at 17:28:59 UTC-0400 (Mon, 09 May 2022 21:28:59 +) Laurent S. <110ef9e3086d8405c2929e34be5b4...@protonmail.ch> is rumored to have said: > On Monday, May 9th, 2022 at 20:35, Alex wrote: > > >> I'm trying to understand why this email from a bank fails DMARC when >> mxlookup says