Hi, On Mon, Apr 24, 2017 at 11:43 PM, Bill Cole <[email protected]> wrote: > On 24 Apr 2017, at 21:35, Alex wrote: > >> Hi, >> >>>> Hi, this rule hit a citibank.com email. Adding 1.8 points simply for >>>> the phrase "your account security" does not seem reasonable. >>>> >>>> Apr 24 20:13:18.660 [28524] dbg: rules: ran body rule TVD_PH_SEC >>>> ======> got hit: "your account security" >>> >>> >>> What *else* hit? What was the final total score? >> >> >> It also hit a secondary RBL for an IP that it shouldn't have, as well >> as bayes00 and hostkarma_bl, totaling 5.044, making it spam. The IP >> that was hit was 52.40.63.1, mta1b3.c1-t.msyscloud.com. > > > Umm... > > # host 1.63.40.52.hostkarma.junkemailfilter.com > 1.63.40.52.hostkarma.junkemailfilter.com has address 127.0.1.1 > > # host mta1b3.c1-t.msyscloud.com.hostkarma.junkemailfilter.com > mta1b3.c1-t.msyscloud.com.hostkarma.junkemailfilter.com has address > 127.0.2.3 > mta1b3.c1-t.msyscloud.com.hostkarma.junkemailfilter.com has address > 127.0.1.1 > > You probably should not be treating those "experimental" result codes as > derogatory. 127.0.1.1 seems to be an assertion that the IP behaves in a > formally correct manner and 127.0.2.3 seems to mean that it's been sending > mail for over a week. These are both GOOD things.
Yes, I said it was for an IP that shouldn't have hit hostkarma_bl. When this email was received on Apr 15th, it also hit hostkarma_bl. It's apparently been corrected. * 1.0 RCVD_IN_HOSTKARMA_BL RBL: Sender listed in HOSTKARMA-BLACK * [52.40.63.1 listed in hostkarma.junkemailfilter.com]
