Atomicorp

Security for Everyone
https://forums.atomicorp.com/

marked as spam unless whitelist

https://forums.atomicorp.com/viewtopic.php?t=2376

Page 1 of 1

marked as spam unless whitelist

Posted: Wed Jul 09, 2008 4:37 am
by cauw
Here you have a header of the messages i have problems with, it is no spam, the addresses from sender are in my whitelist at local.cf but still it is marked as spam....

Code: Select all

DomainKey-Status: no signature
Received: (qmail 28217 invoked by uid 10074); 8 Jul 2008 17:59:14 +0200
Received: from 85-119-245-7.powered-by.netdistri.be by frodo.dutchzone.be (envelope-from <unsubscribe@diditech.eu>, uid 2020) with qmail-scanner-2.02st 
 (clamdscan: 0.93.1/7660. spamassassin: 3.2.5. perlscan: 2.02st.  
 Clear:RC:1(85.119.245.7):. 
 Processed in 0.056546 secs); 08 Jul 2008 15:59:14 -0000
Received: from 85-119-245-7.powered-by.netdistri.be (HELO sam.dutchzone.be) (85.119.245.7)
  by 85-119-245-6.powered-by.netdistri.be with SMTP; 8 Jul 2008 17:59:14 +0200
Received: (qmail 24347 invoked by uid 505); 8 Jul 2008 15:59:08 -0000
Received: from nelson-computer.be by sam.dutchzone.be (envelope-from <unsubscribe@diditech.eu>, uid 101) with qmail-scanner-2.02st 
 (spamassassin: 3.2.4. perlscan: 2.02st.  
 Clear:RC:0(88.198.1.122):SA:1(7.7/4.0):. 
 Processed in 1.332636 secs); 08 Jul 2008 15:59:08 -0000
X-Spam-Status: Yes, hits=7.7 required=4.0
X-Spam-Level: +++++++
Received: from nelson-computer.be (HELO hetzner01.diditech.eu) (88.198.1.122)
  by sam.dutchzone.be with SMTP; 8 Jul 2008 15:59:07 -0000
Received: by hetzner01.diditech.eu (Postfix, from userid 33)
	id 1BDE21B200CE; Tue,  8 Jul 2008 17:59:04 +0200 (CEST)
To: robin@dutchzone.be
Subject: ****SPAM**** HIGH *  NAVIGON - don't travel without !
Date: Tue, 8 Jul 2008 17:59:04 +0200
From: noreply@diditech.eu
Message-ID: <dec3a9b4a1da90592ad315a5dffc71f2@lists.diditech.eu>
X-Priority: 3
X-Mailer: PHPMailer [version 1.73]
X-Mailer: DTDlist v1.1
X-MessageID: 30
X-ListMember: robin@dutchzone.be
Precedence: bulk
Errors-To: unsubscribe@diditech.eu
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="b1_dec3a9b4a1da90592ad315a5dffc71f2"

Posted: Wed Jul 09, 2008 8:32 am
by scott
where are you setting your whitelists at? /etc/mail/spamassassin/local.cf?

Posted: Thu Jul 10, 2008 1:11 pm
by cauw
indeed i have that whitelist in /etc/mail/spamassassin/local.cf

Posted: Fri Jul 11, 2008 8:33 am
by scott
Weird, that should work. I'd talk to the spamassassin folks about it.

Posted: Mon Jul 14, 2008 6:39 am
by cauw
I'm curious about this issue, it's not funny that things in my whitelist get in the marked spam!

Posted: Mon Jul 14, 2008 6:42 am
by breun
Did you restart SpamAssassin after modifying the configuration? Are you sure you got the syntax right?

Posted: Mon Jul 14, 2008 9:54 am
by cauw
breun wrote:Did you restart SpamAssassin after modifying the configuration? Are you sure you got the syntax right?
Yes, SA is restarted, and i'm sure the syntax is right, i have other domains working well! I've checked twice the syntax of the mailaddress that is marked as spam but no solution so far!

Posted: Mon Jul 14, 2008 10:13 am
by breun
Did you check /usr/local/psa/var/log/maillog for these messages? It should tell you what tests SpamAssassin used to determine the score for the message.

Posted: Mon Jul 14, 2008 12:10 pm
by cauw
Here you have some part of my log:

Code: Select all

Jul  6 23:36:24 sam spamd[20734]: spamd: checking message <eb2ae7ae9b1e86e4d0e00cd83a8f53e9@lists.diditrade.com> for info@web-vision.be:8
Jul  6 23:36:25 sam spamd[20734]: auto-whitelist: open of auto-whitelist file failed: locker: safe_lock: cannot create tmp lockfile /var/spool/qscan/.spamassassin/auto-whitelist.lock.sam.dutchzone.be.20734 f
or /var/spool/qscan/.spamassassin/auto-whitelist.lock: Permission denied
Jul  6 23:36:26 sam spamd[20734]: spamd: identified spam (4.2/4.0) for info@web-vision.be:8 in 1.4 seconds, 6238 bytes.
Jul  6 23:36:26 sam spamd[20734]: spamd: result: Y 4 - BAYES_50,HTML_COMMENT_SAVED_URL,HTML_IMAGE_RATIO_02,HTML_MESSAGE,PYZOR_CHECK,SPF_PASS scantime=1.4,size=6238,user=info@web-vision.be,uid=8,required_scor
e=4.0,rhost=sam.dutchzone.be,raddr=127.0.0.1,rport=60648,mid=<eb2ae7ae9b1e86e4d0e00cd83a8f53e9@lists.diditrade.com>,bayes=0.500473,autolearn=spam
Jul  6 23:36:26 sam qmail-scanner[351]: Clear:RC:0(88.198.1.122):SA:1(4.2/4.0): 1.457312 6197 unsubscribe@diditech.eu info@web-vision.be ICYBOX_-_Summer <eb2ae7ae9b1e86e4d0e00cd83a8f53e9@lists.diditrade.com>
 1215380184.353-1.sam.dutchzone.be:4918 orig-sam.dutchzone.be1215380184791351:6197 1215380184.353-0.sam.dutchzone.be:296
Jul  6 23:37:44 sam spamd[20734]: spamd: checking message <a7c7baad1e4beaaaeff94a64f7bcf4eb@lists.diditrade.com> for robin@dutchzone.be:8
Jul  6 23:37:45 sam spamd[20734]: auto-whitelist: open of auto-whitelist file failed: locker: safe_lock: cannot create tmp lockfile /var/spool/qscan/.spamassassin/auto-whitelist.lock.sam.dutchzone.be.20734 f
or /var/spool/qscan/.spamassassin/auto-whitelist.lock: Permission denied
Jul  6 23:37:46 sam spamd[20734]: spamd: identified spam (7.7/4.0) for robin@dutchzone.be:8 in 1.3 seconds, 6238 bytes.
Jul  6 23:37:46 sam spamd[20734]: spamd: result: Y 7 - BAYES_99,HTML_COMMENT_SAVED_URL,HTML_IMAGE_RATIO_02,HTML_MESSAGE,PYZOR_CHECK,SPF_PASS scantime=1.3,size=6238,user=robin@dutchzone.be,uid=8,required_scor
e=4.0,rhost=sam.dutchzone.be,raddr=127.0.0.1,rport=60654,mid=<a7c7baad1e4beaaaeff94a64f7bcf4eb@lists.diditrade.com>,bayes=1.000000,autolearn=spam
Jul  6 23:37:46 sam qmail-scanner[386]: Clear:RC:0(88.198.1.122):SA:1(7.7/4.0): 1.332253 6197 unsubscribe@diditech.eu robin@dutchzone.be ICYBOX_-_Summer <a7c7baad1e4beaaaeff94a64f7bcf4eb@lists.diditrade.com>

Posted: Mon Jul 28, 2008 8:10 am
by cauw
and still having this problem, is there any way to solve this?

Posted: Mon Jul 28, 2008 10:08 am
by scott
BAYES_99,HTML_COMMENT_SAVED_URL,HTML_IMAGE_RATIO_02,HTML_MESSAGE,PYZOR_CHECK,SPF_PASS

This means that the Pyzor network, and the Bayesian classifier on your system are tagging your mail as spam. Thats pretty bad, if pyzor is tagging it then that means everyone in the world that uses pyzor would tag your mail as spam too.

Posted: Thu Aug 07, 2008 6:11 pm
by cauw
scott wrote:BAYES_99,HTML_COMMENT_SAVED_URL,HTML_IMAGE_RATIO_02,HTML_MESSAGE,PYZOR_CHECK,SPF_PASS

This means that the Pyzor network, and the Bayesian classifier on your system are tagging your mail as spam. Thats pretty bad, if pyzor is tagging it then that means everyone in the world that uses pyzor would tag your mail as spam too.
And is there a way how to solve this?
And it is not my own mailaddress but from a company we are working with that is marked as spam...

Posted: Thu Aug 07, 2008 6:22 pm
by scott
well they've been tagged by Pyzor, so no. The whole world (or at least the pyzor using parts) are tagging their mail. Its not just you.
All times are UTC-04:00
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited