Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: SpamAssassin: users

outlook 2007 "Test" email scores 30+

 

 

SpamAssassin users RSS feed   Index | Next | Previous | View Threaded


dana.hanson at gmail

Oct 30, 2009, 2:13 PM

Post #1 of 19 (1378 views)
Permalink
outlook 2007 "Test" email scores 30+

Outlook 2007 for most of the clients under our domain are now having outgoing
emails blocked by Spam Assassin, which our ISP uses. This started in late
September (Outlook/MS update??). Simple Text emails with "hello" or "test"
get scored over 30. If I switch the users over to "windows mail" vs.
"Outlook" We have no problems but this is unacceptable, outlook is our
standard. So the question is what is Outlook 2007 doing to the outbound mail
to cause it to be scored so high with Spam Assassin. We are ready to move
our mail accounts to a different ISP!@!@ Any help is appreciated.
--
View this message in context: http://old.nabble.com/outlook-2007-%22Test%22-email-scores-30%2B-tp26136943p26136943.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.


gagel at cnc

Oct 30, 2009, 2:18 PM

Post #2 of 19 (1338 views)
Permalink
Re: outlook 2007 "Test" email scores 30+ [In reply to]

What are you doing to SpamAssassin?
Post your configuration then perhaps someone can help you.


Kevin W. Gagel
Network Administrator
Local 5448
My blog:
http://mail.cnc.bc.ca/blogs/gagel
My shared files:
http://mail.cnc.bc.ca/users/gagel



>
> --- Original message ---
> Subject: outlook 2007 "Test" email scores 30+
> From: djjmj <dana.hanson [at] gmail>
> To: <users [at] spamassassin>
> Date: Friday, 10/30/2009 2:14 PM
>
>
> Outlook 2007 for most of the clients under our domain are now having
> outgoing
> emails blocked by Spam Assassin, which our ISP uses. This started in
> late
> September (Outlook/MS update??). Simple Text emails with "hello" or
> "test"
> get scored over 30. If I switch the users over to "windows mail" vs.
> "Outlook" We have no problems but this is unacceptable, outlook is our
> standard. So the question is what is Outlook 2007 doing to the
> outbound mail
> to cause it to be scored so high with Spam Assassin. We are ready to
> move
> our mail accounts to a different ISP!@!@ Any help is appreciated.
> --
> View this message in context:
> http://old.nabble.com/outlook-2007-%22Test%22-email-scores-30%2B-tp26136943p26136943.html
> Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
>



-------------------------------------------------------------------
The College of New Caledonia
Visit us at http://www.cnc.bc.ca
Virus scanning is done on all incoming and outgoing email.
Anti-spam information for CNC can be found at http://gateway.cnc.bc.ca
-------------------------------------------------------------------


support-spamassassin at oeko

Oct 30, 2009, 2:26 PM

Post #3 of 19 (1350 views)
Permalink
Re: outlook 2007 "Test" email scores 30+ [In reply to]

Hi,

On Fri, 30.10.2009 at 14:13:45 -0700, djjmj <dana.hanson [at] gmail> wrote:
> Outlook 2007 for most of the clients under our domain are now having outgoing
> emails blocked by Spam Assassin, which our ISP uses. This started in late
> September (Outlook/MS update??). Simple Text emails with "hello" or "test"
> get scored over 30.

w/o showing an _entire_ email of this kind, there is no way telling
what the problem might be.

> outlook is our standard.

OT, but I fully agree that such "standards" should be penalized...

> So the question is what is Outlook 2007 doing to the outbound mail
> to cause it to be scored so high with Spam Assassin. We are ready to move
> our mail accounts to a different ISP!@!@

If it's really an Outlook problem, then your mails would be hanging at
different ISPs, on the receivers' ends.

Try to ask your ISP's tech support to send you debugging info on some
of your emails.


Kind regards,
--Toni++


jhardin at impsec

Oct 30, 2009, 2:33 PM

Post #4 of 19 (1354 views)
Permalink
Re: outlook 2007 "Test" email scores 30+ [In reply to]

On Fri, 30 Oct 2009, Kevin Gagel wrote:

> What are you doing to SpamAssassin?
> Post your configuration then perhaps someone can help you.

Dana may not have that information - saying "which our ISP uses" suggests
SA is not under their control.

Dana:

Does your ISP bounce the messages back to you?

If so, are there any clues in the bounce as to why the messages are
scoring so high? Or does it just say "rejected by SpamAssassin" with no
details?

You really should be discussing this with your ISP's support desk or
postmaster. There's little we can do without data that you're likely
unable to provide. If your ISP has problems correcting the problem, then
they can ask here for help and provide the technical details needed to
troubleshoot the problem.

Something you could do is go to one of the various DNSBL websites and
check whether your internet gateway's public IP address is listed. Your
ISP may be doing something as simple as treating you as J. Random User
From The Internet rather than as one of their customers.

>> --- Original message ---
>> Subject: outlook 2007 "Test" email scores 30+
>>
>> Outlook 2007 for most of the clients under our domain are now having
>> outgoing emails blocked by Spam Assassin, which our ISP uses. This
>> started in late September (Outlook/MS update??). Simple Text emails
>> with "hello" or "test" get scored over 30. If I switch the users over
>> to "windows mail" vs. "Outlook" We have no problems but this is
>> unacceptable, outlook is our standard. So the question is what is
>> Outlook 2007 doing to the outbound mail to cause it to be scored so
>> high with Spam Assassin. We are ready to move our mail accounts to a
>> different ISP!@!@ Any help is appreciated.

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...the Fates notice those who buy chainsaws...
-- www.darwinawards.com
-----------------------------------------------------------------------
Tomorrow: Halloween


dana.hanson at gmail

Oct 30, 2009, 2:47 PM

Post #5 of 19 (1353 views)
Permalink
Re: outlook 2007 "Test" email scores 30+ [In reply to]

Toni Mueller-17 wrote:
>
>
> Hi,
>
> On Fri, 30.10.2009 at 14:13:45 -0700, djjmj <dana.hanson [at] gmail> wrote:
>> Outlook 2007 for most of the clients under our domain are now having
>> outgoing
>> emails blocked by Spam Assassin, which our ISP uses. This started in
>> late
>> September (Outlook/MS update??). Simple Text emails with "hello" or
>> "test"
>> get scored over 30.
>
> w/o showing an _entire_ email of this kind, there is no way telling
> what the problem might be.
>
>> outlook is our standard.
>
> OT, but I fully agree that such "standards" should be penalized...
>
>> So the question is what is Outlook 2007 doing to the outbound mail
>> to cause it to be scored so high with Spam Assassin. We are ready to
>> move
>> our mail accounts to a different ISP!@!@
>
> If it's really an Outlook problem, then your mails would be hanging at
> different ISPs, on the receivers' ends.
>
> Try to ask your ISP's tech support to send you debugging info on some
> of your emails.
>
>
> Kind regards,
> --Toni++
>
>


11:53:31 [24.181.159.14][19038377] Authenticated as xxxx.org
11:53:31 [24.181.159.14][19038377] cmd: MAIL FROM: <xxxx.org>
11:53:31 [24.181.159.14][19038377] rsp: 250 OK <xxx.org> Sender ok
11:53:31 [24.181.159.14][19038377] cmd: RCPT TO: <xxx.org>
11:53:31 [24.181.159.14][19038377] rsp: 250 OK <xxx.org> Recipient ok
11:53:31 [24.181.159.14][19038377] cmd: RSET
11:53:31 [24.181.159.14][19038377] rsp: 250 OK
11:53:34 [24.181.159.14][19038377] cmd: RSET
11:53:34 [24.181.159.14][19038377] rsp: 250 OK
11:53:37 [24.181.159.14][19038377] cmd: MAIL FROM: <xxx.org>
11:53:37 [24.181.159.14][19038377] rsp: 250 OK <xxx.org> Sender ok
11:53:38 [24.181.159.14][19038377] cmd: RCPT TO: <xxx.org>
11:53:38 [24.181.159.14][19038377] rsp: 250 OK <xxx.org> Recipient ok
11:53:38 [24.181.159.14][19038377] cmd: DATA
11:53:43 [24.181.159.14][19038377] rsp: 250 OK
11:53:43 [24.181.159.14][19038377] Data transfer succeeded, writing mail to
119471714.eml
11:53:43 [24.181.159.14][19038377] cmd: QUIT

12:19:21 [38430] Delivery for xxx.org to xxx.com has completed (Bounced)
12:19:23 [38429] Delivery for xxx.org to xxx.com has completed (Bounced)
12:19:27 [38432] Delivery for xxx.org to xxx.com has completed (Bounced)
12:19:39 [38434] Delivery for xxx.org to xxx.com has completed (Bounced)
12:20:39 [38441] Delivery for xxx.org to xxx.com has completed (Bounced)

--
View this message in context: http://old.nabble.com/outlook-2007-%22Test%22-email-scores-30%2B-tp26136943p26137371.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.


jhardin at impsec

Oct 30, 2009, 2:53 PM

Post #6 of 19 (1349 views)
Permalink
Re: outlook 2007 "Test" email scores 30+ [In reply to]

On Fri, 30 Oct 2009, djjmj wrote:

>> Try to ask your ISP's tech support to send you debugging info on some
>> of your emails.
>
> 11:53:31 [24.181.159.14][19038377] Authenticated as xxxx.org
> 11:53:31 [24.181.159.14][19038377] cmd: MAIL FROM: <xxxx.org>
> 11:53:31 [24.181.159.14][19038377] rsp: 250 OK <xxx.org> Sender ok
> 11:53:31 [24.181.159.14][19038377] cmd: RCPT TO: <xxx.org>
> 11:53:31 [24.181.159.14][19038377] rsp: 250 OK <xxx.org> Recipient ok
> 11:53:31 [24.181.159.14][19038377] cmd: RSET
> 11:53:31 [24.181.159.14][19038377] rsp: 250 OK
> 11:53:34 [24.181.159.14][19038377] cmd: RSET
> 11:53:34 [24.181.159.14][19038377] rsp: 250 OK
> 11:53:37 [24.181.159.14][19038377] cmd: MAIL FROM: <xxx.org>
> 11:53:37 [24.181.159.14][19038377] rsp: 250 OK <xxx.org> Sender ok
> 11:53:38 [24.181.159.14][19038377] cmd: RCPT TO: <xxx.org>
> 11:53:38 [24.181.159.14][19038377] rsp: 250 OK <xxx.org> Recipient ok
> 11:53:38 [24.181.159.14][19038377] cmd: DATA
> 11:53:43 [24.181.159.14][19038377] rsp: 250 OK
> 11:53:43 [24.181.159.14][19038377] Data transfer succeeded, writing mail to
> 119471714.eml
> 11:53:43 [24.181.159.14][19038377] cmd: QUIT
>
> 12:19:21 [38430] Delivery for xxx.org to xxx.com has completed (Bounced)
> 12:19:23 [38429] Delivery for xxx.org to xxx.com has completed (Bounced)
> 12:19:27 [38432] Delivery for xxx.org to xxx.com has completed (Bounced)
> 12:19:39 [38434] Delivery for xxx.org to xxx.com has completed (Bounced)
> 12:20:39 [38441] Delivery for xxx.org to xxx.com has completed (Bounced)

Sadly that doesn't help much, apart from telling us that your ISP is
apparently doing bounces rather than SMTP-time rejects, which is not being
a good network citizen.

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...the Fates notice those who buy chainsaws...
-- www.darwinawards.com
-----------------------------------------------------------------------
Tomorrow: Halloween


dana.hanson at gmail

Oct 30, 2009, 2:58 PM

Post #7 of 19 (1355 views)
Permalink
Re: outlook 2007 "Test" email scores 30+ [In reply to]

John Hardin wrote:
>
> On Fri, 30 Oct 2009, Kevin Gagel wrote:
>
>> What are you doing to SpamAssassin?
>> Post your configuration then perhaps someone can help you.
>
>>>Dana may not have that information - saying "which our ISP uses" suggests
>>>SA is not under their control.
>
> Correct SA is not under our control, just trying to find an answer to our
> problem.
>
>>>Dana:
>
>>>Does your ISP bounce the messages back to you?
> No we don't get the bounced message returned, no notification until
> receiving user expecting something calls complaining.
>
>>>If so, are there any clues in the bounce as to why the messages are
> scoring so high? Or does it just say "rejected by SpamAssassin" with no
> details?
>
>>>You really should be discussing this with your ISP's support desk or
> postmaster. There's little we can do without data that you're likely
> unable to provide. If your ISP has problems correcting the problem, then
> they can ask here for help and provide the technical details needed to
> troubleshoot the problem.
>
> We have been discussing with them since Sept 17th with no fixes yet. Once
> they found out
> Windows Mail Client didn't have an issue they have been unwilling to help.
> "Not a server side problem, your clients are the problem"
>
> <Correct SA is not under our control, just trying to find an answer to our
> problem.
>
>>>Something you could do is go to one of the various DNSBL websites and
> check whether your internet gateway's public IP address is listed. Your
> ISP may be doing something as simple as treating you as J. Random User
> From The Internet rather than as one of their customers.
> I requested this information from the ISP last week. There response was
> "our or your" domain are not black listed. Maybe I'm misunderstanding your
> ?
>
>>> --- Original message ---
>>> Subject: outlook 2007 "Test" email scores 30+
>>>
>>> Outlook 2007 for most of the clients under our domain are now having
>>> outgoing emails blocked by Spam Assassin, which our ISP uses. This
>>> started in late September (Outlook/MS update??). Simple Text emails
>>> with "hello" or "test" get scored over 30. If I switch the users over
>>> to "windows mail" vs. "Outlook" We have no problems but this is
>>> unacceptable, outlook is our standard. So the question is what is
>>> Outlook 2007 doing to the outbound mail to cause it to be scored so
>>> high with Spam Assassin. We are ready to move our mail accounts to a
>>> different ISP!@!@ Any help is appreciated.
>
> --
> John Hardin KA7OHZ http://www.impsec.org/~jhardin/
> jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
> key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
> -----------------------------------------------------------------------
> ...the Fates notice those who buy chainsaws...
> -- www.darwinawards.com
> -----------------------------------------------------------------------
> Tomorrow: Halloween
>
>

--
View this message in context: http://old.nabble.com/Re%3A-outlook-2007-%22Test%22-email-scores-30%2B-tp26137005p26137481.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.


dana.hanson at gmail

Oct 30, 2009, 3:09 PM

Post #8 of 19 (1350 views)
Permalink
Re: outlook 2007 "Test" email scores 30+ [In reply to]

John,

Thank you for your interest and support. I will keep pushing our ISP to use
this forum for a resolution.



John Hardin wrote:
>
> On Fri, 30 Oct 2009, djjmj wrote:
>
>>> Try to ask your ISP's tech support to send you debugging info on some
>>> of your emails.
>>
>> 11:53:31 [24.181.159.14][19038377] Authenticated as xxxx.org
>> 11:53:31 [24.181.159.14][19038377] cmd: MAIL FROM: <xxxx.org>
>> 11:53:31 [24.181.159.14][19038377] rsp: 250 OK <xxx.org> Sender ok
>> 11:53:31 [24.181.159.14][19038377] cmd: RCPT TO: <xxx.org>
>> 11:53:31 [24.181.159.14][19038377] rsp: 250 OK <xxx.org> Recipient ok
>> 11:53:31 [24.181.159.14][19038377] cmd: RSET
>> 11:53:31 [24.181.159.14][19038377] rsp: 250 OK
>> 11:53:34 [24.181.159.14][19038377] cmd: RSET
>> 11:53:34 [24.181.159.14][19038377] rsp: 250 OK
>> 11:53:37 [24.181.159.14][19038377] cmd: MAIL FROM: <xxx.org>
>> 11:53:37 [24.181.159.14][19038377] rsp: 250 OK <xxx.org> Sender ok
>> 11:53:38 [24.181.159.14][19038377] cmd: RCPT TO: <xxx.org>
>> 11:53:38 [24.181.159.14][19038377] rsp: 250 OK <xxx.org> Recipient ok
>> 11:53:38 [24.181.159.14][19038377] cmd: DATA
>> 11:53:43 [24.181.159.14][19038377] rsp: 250 OK
>> 11:53:43 [24.181.159.14][19038377] Data transfer succeeded, writing mail
>> to
>> 119471714.eml
>> 11:53:43 [24.181.159.14][19038377] cmd: QUIT
>>
>> 12:19:21 [38430] Delivery for xxx.org to xxx.com has completed (Bounced)
>> 12:19:23 [38429] Delivery for xxx.org to xxx.com has completed (Bounced)
>> 12:19:27 [38432] Delivery for xxx.org to xxx.com has completed (Bounced)
>> 12:19:39 [38434] Delivery for xxx.org to xxx.com has completed (Bounced)
>> 12:20:39 [38441] Delivery for xxx.org to xxx.com has completed (Bounced)
>
> Sadly that doesn't help much, apart from telling us that your ISP is
> apparently doing bounces rather than SMTP-time rejects, which is not being
> a good network citizen.
>
> --
> John Hardin KA7OHZ http://www.impsec.org/~jhardin/
> jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
> key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
> -----------------------------------------------------------------------
> ...the Fates notice those who buy chainsaws...
> -- www.darwinawards.com
> -----------------------------------------------------------------------
> Tomorrow: Halloween
>
>

--
View this message in context: http://old.nabble.com/outlook-2007-%22Test%22-email-scores-30%2B-tp26136943p26137585.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.


kremels at kreme

Oct 30, 2009, 3:27 PM

Post #9 of 19 (1348 views)
Permalink
Re: outlook 2007 "Test" email scores 30+ [In reply to]

On Oct 30, 2009, at 3:13 PM, djjmj wrote:
> Outlook 2007 for most of the clients under our domain are now having
> outgoing
> emails blocked by Spam Assassin,

No they aren't. First, SpamAssassin doesn't block mail, ever. Second,
SpamAssassin doesn't generally scan outbound mail. Your ISP has
majority screwed a pooch, and that has nothing to do with SpamAssassin.

> (Outlook/MS update??). Simple Text emails with "hello" or "test"
> get scored over 30.

Well, they are from LookOut clients, so spam probability seems very
hog to me :p

> So the question is what is Outlook 2007 doing to the outbound mail
> to cause it to be scored so high with Spam Assassin.

Probably your ISP has some extremely poorly written and badly
implemented and completely urn-thought-out custom rules that are
screwing things up.

> We are ready to move our mail accounts to a different ISP!

Sounds like a great idea to me.


kdeugau at vianet

Oct 30, 2009, 3:30 PM

Post #10 of 19 (1364 views)
Permalink
Re: outlook 2007 "Test" email scores 30+ [In reply to]

djjmj wrote:
> We have been discussing with them since Sept 17th with no fixes yet. Once
> they found out
> Windows Mail Client didn't have an issue they have been unwilling to help.
> "Not a server side problem, your clients are the problem"

Then tell them you're walking as soon as you find another provider. I'd
be quite happy as a mail/spamfilter admin if Outlook ceased to exist,
but it's easily second or third place in mail client popularity.
(Outlook Express/Windows Mail is in first; Thunderbird is the other
player in the top three, IMO.) MS Outlook is a common enough mail
client... and preferred by *business* customers in a high enough
percentage... that not supporting it is downright stupid on their part.

Try enabling SMTP authentication, and possibly switching the outbound
port to 587 from the default 25; most ISPs these days offer some form
of authenticated outbound relay that provides some buffer against
overscoring in SA. TBH SA scores of 30+ sound like they've just bumped
the score on a couple of rules that target forged Outlook mail, without
considering the impact on legitimate relay traffic.

> John Hardin wrote:
>> Something you could do is go to one of the various DNSBL websites and
>> check whether your internet gateway's public IP address is listed. Your
>> ISP may be doing something as simple as treating you as J. Random User
>> From The Internet rather than as one of their customers.

> I requested this information from the ISP last week. There response was
> "our or your" domain are not black listed. Maybe I'm misunderstanding your
> ?

Yes, you've misunderstood. John's question was about the IP address you
get on your connection; visiting ipchicken.com (among other
possibilities) should tell you what IP your mail is apparently coming
"from".

Your ISP may have mangled their SA config (or just not bothered
configuring it properly in the first place) such that parts of their own
network used for customer connections aren't being properly bypassed or
handled by SA's network tests (among other things).

Is there any other pattern in the messages that are blocked? (eg only
really short messages, messages with the word "foobar" in the first
paragraph, messages with more than five cute-kitten-pictures attached, etc)

(Just for the record, I've seen more and more filtering systems in
general pick up on short test messages for no reason I can see - Postini
is the big culprit in the mail flow I deal with so far, but I've had
occasional reports where other filter systems are involved. Bleaugh.)

-kgd


jhardin at impsec

Oct 30, 2009, 3:51 PM

Post #11 of 19 (1349 views)
Permalink
Re: outlook 2007 "Test" email scores 30+ [In reply to]

On Fri, 30 Oct 2009, djjmj wrote:

> John Hardin wrote:
>>
> Dana may not have that information - saying "which our ISP uses" suggests
>> SA is not under their control.
>
> Correct SA is not under our control, just trying to find an answer to our
> problem.

>> Dana:
>>
>> Does your ISP bounce the messages back to you?
>
> No we don't get the bounced message returned, no notification until
> receiving user expecting something calls complaining.

Okay. At least they aren't causing backscatter.

>> You really should be discussing this with your ISP's support desk or
>> postmaster. There's little we can do without data that you're likely
>> unable to provide. If your ISP has problems correcting the problem,
>> then they can ask here for help and provide the technical details
>> needed to troubleshoot the problem.
>
> We have been discussing with them since Sept 17th with no fixes yet.
> Once they found out Windows Mail Client didn't have an issue they have
> been unwilling to help. "Not a server side problem, your clients are the
> problem"

Bummer. Will they even go look in the logs and see _why_ the messages are
being discarded?

>> Something you could do is go to one of the various DNSBL websites and
>> check whether your internet gateway's public IP address is listed. Your
>> ISP may be doing something as simple as treating you as J. Random User
>> From The Internet rather than as one of their customers.
>
> I requested this information from the ISP last week. There response was
> "our or your" domain are not black listed. Maybe I'm misunderstanding
> your ?

Expanded format:

Your connection to the Internet has an IP address.

When your ISP receives email from you, it comes from that IP address.

They _should_ have their mail system configured to say "that IP address is
our client, accept mail from it always".

They might not be doing that properly, in which case your IP address might
then be compared to DNS blacklists, and if it appears on one, be rejected.

But without knowing _why_ the ISP is rejecting your mail, that's just a
WAG.

Here's another question: are you using authenticated SMTP? There are
certain types of problems that will avoid. You might want to try using
authenticated SMTP. This might help getting that set up:

http://www.barnard.columbia.edu/at/email/outlook-smtp.htm

>>>> --- Original message ---
>>>>
>>>> Outlook 2007 for most of the clients under our domain are now having
>>>> outgoing emails blocked by Spam Assassin, which our ISP uses. This
>>>> started in late September (Outlook/MS update??). Simple Text emails
>>>> with "hello" or "test" get scored over 30. If I switch the users
>>>> over to "windows mail" vs. "Outlook" We have no problems but this is
>>>> unacceptable, outlook is our standard. So the question is what is
>>>> Outlook 2007 doing to the outbound mail to cause it to be scored so
>>>> high with Spam Assassin. We are ready to move our mail accounts to a
>>>> different ISP!@!@ Any help is appreciated.

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...the Fates notice those who buy chainsaws...
-- www.darwinawards.com
-----------------------------------------------------------------------
Tomorrow: Halloween


dana.hanson at gmail

Oct 30, 2009, 7:20 PM

Post #12 of 19 (1336 views)
Permalink
Re: outlook 2007 "Test" email scores 30+ [In reply to]

Thanks for the info Kris and John. I have something to work with the ISP now
and somethings I can try on the client. BTW I agree with you on the Outlook
existing comment. I have asked our ISP your questions throught our support
post with them. We'll see what their response is.


Kris Deugau wrote:
>
> djjmj wrote:
>> We have been discussing with them since Sept 17th with no fixes yet. Once
>> they found out
>> Windows Mail Client didn't have an issue they have been unwilling to
>> help.
>> "Not a server side problem, your clients are the problem"
>
> Then tell them you're walking as soon as you find another provider. I'd
> be quite happy as a mail/spamfilter admin if Outlook ceased to exist,
> but it's easily second or third place in mail client popularity.
> (Outlook Express/Windows Mail is in first; Thunderbird is the other
> player in the top three, IMO.) MS Outlook is a common enough mail
> client... and preferred by *business* customers in a high enough
> percentage... that not supporting it is downright stupid on their part.
>
> Try enabling SMTP authentication, and possibly switching the outbound
> port to 587 from the default 25; most ISPs these days offer some form
> of authenticated outbound relay that provides some buffer against
> overscoring in SA. TBH SA scores of 30+ sound like they've just bumped
> the score on a couple of rules that target forged Outlook mail, without
> considering the impact on legitimate relay traffic.
>
>> John Hardin wrote:
>>> Something you could do is go to one of the various DNSBL websites and
>>> check whether your internet gateway's public IP address is listed. Your
>>> ISP may be doing something as simple as treating you as J. Random User
>>> From The Internet rather than as one of their customers.
>
>> I requested this information from the ISP last week. There response was
>> "our or your" domain are not black listed. Maybe I'm misunderstanding
>> your
>> ?
>
> Yes, you've misunderstood. John's question was about the IP address you
> get on your connection; visiting ipchicken.com (among other
> possibilities) should tell you what IP your mail is apparently coming
> "from".
>
> Your ISP may have mangled their SA config (or just not bothered
> configuring it properly in the first place) such that parts of their own
> network used for customer connections aren't being properly bypassed or
> handled by SA's network tests (among other things).
>
> Is there any other pattern in the messages that are blocked? (eg only
> really short messages, messages with the word "foobar" in the first
> paragraph, messages with more than five cute-kitten-pictures attached,
> etc)
>
> (Just for the record, I've seen more and more filtering systems in
> general pick up on short test messages for no reason I can see - Postini
> is the big culprit in the mail flow I deal with so far, but I've had
> occasional reports where other filter systems are involved. Bleaugh.)
>
> -kgd
>
>
:-):-):-)
--
View this message in context: http://old.nabble.com/Re%3A-outlook-2007-%22Test%22-email-scores-30%2B-tp26137005p26139304.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.


dana.hanson at gmail

Oct 30, 2009, 8:15 PM

Post #13 of 19 (1335 views)
Permalink
Re: outlook 2007 "Test" email scores 30+ [In reply to]

one small clarification, which didnt come to me until after I went to
IPchicken. Our ISP is NOT our EmailSP We are using authenticaion on port 25.
Tried 587, not configured on ESP side.


John Hardin wrote:
>
> On Fri, 30 Oct 2009, djjmj wrote:
>
>> John Hardin wrote:
>>>
>> Dana may not have that information - saying "which our ISP uses" suggests
>>> SA is not under their control.
>>
>> Correct SA is not under our control, just trying to find an answer to our
>> problem.
>
>>> Dana:
>>>
>>> Does your ISP bounce the messages back to you?
>>
>> No we don't get the bounced message returned, no notification until
>> receiving user expecting something calls complaining.
>
> Okay. At least they aren't causing backscatter.
>
>>> You really should be discussing this with your ISP's support desk or
>>> postmaster. There's little we can do without data that you're likely
>>> unable to provide. If your ISP has problems correcting the problem,
>>> then they can ask here for help and provide the technical details
>>> needed to troubleshoot the problem.
>>
>> We have been discussing with them since Sept 17th with no fixes yet.
>> Once they found out Windows Mail Client didn't have an issue they have
>> been unwilling to help. "Not a server side problem, your clients are the
>> problem"
>
> Bummer. Will they even go look in the logs and see _why_ the messages are
> being discarded?
>
>>> Something you could do is go to one of the various DNSBL websites and
>>> check whether your internet gateway's public IP address is listed. Your
>>> ISP may be doing something as simple as treating you as J. Random User
>>> From The Internet rather than as one of their customers.
>>
>> I requested this information from the ISP last week. There response was
>> "our or your" domain are not black listed. Maybe I'm misunderstanding
>> your ?
>
> Expanded format:
>
> Your connection to the Internet has an IP address.
>
> When your ISP receives email from you, it comes from that IP address.
>
> They _should_ have their mail system configured to say "that IP address is
> our client, accept mail from it always".
>
> They might not be doing that properly, in which case your IP address might
> then be compared to DNS blacklists, and if it appears on one, be rejected.
>
> But without knowing _why_ the ISP is rejecting your mail, that's just a
> WAG.
>
> Here's another question: are you using authenticated SMTP? There are
> certain types of problems that will avoid. You might want to try using
> authenticated SMTP. This might help getting that set up:
>
> http://www.barnard.columbia.edu/at/email/outlook-smtp.htm
>
>>>>> --- Original message ---
>>>>>
>>>>> Outlook 2007 for most of the clients under our domain are now having
>>>>> outgoing emails blocked by Spam Assassin, which our ISP uses. This
>>>>> started in late September (Outlook/MS update??). Simple Text emails
>>>>> with "hello" or "test" get scored over 30. If I switch the users
>>>>> over to "windows mail" vs. "Outlook" We have no problems but this is
>>>>> unacceptable, outlook is our standard. So the question is what is
>>>>> Outlook 2007 doing to the outbound mail to cause it to be scored so
>>>>> high with Spam Assassin. We are ready to move our mail accounts to a
>>>>> different ISP!@!@ Any help is appreciated.
>
> --
> John Hardin KA7OHZ http://www.impsec.org/~jhardin/
> jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
> key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
> -----------------------------------------------------------------------
> ...the Fates notice those who buy chainsaws...
> -- www.darwinawards.com
> -----------------------------------------------------------------------
> Tomorrow: Halloween
>
>

--
View this message in context: http://old.nabble.com/Re%3A-outlook-2007-%22Test%22-email-scores-30%2B-tp26137005p26139546.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.


jhardin at impsec

Oct 31, 2009, 9:31 AM

Post #14 of 19 (1302 views)
Permalink
Re: outlook 2007 "Test" email scores 30+ [In reply to]

On Fri, 30 Oct 2009, djjmj wrote:

> one small clarification, which didnt come to me until after I went to
> IPchicken. Our ISP is NOT our EmailSP

That is a pretty critical part of the equation. Having problems with an
ESP changes many of the assumptions that we make if you say you're having
problems with your ISP...

After visiting IPChecken.com and getting your IP address, did you then
do a DNSBL lookup for it? If so, did you get any hits?

Here is a site that gives you your IP address and lets you check it
against DNSBLs:

http://cqcounter.com/rbl_check/

> We are using authenticaion on port 25. Tried 587, not configured on ESP
> side.

They really should configure support for that. If they are reluctant to,
it should be another nail in their coffin as far as you are concerned.

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...the Fates notice those who buy chainsaws...
-- www.darwinawards.com
-----------------------------------------------------------------------
Today: Halloween


gene.heskett at verizon

Oct 31, 2009, 10:20 AM

Post #15 of 19 (1316 views)
Permalink
Re: outlook 2007 "Test" email scores 30+ [In reply to]

On Saturday 31 October 2009, John Hardin wrote:
>On Fri, 30 Oct 2009, djjmj wrote:
>> one small clarification, which didnt come to me until after I went to
>> IPchicken. Our ISP is NOT our EmailSP
>
>That is a pretty critical part of the equation. Having problems with an
>ESP changes many of the assumptions that we make if you say you're having
>problems with your ISP...
>
>After visiting IPChecken.com and getting your IP address, did you then
>do a DNSBL lookup for it? If so, did you get any hits?
>
>Here is a site that gives you your IP address and lets you check it
>against DNSBLs:
>
> http://cqcounter.com/rbl_check/

Interesting. I run a very small web page at http://gene.homelinx.net:85/gene
and I suppose because I am in a dynamically assigned IP address range
(verizon adsl), I find I am on 4 of those lists. Probably not a heckofalot I
can do about that, darnit.

Thanks for the link, bookmarked.


--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
The NRA is offering FREE Associate memberships to anyone who wants them.
<https://www.nrahq.org/nrabonus/accept-membership.asp>

I don't have an eating problem. I eat. I get fat. I buy new clothes.
No problem.


support-spamassassin at oeko

Oct 31, 2009, 11:01 AM

Post #16 of 19 (1314 views)
Permalink
Re: outlook 2007 "Test" email scores 30+ [In reply to]

Hi,

On Fri, 30.10.2009 at 15:09:20 -0700, djjmj <dana.hanson [at] gmail> wrote:
> Thank you for your interest and support. I will keep pushing our ISP to use
> this forum for a resolution.

please learn about how email works. Really.

You only sent an obfuscated log about an email conversation with your
ISP, but not the offending message, which is crucial in determining
what might have gone awry on SA's side, if anything.


Kind regards,
--Toni++


barton.schaefer at gmail

Oct 31, 2009, 11:08 AM

Post #17 of 19 (1308 views)
Permalink
Re: outlook 2007 "Test" email scores 30+ [In reply to]

On Sat, Oct 31, 2009 at 9:31 AM, John Hardin <jhardin [at] impsec> wrote:
> Here is a site that gives you your IP address and lets you check it against
> DNSBLs:
>
>   http://cqcounter.com/rbl_check/

Just as a word of warning, that site is still checking
blacklist.spambag.org, which has been offline since 2007 and now lists
the entire Internet.


gene.heskett at verizon

Oct 31, 2009, 11:25 AM

Post #18 of 19 (1323 views)
Permalink
Re: outlook 2007 "Test" email scores 30+ [In reply to]

On Saturday 31 October 2009, Bart Schaefer wrote:
>On Sat, Oct 31, 2009 at 9:31 AM, John Hardin <jhardin [at] impsec> wrote:
>> Here is a site that gives you your IP address and lets you check it
>> against DNSBLs:
>>
>> http://cqcounter.com/rbl_check/
>
>Just as a word of warning, that site is still checking
>blacklist.spambag.org, which has been offline since 2007 and now lists
>the entire Internet.
>
That reduces my addresses hit count to 3 obviously. Thanks for the heads up,
Bart.

--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
The NRA is offering FREE Associate memberships to anyone who wants them.
<https://www.nrahq.org/nrabonus/accept-membership.asp>

What I tell you three times is true.
-- Lewis Carroll


jhardin at impsec

Oct 31, 2009, 9:27 PM

Post #19 of 19 (1300 views)
Permalink
Re: outlook 2007 "Test" email scores 30+ [In reply to]

On Sat, 31 Oct 2009, Bart Schaefer wrote:

> On Sat, Oct 31, 2009 at 9:31 AM, John Hardin <jhardin [at] impsec> wrote:
>> Here is a site that gives you your IP address and lets you check it against
>> DNSBLs:
>>
>> http://cqcounter.com/rbl_check/
>
> Just as a word of warning, that site is still checking
> blacklist.spambag.org, which has been offline since 2007 and now lists
> the entire Internet.

There are, of course, several sites that do multiple-DNSBL checks; it's
possible that this one doesn't check some - for example, though I saw the
component lists I didn't see it checking zen.spamhaus.org. It just came up
high on a quick google, and happened to have an automatic link for "check
your current IP address".

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...the Fates notice those who buy chainsaws...
-- www.darwinawards.com
-----------------------------------------------------------------------
Today: Halloween

SpamAssassin users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.