Mailing List Archive: SpamAssassin: users

cumulating dyn dns rules

Index | Next | Previous | View Threaded

stephane_chazelas at yahoo

Mar 27, 2012, 8:08 AM

Post #1 of 6 (427 views)
Permalink

cumulating dyn dns rules

Hello, we've had a false positive reported for those headers:

Return-Path: <...@northernnetworking.co.uk>
X-Spam-Flag: YES
X-Spam-Score: 3.679
X-Spam-Level: ***
X-Spam-Status: Yes, score=3.679 tagged_above=0 required=3.1
tests=[BAYES_00=-3.599, DYN_RDNS_AND_INLINE_IMAGE=1.168,
FH_HELO_EQ_D_D_D_D=3.177, HELO_DYNAMIC_IPADDR=1.951,
HTML_MESSAGE=0.001, RDNS_DYNAMIC=0.982, SPF_PASS=-0.001] autolearn=no
[...]
Received: from lvps92-60-123-131.vps.webfusion.co.uk (lvps92-60-123-131.vps.webfusion.co.uk [92.60.123.131])
[...]

Without BAYES, that email would have been discarded on the sole
base that it is coming from a server whose hostname (both PTR
record and HELO hostname) looks like a dynamic one.

That IP address is the MX and SPF for northernnetworking.co.uk
(and also the MX for a number of other domains as seen at
http://www.reversemx.com/mxip/92.60.123.131/), all genuine
AFAICT.

AFAICT, "vps" stands for "virtual private server" at the
webfusion hosting company, the IP address is not dynamic.

But even if it were, wouldn't that score be a bit excessive?
Aren't FH_HELO_EQ_D_D_D_D and HELO_DYNAMIC_IPADDR
redundant/overlapping?

--
Stephane

KMcGrail at PCCC

Mar 28, 2012, 8:36 AM

Post #2 of 6 (391 views)
Permalink

Re: cumulating dyn dns rules [In reply to]

I believe

FH_HELO_EQ_D_D_D_D
is already being removed

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6778

Regards,
KAM

On 3/27/2012 11:08 AM, Stephane Chazelas wrote:
> Hello, we've had a false positive reported for those headers:
>
> Return-Path:<...@northernnetworking.co.uk>
> X-Spam-Flag: YES
> X-Spam-Score: 3.679
> X-Spam-Level: ***
> X-Spam-Status: Yes, score=3.679 tagged_above=0 required=3.1
> tests=[BAYES_00=-3.599, DYN_RDNS_AND_INLINE_IMAGE=1.168,
> FH_HELO_EQ_D_D_D_D=3.177, HELO_DYNAMIC_IPADDR=1.951,
> HTML_MESSAGE=0.001, RDNS_DYNAMIC=0.982, SPF_PASS=-0.001] autolearn=no
> [...]
> Received: from lvps92-60-123-131.vps.webfusion.co.uk (lvps92-60-123-131.vps.webfusion.co.uk [92.60.123.131])
> [...]
>
>
> Without BAYES, that email would have been discarded on the sole
> base that it is coming from a server whose hostname (both PTR
> record and HELO hostname) looks like a dynamic one.
>
> That IP address is the MX and SPF for northernnetworking.co.uk
> (and also the MX for a number of other domains as seen at
> http://www.reversemx.com/mxip/92.60.123.131/), all genuine
> AFAICT.
>
> AFAICT, "vps" stands for "virtual private server" at the
> webfusion hosting company, the IP address is not dynamic.
>
> But even if it were, wouldn't that score be a bit excessive?
> Aren't FH_HELO_EQ_D_D_D_D and HELO_DYNAMIC_IPADDR
> redundant/overlapping?
>

--
*Kevin A. McGrail*
President

Peregrine Computer Consultants Corporation
3927 Old Lee Highway, Suite 102-C
Fairfax, VA 22030-2422

http://www.pccc.com/

703-359-9700 x50 / 800-823-8402 (Toll-Free)
703-359-8451 (fax)
KMcGrail [at] PCCC <mailto:kmcgrail [at] pccc>

Attachments:

pccc_logo.gif (10.2 KB)

axb.lists at gmail

Mar 28, 2012, 8:37 AM

Post #3 of 6 (390 views)
Permalink

Re: cumulating dyn dns rules [In reply to]

On 03/27/2012 05:08 PM, Stephane Chazelas wrote:
> Hello, we've had a false positive reported for those headers:
>
> Return-Path:<...@northernnetworking.co.uk>
> X-Spam-Flag: YES
> X-Spam-Score: 3.679
> X-Spam-Level: ***
> X-Spam-Status: Yes, score=3.679 tagged_above=0 required=3.1
> tests=[BAYES_00=-3.599, DYN_RDNS_AND_INLINE_IMAGE=1.168,
> FH_HELO_EQ_D_D_D_D=3.177, HELO_DYNAMIC_IPADDR=1.951,
> HTML_MESSAGE=0.001, RDNS_DYNAMIC=0.982, SPF_PASS=-0.001] autolearn=no
> [...]
> Received: from lvps92-60-123-131.vps.webfusion.co.uk (lvps92-60-123-131.vps.webfusion.co.uk [92.60.123.131])
> [...]
>
>
> Without BAYES, that email would have been discarded on the sole
> base that it is coming from a server whose hostname (both PTR
> record and HELO hostname) looks like a dynamic one.
>
> That IP address is the MX and SPF for northernnetworking.co.uk
> (and also the MX for a number of other domains as seen at
> http://www.reversemx.com/mxip/92.60.123.131/), all genuine
> AFAICT.
>
> AFAICT, "vps" stands for "virtual private server" at the
> webfusion hosting company, the IP address is not dynamic.
>
> But even if it were, wouldn't that score be a bit excessive?
> Aren't FH_HELO_EQ_D_D_D_D and HELO_DYNAMIC_IPADDR
> redundant/overlapping?

FH_HELO_EQ_D_D_D_D will be removed with next sa-update

meanwhile

score FH_HELO_EQ_D_D_D_D 0

stephane.chazelas at gmail

Mar 28, 2012, 10:26 AM

Post #4 of 6 (394 views)
Permalink

Re: cumulating dyn dns rules [In reply to]

2012-03-28 17:37:25 +0200, Axb:
[...]
> >But even if it were, wouldn't that score be a bit excessive?
> >Aren't FH_HELO_EQ_D_D_D_D and HELO_DYNAMIC_IPADDR
> >redundant/overlapping?
>
> FH_HELO_EQ_D_D_D_D will be removed with next sa-update
>
> meanwhile
>
> score FH_HELO_EQ_D_D_D_D 0
[...]

OK. Thanks (and to Kevin).

--
Stephane

me at junc

Mar 28, 2012, 11:00 PM

Post #5 of 6 (388 views)
Permalink

Re: cumulating dyn dns rules [In reply to]

Den 2012-03-27 17:08, Stephane Chazelas skrev:

> AFAICT, "vps" stands for "virtual private server" at the
> webfusion hosting company, the IP address is not dynamic.

so why does the hostname contains ip addr ?, okay stop fighting :)

http://www.dnswl.org/ you can ask to get your own ip in the virtual
server listed here, that will help on the sign its a maybe / maybe not
dynamic ip

or contact the virtual hosters about that issue about ip addr in
hostnames when its static, my isp is stupid there as well, my ip is
seperated listed in ripe, but spamhuas list me since its inside a
dynamic pool

it cant be better ...

> But even if it were, wouldn't that score be a bit excessive?
> Aren't FH_HELO_EQ_D_D_D_D and HELO_DYNAMIC_IPADDR
> redundant/overlapping?

trusted_networks is not your friend ?

me at junc

Mar 28, 2012, 11:04 PM

Post #6 of 6 (391 views)
Permalink

Re: cumulating dyn dns rules [In reply to]

Den 2012-03-28 17:36, Kevin A. McGrail skrev:
> I believe
>
> FH_HELO_EQ_D_D_D_D
> is already being removed
>
> https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6778

smtp_helo_name=google.example.org in postfix main.cf did not help on
stupid defaults from dynamic reverse ?

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads