Menu
▾
▴
Re: [Assp-test] Some whitelisted sender mail going to OKmail instead of notspam
|
From: Thomas E. <Tho...@th...> - 2018-01-08 12:16:35
|
>put in notspam You need to configure, if or not and where to store/collect which mails. There is a complete GUI section only for this purpose. But you are right, the MSGID signature detection is a special case. It should make sure the mail is delivered (by whitelisting and noprocessing) - but it should not override any other setting. possible solution: Well known good replies (valid MSGID Sig) are signed whitelisted and noprocessing - this will not be changed. I've change the logic and code a little bit and I just make some tests with this new code. If a mail is detected by 'valid MSGID Sig' and - at the end of the mail-body processing the reason for the noprocessing flag is only this detection (no other like: noprocessing, npRe, npIP ....), the mail will be stored like any other 'whitelisted or local' mail (NonSpamLog). Thomas Von: "K Post" <nnt...@gm...> An: "ASSP development mailing list" <ass...@li...> Datum: 07.01.2018 21:17 Betreff: Re: [Assp-test] Some whitelisted sender mail going to OKmail instead of notspam I certainly understand not wanting no processing mails to go into the corpus. YAY! Something I understand!! What I don't follow is why we would want a message that's a reply that has a valid MSGID Sig should be considered no processing in the first place. I understand why this is happening, because the DoMsgIDSig is coded this way. I just don't follow why we'd want it to be for replies that we know are good. Bad? Kill em, score them and decide what do to, but is we know they're good, put in notspam. Or is my logic flawed? On Sun, Jan 7, 2018 at 1:33 PM, Thomas Eckardt <Tho...@th... > wrote: Most noprocessing mails will compromize the corpus. They are norpocessing to break all rules - why should assp learn from (may be) rule breaking mails. An good example are the mails in the assp mailing lists. We are talking about bad mails, bad content, bad headers .... - if assp would learn, that all this stuff is OK, what would happen? :):):) Yes, it would be possible to define a logic behind a large set of exceptional rules, to define where to store mails. And maybe there would be two or three admins using it - but only one of them will remember after a year, why these stupid noprocessing mails are stored wild araound. Thomas Von: "K Post" <nnt...@gm...> An: "ASSP development mailing list" < ass...@li...> Datum: 07.01.2018 19:17 Betreff: Re: [Assp-test] Some whitelisted sender mail going to OKmail instead of notspam did a little basic testing New email from gmail from a whitelisted sender goes to notspam If a whitelisted gmail user replies to one of my emails, it goes to okmail, and shows info: found valid MSGID signature in [In-Reply-To:] - accept mail And this makes sense now. It's right in the DoMsgIDSig ....If activated and a bounced mail from null sender or postmaster contains no valid signature the configured action is taken. If activated and any other mail contains a valid signature (eg. because it is an answer/reply to a tagged mail), this mail will be flagged as noprocessing and whitelisted ! So my question is why would we want this behavior? If I send a message and someone replies, why wouldn't we want to add replies to notspam so their content contributes to the corpus? I really like the rest of what DoMsgIDsig does in terms of scoring negatively, but why noprocess replies / put to okmail from whitelisted people? On Sun, Jan 7, 2018 at 12:47 PM, K Post <nnt...@gm...> wrote: I've been having degraded bayesian and HMM results, lots of false positives recently, so I'm going through some mail manually in the corpus to do some bulk retraining. I do this periodically and find that it helps. One thing I noticed is some mail in OkMail that comes from a whitelisted @ gmail.com address. I can't figure out why it's in OkMail and not notspam. Is this log line saying that the message became no processing because of a MSGID signature?? I don't understand- Jan-07-18 12:00:51 msg64450-01103 [Noprocessing] 209.85.215.50 < Whi...@gm...> to: my...@Ou... info: found valid MSGID signature in [References:] - accept mail Everything else in the log, I would expect from a google SMTP server, no penalty box, no delaying, no blocking Jan-07-18 12:00:49 209.85.215.50 info: got STARTTLS request from 209.85.215.50 Jan-07-18 12:00:50 msg64450-01103 209.85.215.50 < Whi...@gm...> info: found message size announcement: 15.02 kByte Jan-07-18 12:00:50 msg64450-01103 209.85.215.50 < Whi...@gm...> IP 209.85.215.50 matches noPB - with 209.85.128.0/17 FROMSPF: _netblocks.google.com Jan-07-18 12:00:50 msg64450-01103 209.85.215.50 < Whi...@gm...> IP 209.85.215.50 matches noPBwhite - with 209.85.128.0/17 FROMSPF: _netblocks.google.com Jan-07-18 12:00:50 msg64450-01103 209.85.215.50 < Whi...@gm...> IP 209.85.215.50 matches noDelay - with 209.85.128.0/17 FROMSPF: _netblocks.google.com Jan-07-18 12:00:50 msg64450-01103 209.85.215.50 < Whi...@gm...> IP 209.85.215.50 matches noBlockingIPs - with 209.85.128.0/17 FROMSPF: _netblocks.google.com Jan-07-18 12:00:51 msg64450-01103 209.85.215.50 < Whi...@gm...> to: my...@Ou... Whitelisted sender address: Whi...@gm... for recipient my...@Ou... Jan-07-18 12:00:51 msg64450-01103 [Noprocessing] 209.85.215.50 < Whi...@gm...> to: my...@Ou... info: found valid MSGID signature in [References:] - accept mail Jan-07-18 12:00:51 msg64450-01103 209.85.215.50 < Whi...@gm...> to: my...@Ou... DKIM-Signature found Jan-07-18 12:00:51 msg64450-01103 209.85.215.50 < Whi...@gm...> to: my...@Ou... IP 209.85.215.50 matches noBlockingIPs - with 209.85.128.0/17 FROMSPF: _ netblocks.google.com Jan-07-18 12:00:52 msg64450-01103 209.85.215.50 < Whi...@gm...> to: my...@Ou... [Plugin] calling plugin ASSP_AFC Jan-07-18 12:00:52 msg64450-01103 209.85.215.50 < Whi...@gm...> to: my...@Ou... message proxied without processing (no bad attachments) Jan-07-18 12:00:52 msg64450-01103 [MessageOK] 209.85.215.50 < Whi...@gm...> to: my...@Ou... message ok - (noprocessing and whitelisted - found valid Message-ID signature) - [re subject] -> messages/okmail/re_subject--1134846.txt Jan-07-18 12:00:53 msg64450-01103 209.85.215.50 < Whi...@gm...> to: my...@Ou... finished message - received DATA size: 15.18 kByte - sent DATA size: 15.85 kByte Jan-07-18 12:00:53 msg64450-01103 209.85.215.50 < Whi...@gm...> to: my...@Ou... disconnected: session:3F7AE040 209.85.215.50 - processing time 4 seconds I did an analyze and don't see anything that suggests it would be no processing: • On Global Whitelist: 'Whi...@gm...' • DKIM-check returned OK body altered - header passed - suspicious-OK • SPF-check returned OK for 209.85.215.50 -> Whi...@gm..., mail-lf0-f50.google.com • Received-SPF: pass (gmail.com ... _spf.google.com: Sender is authorized to use 'Whi...@gm...' in 'mfrom' identity (mechanism 'include:_netblocks.google.com' matched)) receiver=assp.ourcharity.org; identity=mailfrom; envelope-from="Whi...@gm..."; helo= mail-lf0-f50.google.com; client-ip=209.85.215.50 • URIBL check: 'OK' • Known Good HELO: 'mail-lf0-f50.google.com' • HELO Blacklist Ignore: 'mail-lf0-f50.google.com' • Valid Format of HELO: 'mail-lf0-f50.google.com' • IP in Helo check: 'OK' • AUTH would be disabled • IP 209.85.215.50 is in noPB IPs (209.85.128.0/17 FROMSPF: _ netblocks.google.com) • RBLCheck returned OK for 209.85.215.50: • domain gmail.com (in Mail From: , From) has a valid MX record: gmail-smtp-in.l.google.com • domainMX gmail-smtp-in.l.google.com has a valid A record: 173.194.175.27 • 209.85.215.50 PTR record via DNS: status=PTR OK - mail-lf0-f50.google.com • 209.85.215.50 SenderBase: status=not classified, data=[CN=US, ORG=DOT INTERNET, DOM=google.com, BLS=, HNM=Y, CIDR=17, HN=mail-lf0-f50] • IP 209.85.215.50 is in noDelay (209.85.128.0/17 FROMSPF: _ netblocks.google.com) • IP 209.85.215.50 is in noBlockingIPs (209.85.128.0/17 FROMSPF: _ netblocks.google.com) As always, any guidance would be appreciated. ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ Assp-test mailing list Ass...@li... https://lists.sourceforge.net/lists/listinfo/assp-test DISCLAIMER: ******************************************************* This email and any files transmitted with it may be confidential, legally privileged and protected in law and are intended solely for the use of the individual to whom it is addressed. This email was multiple times scanned for viruses. There should be no known virus in this email! ******************************************************* ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ Assp-test mailing list Ass...@li... https://lists.sourceforge.net/lists/listinfo/assp-test ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot _______________________________________________ Assp-test mailing list Ass...@li... https://lists.sourceforge.net/lists/listinfo/assp-test DISCLAIMER: ******************************************************* This email and any files transmitted with it may be confidential, legally privileged and protected in law and are intended solely for the use of the individual to whom it is addressed. This email was multiple times scanned for viruses. There should be no known virus in this email! ******************************************************* |
