spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Alex <mysqlstud...@gmail.com>
Subject Re: TVD_PH_SEC score problem
Date Tue, 25 Apr 2017 12:45:35 GMT
Hi,

On Mon, Apr 24, 2017 at 11:43 PM, Bill Cole
<sausers-20150205@billmail.scconsult.com> wrote:
> On 24 Apr 2017, at 21:35, Alex wrote:
>
>> Hi,
>>
>>>> Hi, this rule hit a citibank.com email. Adding 1.8 points simply for
>>>> the phrase "your account security" does not seem reasonable.
>>>>
>>>> Apr 24 20:13:18.660 [28524] dbg: rules: ran body rule TVD_PH_SEC
>>>> ======> got hit: "your account security"
>>>
>>>
>>> What *else* hit? What was the final total score?
>>
>>
>> It also hit a secondary RBL for an IP that it shouldn't have, as well
>> as bayes00 and hostkarma_bl, totaling 5.044, making it spam. The IP
>> that was hit was 52.40.63.1, mta1b3.c1-t.msyscloud.com.
>
>
> Umm...
>
> # host 1.63.40.52.hostkarma.junkemailfilter.com
> 1.63.40.52.hostkarma.junkemailfilter.com has address 127.0.1.1
>
> # host mta1b3.c1-t.msyscloud.com.hostkarma.junkemailfilter.com
> mta1b3.c1-t.msyscloud.com.hostkarma.junkemailfilter.com has address
> 127.0.2.3
> mta1b3.c1-t.msyscloud.com.hostkarma.junkemailfilter.com has address
> 127.0.1.1
>
> You probably should not be treating those "experimental" result codes as
> derogatory. 127.0.1.1 seems to be an assertion that the IP behaves in a
> formally correct manner and 127.0.2.3 seems to mean that it's been sending
> mail for over a week. These are both GOOD things.

Yes, I said it was for an IP that shouldn't have hit hostkarma_bl.
When this email was received on Apr 15th, it also hit hostkarma_bl.
It's apparently been corrected.

 *  1.0 RCVD_IN_HOSTKARMA_BL RBL: Sender listed in HOSTKARMA-BLACK
 *      [52.40.63.1 listed in hostkarma.junkemailfilter.com]

Mime
View raw message