spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From RW <rwmailli...@googlemail.com>
Subject Re: HTML Preheader affected by NORDNS_LOW_CONTRAST
Date Sun, 01 Sep 2019 17:48:55 GMT
On Fri, 30 Aug 2019 19:33:29 -0400
Bill Cole wrote:


> As RW said, the NORDNS_LOW_CONTRAST rule is a meta-rule, boosting the 
> score of messages with BOTH low-contrast content AND broken reverse
> DNS for a relay. The "preheader" satisfies the first part but the
> second part is actually a fairly complex and error-prone
> determination based on SA parsing Received headers and classifying
> message hand-off each one recordfs. My guess is that this is due to
> something strange in how DuoCircle constructs its Received header,
> because I can find no sign of MailChimp actually messing up their
> rDNS in a chronic or widespread manner.
> 

Actually looking at it again, it's surprising it hits any legitimate
modern commercial email as __HTML_FONT_LOW_CONTRAST_MINFP includes
'&& !__NOT_SPOOFED' which excludes any hits that pass SPF or DKIM. In
recent mail NORDNS_LOW_CONTRAST has only 1 FP in 30k ham.

It's possible that the value in NORDNS_LOW_CONTRAST rreally comes from 

__RDNS_NONE && !__NOT_SPOOFED

HTML_FONT_LOW_CONTRAST has an S/O of 0.336 and hits 10.6% of spam,
so it make be making thing worst all around.

Mime
View raw message