I appreciate using the dev version for the latest and greatest features. I like being able to offer suggestion / feedback where possible that can help shape (or not) the future of ASSP. There's obviously been a lot from me lately... I will try to post more generic questions like this to the general list, but years ago you told me to opposite if I was running dev.
On Thu, May 14, 2015 at 4:07 AM, Thomas Eckardt <thomas.ecka...@thockar.com> wrote: > >May-13-15 20:46:55 msg64413-11501 [Noprocessing] xxx.yyy.130.50 < > >sender.n...@theirdomain.com> to: m...@ourcharity.org info: found valid > MSGID > >signature in [In-Reply-To:] - accept mail > > This is the reason for noprocessing - it is an answer to a mail - it > contains a valid MSGID-signature! > > > >I don't see this score of 50 in the maillog below though > > AND AGAIN ! > > The analyzer does not process mails - it checks matches and shows all it > can find. > > You have to know your configuration - in case, noprocessing/whitelisting > will skip the DNSBL check, if the mail is really processed. > > > >I've got enhancedOriginIPDetect on. > > Switch it off. > > >I don't see WHY it's no processing from the maillog. How can I figure > that > >out? > > Ken - this is an 'ASSP development mailing list' . If you have general > problems to understand how assp works - don't use the dev version, switch > to the production version 2.4.3 and post your questions in the user list > or the forum! > > Thomas > > > > Von: K Post <nntp.p...@gmail.com> > An: ASSP development mailing list <assp-test@lists.sourceforge.net> > Datum: 14.05.2015 05:25 > Betreff: [Assp-test] Message from whitelisted sender processing as > non-processing?? / Home IP as originating IP scored > > > > I'm seeing this with a bunch of senders. Just noticing now, don't know how > long this has been going on. > > A whitelisted sender sends legit mail to the system. It goes to OKMAIL > instead of notspam because it is somehow getting flagged as no processing. > I don't see WHY it's no processing from the maillog. How can I figure > that > out? > > One thing that I do notice see when I did an analyze from the gui on at > least one file is that the line: > x-originating-ip: [76.189.xxx.xxx] is detected as being in the baracuda > dns > black list. It should be - it's a residential cable ISP IP address, but > that's just what was used to send the mail through to their ISP > legitimately. I've got enhancedOriginIPDetect on. > > Analyze shows > detected IP's on the mail routing way: 76.189.xxx.xxx(xxxxxx.res.rr.com) > •detected source IP: 76.189.xxx.xxx > and > DNSBL: failed, 76.189.xxx.xxx listed in bb.barracudacentral.org - message > score: 50 > I don't see this score of 50 in the maillog below though. Very confused > about that. > > Should we be looking up the user's home IP address and assigning the same > negative score was we would if we directly received a message from a home > IP? > > > See below for the relevant maillog > Thanks > > May-13-15 20:46:53 msg64413-11501 xxx.yyy.130.50 < > sender.n...@theirdomain.com> info: found message size announcement: 46.31 > kByte > May-13-15 20:46:55 msg64413-11501 xxx.yyy.130.50 < > sender.n...@theirdomain.com> to: m...@ourcharity.org Whitelisted sender > address: sender.n...@theirdomain.com for recipient m...@ourcharity.org > May-13-15 20:46:55 msg64413-11501 [Noprocessing] xxx.yyy.130.50 < > sender.n...@theirdomain.com> to: m...@ourcharity.org info: found valid MSGID > signature in [In-Reply-To:] - accept mail > May-13-15 20:46:55 msg64413-11501 xxx.yyy.130.50 < > sender.n...@theirdomain.com> to: m...@ourcharity.org Message-Score: added > -40 > for KnownGoodHelo, total score for this message is now -40 > May-13-15 20:46:55 msg64413-11501 xxx.yyy.130.50 < > sender.n...@theirdomain.com> to: m...@ourcharity.org info: found known good > HELO 'exchange.theirdomain.com' - weight is -2 > May-13-15 20:46:55 msg64413-11501 xxx.yyy.130.50 < > sender.n...@theirdomain.com> to: m...@ourcharity.org Message-Score: added > -15 > (pbwValencePB) for In Penalty White Box, total score for this message is > now -55 > May-13-15 20:46:58 msg64413-11501 xxx.yyy.130.50 < > sender.n...@theirdomain.com> to: m...@ourcharity.org info: removed > MSGID-signature from header > May-13-15 20:46:58 msg64413-11501 xxx.yyy.130.50 < > sender.n...@theirdomain.com> to: m...@ourcharity.org [Plugin] calling plugin > ASSP_AFC > May-13-15 20:46:58 msg64413-11501 xxx.yyy.130.50 < > sender.n...@theirdomain.com> to: m...@ourcharity.org info: 6 attachments > found for Level-1 > May-13-15 20:46:58 msg64413-11501 xxx.yyy.130.50 < > sender.n...@theirdomain.com> to: m...@ourcharity.org message proxied without > processing (no bad attachments) > May-13-15 20:46:58 msg64413-11501 [MessageOK] xxx.yyy.130.50 < > sender.n...@theirdomain.com> to: m...@ourcharity.org message ok - > (noprocessing and whitelisted - found valid Message-ID signature) - [RE > MailSubject] -> messages/okmail/RE_MailSubject.txt > > ------------------------------------------------------------------------------ > One dashboard for servers and applications across Physical-Virtual-Cloud > Widest out-of-the-box monitoring support with 50+ applications > Performance metrics, stats and reports that give you Actionable Insights > Deep dive visibility with transaction tracing using APM Insight. > http://ad.doubleclick.net/ddm/clk/290420510;117567292;y > _______________________________________________ > Assp-test mailing list > Assp-test@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/assp-test > > > > > DISCLAIMER: > ******************************************************* > This email and any files transmitted with it may be confidential, legally > privileged and protected in law and are intended solely for the use of the > > individual to whom it is addressed. > This email was multiple times scanned for viruses. There should be no > known virus in this email! > ******************************************************* > > > > ------------------------------------------------------------------------------ > One dashboard for servers and applications across Physical-Virtual-Cloud > Widest out-of-the-box monitoring support with 50+ applications > Performance metrics, stats and reports that give you Actionable Insights > Deep dive visibility with transaction tracing using APM Insight. > http://ad.doubleclick.net/ddm/clk/290420510;117567292;y > _______________________________________________ > Assp-test mailing list > Assp-test@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/assp-test > ------------------------------------------------------------------------------ One dashboard for servers and applications across Physical-Virtual-Cloud Widest out-of-the-box monitoring support with 50+ applications Performance metrics, stats and reports that give you Actionable Insights Deep dive visibility with transaction tracing using APM Insight. http://ad.doubleclick.net/ddm/clk/290420510;117567292;y _______________________________________________ Assp-test mailing list Assp-test@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-test
