On Wed, 24 Feb 2021, Jared Hall wrote:
On 2/24/2021 9:10 AM, Alessio Cecchi wrote:
that match "X-Mailer =~ /q(?!q?mail|\d|[-\w]*=+;)[^u]/i"
AND the body DOESN'T have has Invisible Text Styles AND there is no
In-Reply-To header. Seems a little excessive to me. Points added for
good behavior? Am I reading that right?
It's avoiding combinations in masscheck that hit only ham, or, absent
that, hit far more ham than spam, in an attempt to reduce false positives.
The __XM_RANDOM header rule is intended to catch the specific condition of
the email, the scored XM_RANDOM meta is intended to add points for when
that condition indicates spam.
Perhaps: /q(?!q?mail|bo|\d|[-\w]*=+;)[^u]/i might be appropriate, at
least as an workaround. Or something similar.
I've already added an exclusion for it.
Is there a genuine use for CASE-Insensitive rules in a X-Mailer
definition? They don't seem to switch case very often.
If you're looking for a specific X-Mailer value, sure. If you're writing a
general rule then focusing on case can miss spam signs.
Is "Qboxmail" the problem? Since this is the name of our company are
there any chances to keep it without catching the rule?
Yes, you should change the name of your company! ;)
I see that JH and the SpamAssassin crew will address your problem. In
the meantime, it won't hurt to add a local rule like:
header MY_XM_RANDOM X-Mailer =~ /Qboxmail Webmail/
score MY_XM_RANDOM -1.154
Which, again, doesn't help anyone outside his company.
IMHO you shouldn't be scanning internal-only email anyway.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
People who are unable to figure out how to make change without
the help of a cash register are demanding a $15/hr minimum wage?
-----------------------------------------------------------------------
270 days since the first private commercial manned orbital mission (SpaceX)
