----- Message from Matt Corallo <sa...@mattcorallo.com> ---------
Date: Mon, 15 Nov 2021 20:06:22 -0500
From: Matt Corallo <sa...@mattcorallo.com>
Subject: SHOPIFY_IMG_NOT_RCVD_SFY but from Shopify
To: users@spamassassin.apache.org
Full headers follow, but it seems the shopify detection in the above
isn't quite correct;
Return-path:
<bounces+11006833-f9b2-vmstfpodc=mattcorallo....@mailer.shopifyemail.com>
Envelope-to: vmstfp...@mattcorallo.com
Delivery-date: Mon, 15 Nov 2021 21:10:55 +0000
Received: from o13.mailer.shopify.com ([149.72.221.62])
by mail.as397444.net with esmtps TLS1.3 id 1mmjFb-0034Ki-02
(envelope-from
<bounces+11006833-f9b2-vmstfpodc=mattcorallo....@mailer.shopifyemail.com>)
for vmstfp...@mattcorallo.com; Mon, 15 Nov 2021 21:10:54 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=shopifyemail.com;
h=content-transfer-encoding:content-type:from:mime-version:subject:to;
s=s1; bh=L6MOYDUWmLOqslFvAtFYWh5qLPKmd6pYEgpqrenHnBs=;
b=UvsSoEOv493AjrzWR4oEG6Az0lh/7AXA3ffUaba8uMXlw9JLorE+crRICh8MvxfG5Fvo
pvdct01r9M+Bf026VMyW/FlFWXpWzN05nzQAOCiFbmG+5EO1eRH1OeVgh01abOvixsBeE3
CjdBHnuX6AN5nqhsAbN9sCxvqbp8Fw2ua/gXe3UV4I2eN84kKNavD+OXlg6p58tAdYLbIP
H0cZsSbI2P0r7IBx9xy8W75+xko5TmEv8G3iCqu5XIkjyFiXXQ7Tb6945ufsesdWPySptl
tB/4bpKj0tsHPVB5P0Khbs+D+rihd6fXCIR1DVSi95zRy7jFetZ+qs92V2kcriqw==
Received: by filterdrecv-55446c4d49-qtzhb with SMTP id
filterdrecv-55446c4d49-qtzhb-1-6192CCBD-22
2021-11-15 21:10:21.40606231 +0000 UTC m=+6475835.615170087
Received: from MTEwMDY4MzM (unknown)
by ismtpd0166p1iad2.sendgrid.net (SG)
with HTTP
id IH-oNFPeQuCQYJmXFK0TZA
Mon, 15 Nov 2021 21:10:21.347 +0000 (UTC)
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset=utf-8
Date: Mon, 15 Nov 2021 21:10:47 +0000 (UTC)
From: Vogmask <cont...@vogmask.com>
Mime-Version: 1.0
Message-ID: <e1020005-16b7d47c7b523542-ab262...@shopify.com>
Subject: Vogmask wishing you healthy holidays
X-SG-EID:
=?us-ascii?Q?5B6O2rXra8yyjbieZ0HfzpfFbNtt4wWp=2Fd3WXqmWbfqOhxfdxmGFIM=2FJ+PIMU1?=
=?us-ascii?Q?oyOqpYWvcUFyjZEr5TyX=2FjAbJd+Cumgvq6xfZOv?=
=?us-ascii?Q?dJTD9NPE03XHHpKZfmLGsyYlBT3Yxr5Qogi9GtS?=
=?us-ascii?Q?fGgYxj6BfQZ5sgFhTZLSAkyx3A5JqvfSC2cUCEQ?=
=?us-ascii?Q?qw1QCFhVicli0a95RuZaLPLyojnDWYGuWhoz4K6?=
=?us-ascii?Q?GTt0hihCTSnJlw373HjtCV5Prw7z7g1O=2Fp5Qmd?=
X-SG-ID:
=?us-ascii?Q?N2C25iY2uzGMFz6rgvQsb8raWjw0ZPf1VmjsCkspi=2FKOpeJUHWlRJMC+AMZBck?=
=?us-ascii?Q?1FO70fiqNhdDAf7Doabm9bNI6SbkpfQ9BOq3F=2F8?=
=?us-ascii?Q?X4Pw5908aEJHVHyHsvaINuP86SswzO+KInLAmfy?=
=?us-ascii?Q?9hxCxyg11qt5djFNco+YTTtSQciyHkmmHsAzq2d?=
=?us-ascii?Q?vU8YuM0JyjIqBCzK+fgunAGA9Am7yJx+ms17zgY?=
=?us-ascii?Q?FJS+BROGhX8MiQjivNzk380SgpNY5C77gvW8ZRj?=
=?us-ascii?Q?J15FBaoBIyCz33IurtkuTOueoixnDmSsOGPzF15?=
=?us-ascii?Q?+s7qzGuDM+9E2jc5P6iFBrwJxrOf8hFN0sB00=2Fa?=
=?us-ascii?Q?Xo8cRVYiWGen6HzGlYT6fSn7Vay=2FY27=2FBNYADhS?=
=?us-ascii?Q?1JZAzkQXvIaP0zmaHEaAEZopZo88ZOhNWsc6FEM?=
=?us-ascii?Q?1eN4=2FbcZYpm8pCYg=2Fnnc8Ll8pbJoKP9Qv5DFaIz?=
=?us-ascii?Q?uBuKVnzHb2SVWp5I3aJpBgKe7xNFr9sOQ5jmlao?=
=?us-ascii?Q?hZxMWfZUD230qWrgZ16HraxrsZF7515ZObGChZQ?=
=?us-ascii?Q?3uJhHV1Sj=2FwBNNl9TPZVyAfsmATNtj3RDatJAcG?=
=?us-ascii?Q?jexHfFXjGFY9AmxpOYK0W6DYsjWkeILZAVpZZK+?=
=?us-ascii?Q?D8wsG9qf1R0eTHxM33td=2Fm8AYcA9EW4OmMOG=2FQ8?=
=?us-ascii?Q?ReYV=2Fvs8P1g=2FUONIhgeeGhV1l1bBEBMcf35JieG?=
=?us-ascii?Q?s74Y=2FlXN01oc9YfbTQIhhgT08M8LoR8h95fUZ8M?=
=?us-ascii?Q?Qo04CgxLdXmsz82L1x903a0Uvfs+KkRfhi8rGrP?=
=?us-ascii?Q?g0rFHSls9Tpqc87ZvvEhLjRcXKBedlUchWuc4Cr?=
=?us-ascii?Q?Vh7kppkZ7A=2F6kiTgrwHMNPpzdG6AuDzwWvQ6kEB?=
=?us-ascii?Q?MO4SRttyHoWu3ILaf0TaUxRVJeckcR6BeoTE1xX?=
=?us-ascii?Q?4pDsp6BX4mp6H=2F0dE5pxtt9xpbAnVXAhRWn=2FNpV?=
=?us-ascii?Q?23at3HdyRYfnbrS7QGNLw6=2F62aJ3q0nPU6WD0Xf?=
=?us-ascii?Q?J0TtFlA8=2Fsp=2FC7AfYYvr3SBAQIO6Lc5EwetgQ0i?=
=?us-ascii?Q?R34qVWkrMon+WZRUu36toGbC19DACvzpa8=2FZbLM?=
=?us-ascii?Q?1bPSFCWyI1bi9=2FDVVt0JaX2kTVFQvJa55JAUWT0?=
=?us-ascii?Q?awO+R9n92HN3?=
To: Matthew Corallo <vmstfp...@mattcorallo.com>
X-Entity-ID: IhRJlkz40SfErzamwKHkAA==
X-Spam-Report: Yes, score=6.3 required=5.0 autolearn=disabled version=3.4.6
pts rule name description
---- ----------------------
--------------------------------------------------
0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
[score: 0.4944]
-0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[149.72.221.62 listed in wl.mailspike.net]
0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
mail domains are different
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
identical to background
0.0 HTML_IMAGE_RATIO_04 BODY: HTML has a low ratio of text to image
area
0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from
envelope-from domain
-0.1 DKIM_VALID Message has at least one valid DKIM or
DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not
necessarily
valid
0.8 RDNS_NONE Delivered to internal network by a host
with no rDNS
2.0 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS
2.5 SHOPIFY_IMG_NOT_RCVD_SFY Shopify hosted image but message not
from Shopify
0.0 NORDNS_LOW_CONTRAST No rDNS + hidden text
X-Spam-Score: 6.3
----- End message from Matt Corallo <sa...@mattcorallo.com> -----
I've had issues with this one before, and have this note in my local.cf:
## This rule is triggering a lot on emails which are not Spam,
reducing score from 2.497
score SHOPIFY_IMG_NOT_RCVD_SFY 1.8
Simon
--
Simon Wilson
M: 0400 12 11 16
