Am 2024-06-14 21:20, schrieb Matus UHLAR - fantomas:
If you want to find out more, feed the mail to "spamassassin -D" and
that should explain which text matched which rules.
and as we told you already, your client should NOT play with small
or semi-invisible text in mail. That's what spamers do.
On 14.06.24 23:33, Thomas Barth via users wrote:
Cool, but now I ve more questions! :-)
When the eMail arrived the score was 6.248. I repeat the testlist:
BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1,
DKIM_VALID_EF=-0.1, DMARC_PASS=-0.001, FONT_INVIS_MSGID=2.497,
FONT_INVIS_NORDNS=1.544, HTML_FONT_TINY_NORDNS=1.514,
HTML_MESSAGE=0.001,
RDNS_NONE=0.793, RELAYCOUNTRY_BAD=2, SPF_HELO_NONE=0.001,
SPF_PASS=-0.001,
T_KAM_HTML_FONT_INVALID=0.01, T_SCC_BODY_TEXT_LINE=-0.01
But when piping the eMail to spamassassin -D the score is 10.5! And
RDNS_NONE gets a 1.3!
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the Spamhaus
DBL
blocklist
[URI: www.example.com]
[URI: example.com]
This happened because spam URL was not on DBL blocklist at the time you have
received the mail. This happens all the time.
Also Bill has posted useful info.
However, this is not the output of spamassassin -D, just the resulting spam
headers.
I'm skipping the rest of recommendations because of the latter.
WARNING
If you colleague is discussing with spammer, skip this discussion and tell
him not to. There is no point in helping spammer avoiding filters.
The existence of www.example.com and example.com URIs in the mail indicates
that the mail was sent by spammer.
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Remember half the people you know are below average.
