On Monday 02 January 2006 00:50, Chris Purves wrote:
>On Sunday 01 January 2006 12:24, Gene Heskett wrote:
>> On Saturday 31 December 2005 20:21, Chris Purves wrote:
>> >On Sun, January 1, 2006 3:28 am, Gene Heskett said:
>> >> On Saturday 31 December 2005 13:38, Rick Macdougall wrote:
>> >>>Gene Heskett wrote:
>> >>>> On Saturday 31 December 2005 12:42, Gene Heskett wrote:
>> >>>>> This morning I'm going thru my JunqueMail folder and find
>> >>>>> that about a dozen msgs to the OpenOffice list, 5 or 6 to the
>> >>>>> fedeora list, and one to the gimp-print-devel list were
>> >>>>> flaged and sorted as *****SPAN*****. With one exception, all
>> >>>>> were in english.
>> >>>
>> >>>Would help if you let us know what rules got hit.
>> >>
>> >> Content analysis details: (5.7 points, 5.0 required)
>> >>
>> >> pts rule name description
>> >> ---- ----------------------
>> >> --------------------------------------------------
>> >> 3.8 HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious
>> >> hostname (IP addr
>> >> 2)
>> >> 1.8 FORGED_YAHOO_RCVD 'From' yahoo.com does not match
>> >> 'Received' headers
>> >> -0.2 BAYES_40 BODY: Bayesian spam probability is
>> >> 20 to 40%
>> >> [score: 0.3369]
>> >> 0.2 DNS_FROM_RFC_ABUSE RBL: Envelope sender in
>> >> abuse.rfc-ignorant.org
>> >
>> >Is that the entire header? You're missing a bunch of "Received"
>> > lines.
>>
>> FWIW, fetchmail sucks it and dumps it to /var/spool/mail/gene, &
>> kmail sucks it from there. This is due to a bug in the kmail suck
>> from servers code of quite long duration, 3 or 4 years now. Humm,
>> headers do seem to be getting lost!
>
>If some of the header is being removed, then that might be a problem.
> That could definitely trigger the FORGED_YAHOO_RCVD rule if the
> received header listing the Yahoo! server was removed.
In that event, how do I go about telling fetchmail that the mailfile it
generates in /var/spool/mail/gene is to be a verbatum copy of what was
sucked in the vz's server. My fetchmailrc is comparatively clean,
with no options that I know about set that would encourage the
shrunken headers. There are no OPTIONS currently defined.
-------------sanitized of course-----------
poll incoming.verizon.net with proto pop3
user XXXXXXX with password YYYYYYYY is gene
# options OPTIONS
poll pop.gmail.com with proto pop3
user ZZZZZZZZZZ with password YYYYYYYYYYYYYYYY is gene
options ssl
# end of file
-----------------------------------------
Or is there some option I need to set to make it do verbatum sucks?
--
Cheers, Gene
People having trouble with vz bouncing email to me should add the word
'online' between the 'verizon', and the dot which bypasses vz's
stupid bounce rules. I do use spamassassin too. :-)
Yahoo.com and AOL/TW attorneys please note, additions to the above
message by Gene Heskett are:
Copyright 2005 by Maurice Eugene Heskett, all rights reserved.
