On Tue, 29 Jun 2010, Karsten Br?ckelmann wrote: > On Tue, 2010-06-29 at 04:39 -0400, Dan Mahoney, System Admin wrote: > > On Mon, 28 Jun 2010, Yet Another Ninja wrote: > > > > > Perhaps this is by design, but rt replies are, strictly speaking, not > > > > bounce messages. > > > > from what I see it looks normal if someone really makes an effort to > > > "tune" SA scores. > > > > > > score ANY_BOUNCE_MESSAGE 0.1 > > > score SHORTCIRCUIT 0 > > > > Even so, why is it matching, when it's not a bounce. It's either > > something inaccurate in spamassassin, or something RT is doing that it > > shouldn't be. It it's the latter, I'll attempt to fix rt. If the former, > > perhaps SA should. > > You didn't provide the necessary information to determine, why the > vbounce rules fire. A full, raw message would be good, and of course > your whitelist_bounce_relays setting. Ideally you would further provide > the relevant sub-tests hit. > > Moreover, you didn't mention your SA version, though from another post > of yours we know it to be 3.2.3. There have been quite some changes to > the vbounce rule-set since -- does 3.3.x also hit? > > > Lastly, as Alex hinted, stock SA would *not* have classified the mail as > spam. That is due to your incredibly high custom score. > > The vbounce rule-set is meant to identify backscatter, and action is > supposed to be taken on the rules hit. It is not meant and better not be > used to classify these spam. See the vbounce rule-set cf file for proper > usage.
Sorry to be replying to such an old message, but SA 3.3.1 seems to be hitting these rules simply when a message has the word 'AutoReply' in the subject header. As such, it would be difficult to accurately identify mail as backscatter, as some web sites (Dell, for example) send emails that contain the word 'AutoReply' in the subject after a web form is submitted.
