On 06/25/2014 10:21 PM, Philip Prindeville wrote:
http://pastebin.com/qLyKx40b
"This paste has been removed!" :(
Here’s what I’m showing it matched:
Jun 25 11:16:07 mail mimedefang.pl[18682]: s5PHFqsC019802:
s5PHFqsC019802: 4.889 (****)
BAYES_00,BODY_8BITS,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VERIFIED,HTML_MESSAGE,L_BLOCK_ISP,SPF_HELO_PASS,SPF_PASS,T_RP_MATCHES_RCVD
Odd that it didn’t match MIME_CHARSET_FARAWAY or
CHARSET_FARAWAY_HEADER or any rules about excessive redundant
encoding.
FARAWAY will only match if you enabled
ok_locales en
or some other country - not always reliable
interesting that you got a BAYES_00 - meaning your Bayes may need more
learning/ auto learning
Would it be a lot of work to the number of ETH (D w/ STROKE,
whatever) followed by 3/4 character pairs?
Here’s the other thing I don’t get.
The message claims to be 7-bit and text/plain, yet it uses encoded
characters which exceed 7-bit widths yet this doesn’t seem to be
firing any rules either.
Ь would seem to be at least an 11-bit wide character.
Are we being “too liberal in what we accept”?
or trying to be too restrictive? ESPish sort of mail can contain often
contain such wonderful combinations. The travel business senders are
experts in producing the wildest of mixes.
