Re: FSL_HELO_BARE_IP_2 fires on wrong header

[Reindl Harald]

Am 25.01.2016 um 15:07 schrieb Axb:

On 01/25/2016 03:01 PM, Reindl Harald wrote:

Am 25.01.2016 um 14:41 schrieb RW:

On Mon, 25 Jan 2016 14:11:30 +0100
Reindl Harald wrote:

there is *no point* on fire a rule on the third Received header when
the HELO is pretty clear "mail1.intellij.net" and matches PTR/A
perfectly too

Of course there's a point. It's intended to detect spam software that's
relaying through a real MTA - typically someone else's.

no there is no point

"Received: from unknown (HELO 46.137.93.51) with ESMTPA" is the MTA
client (the A is for Authenticated = SASL)

at least 1.5 points is unacceptable for (in general questionable)
deep header inspection

It works well for me, if you don't like it rescore it

it would work well if it only checks the own received header

Received: from mail1.intellij.net (mail1.intellij.net [46.137.178.215])
"mail1.intellij.net" is one time for the HELO and one time for the PTR

Not worth an argument - masschecker set the score based on spam corpus

lower the score and have a nice day

cat maillog | grep FSL_HELO_BARE_IP_2 | grep "result: Y" | wc -l
21

cat maillog | grep FSL_HELO_BARE_IP_2 | wc -l
130

cat maillog | grep FSL_HELO_BARE_IP_2 | grep BAYES_00 | wc -l
93

masschecker is not worth an argument in 2016:
02-Jan-2016 00:22:49: SpamAssassin: No update available
03-Jan-2016 00:32:25: SpamAssassin: No update available
04-Jan-2016 00:03:32: SpamAssassin: No update available
05-Jan-2016 01:45:11: SpamAssassin: No update available
06-Jan-2016 01:28:29: SpamAssassin: No update available
07-Jan-2016 00:36:53: SpamAssassin: No update available
08-Jan-2016 01:28:56: SpamAssassin: No update available
09-Jan-2016 00:56:22: SpamAssassin: No update available
10-Jan-2016 00:47:09: SpamAssassin: No update available
11-Jan-2016 00:31:39: SpamAssassin: No update available
12-Jan-2016 01:14:41: SpamAssassin: No update available
13-Jan-2016 00:39:28: SpamAssassin: No update available
14-Jan-2016 00:14:53: SpamAssassin: No update available
15-Jan-2016 01:15:31: SpamAssassin: No update available
16-Jan-2016 00:30:26: SpamAssassin: No update available
17-Jan-2016 01:21:19: SpamAssassin: No update available
18-Jan-2016 00:51:34: SpamAssassin: No update available
19-Jan-2016 01:38:51: SpamAssassin: No update available
20-Jan-2016 00:51:39: SpamAssassin: No update available
21-Jan-2016 00:56:00: SpamAssassin: No update available
22-Jan-2016 01:33:51: SpamAssassin: No update available
23-Jan-2016 01:32:07: SpamAssassin: No update available
24-Jan-2016 00:00:21: SpamAssassin: No update available
25-Jan-2016 00:22:38: SpamAssassin: No update available

---------------------------------------------------------------------
 > score FSL_HELO_BARE_IP_1 0.1
 > score FSL_HELO_BARE_IP_2 0.1
---------------------------------------------------------------------

OK: /usr/bin/systemctl reload spamassassin.service

not worth an argument when it's simply wrong and hits mostly clear ham and is broken by definition looking at *random* headers?

signature.asc
Description: OpenPGP digital signature