whitelist problems

Mon Mar 29 21:01:48 IST 2004

I sent a message earlier but it didn't appear to make it to the list so I'm
trying again.  I'm running MailScanner 4.28.5-2 with SpamAssassin 2.63.
I've run into occasional problems with messages to this list being picked
up as spam because of the content we send around.  Because of that, I've
added the following line to my spam.whitelist.rules file:

To:     MAILSCANNER*@JISCMAIL.AC.UK     yes

The asterisk covers both this list and the MAILSCANNER-ANNOUNCE list.
However, this morning I had the attached message picked up as spam from
this group.  I just noted that the message contains another message with
its own "To:" line.  Could that have confused MS/SA?

================================================================================
Don Newcomer                                            Dickinson College
Senior Manager, Systems                                 P.O. Box 1773
newcomer at dickinson.edu                                  Carlisle, PA  17013
                                                        Phone: (717) 245-1256
                                                          FAX: (717) 245-1690
-------------- next part --------------
From mailscanner at SMITS.CO.UK Mon Mar 29 08:21:00 2004
Return-Path: <newcomer at alpha.dickinson.edu>
Received: from alpha.dickinson.edu by falcon.dickinson.edu
    (8.8.8/1.1.22.3/25Feb99-0911AM)
	id FAA0000029109; Mon, 29 Mar 2004 05:11:31 -0500 (EST)
Received: by alpha.dickinson.edu (8.11.1/1.1.29.3/19Aug03-0302PM)
	id i2TABVr0000371708; Mon, 29 Mar 2004 05:11:31 -0500 (EST)
Received: from smtp.jiscmail.ac.uk by alpha.dickinson.edu
    (8.11.1/1.1.29.3/19Aug03-0302PM)
	id i2TABIN0000441017; Mon, 29 Mar 2004 05:11:18 -0500 (EST)
Received: from LISTSERV.JISCMAIL.AC.UK (jiscmail.ac.uk) by
    smtp.jiscmail.ac.uk (LSMTP for Windows NT v1.1b) with SMTP id
    <9.000E5B86 at smtp.jiscmail.ac.uk>; Mon, 29 Mar 2004 11:11:03 +0100
Received: from JISCMAIL.AC.UK by JISCMAIL.AC.UK (LISTSERV-TCP/IP release
    1.8e)
          with spool id 35090964 for MAILSCANNER at JISCMAIL.AC.UK; Mon, 29 Mar
          2004 11:11:03 +0100
Received: from 130.246.192.53 by JISCMAIL.AC.UK (SMTPL release 1.0i) with
    TCP;
          Mon, 29 Mar 2004 11:11:03 GMT
X-RAL-MFrom: <mailscanner at smits.co.uk>
X-RAL-Connect: <smtp-out5.blueyonder.co.uk [195.188.213.8]>
Received: from smtp-out5.blueyonder.co.uk (smtp-out5.blueyonder.co.uk
          [195.188.213.8]) by fili.jiscmail.ac.uk (8.12.8/8.12.8) with
    ESMTP id
          i2TAAwY8014819 for <MAILSCANNER at JISCMAIL.AC.UK>; Mon, 29 Mar 2004
          11:10:59 +0100
Received: from hermes.clumpton.homeip.net ([82.41.193.249]) by
          smtp-out5.blueyonder.co.uk with Microsoft SMTPSVC(5.0.2195.5600);
          Mon, 29 Mar 2004 11:10:58 +0100
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
X-MimeOLE: Produced By Microsoft Exchange V6.5.6944.0
Thread-Topic: Mailscanner-4.28.6-1 and SPAM Actions= attachment deliver
    problems
Thread-Index: AcQVJJh0LSvPMpE8Rjab9Bmd6TedeAASP1eAAACjlWAAAMUr4A==
X-OriginalArrivalTime: 29 Mar 2004 10:10:58.0555 (UTC)
                       FILETIME=[217F94B0:01C41576]
X-CCLRC-SPAM-report: -4.8 : BAYES_00,HTML_MESSAGE
X-Scanned-By: MIMEDefang 2.38
Message-ID: 
    <58696C94787F16468267F3509F11503007701A at hermes.clumpton.homeip.net>
Date:         Mon, 29 Mar 2004 11:10:56 +0100
Reply-To: MailScanner mailing list <MAILSCANNER at JISCMAIL.AC.UK>
Sender: MailScanner mailing list <MAILSCANNER at JISCMAIL.AC.UK>
From: MailScanner <mailscanner at SMITS.CO.UK>
Subject: Re: Mailscanner-4.28.6-1 and SPAM Actions= attachment deliver
    problems
To: MAILSCANNER at JISCMAIL.AC.UK
Precedence: list
X-Dickinson-MailScanner-Information: Please contact the ISP for more
    information
X-Dickinson-MailScanner: Found to be clean
X-Dickinson-MailScanner-SpamCheck: spam, SpamAssassin (score=4.096,
	required 3, BAYES_30 -0.90, BigEvilList_132 3.00, HTML_MESSAGE 0.10,
	J_CHICKENPOX_14 0.60, J_CHICKENPOX_43 0.60, J_CHICKENPOX_46 0.60,
	RCVD_IN_SORBS 0.10)
X-Dickinson-MailScanner-SpamScore: ssss
X-MailScanner-From: owner-mailscanner at jiscmail.ac.uk

Hi Kevin,

On Exchange 2003 I am seeing full original headers and body in plain
text with HTML markups as per sample below (my edits to user and server
info). What format mangling are you seeing? I don't recall any mangling
from Exchange 2000. Messages used to look very similar to this when my
mail server was on 2000. Certainly plenty for sa-learn to get its teeth
into.

Bart... 

Received:  from mailscanner.mydomain.com ([x.x.x.x]) by exchange.local
over TLS secured channel with Microsoft SMTPSVC
(5.0.2195.6713); Wed, 24 Mar 2004 02:36:02 +0000
MIME-Version: 1.0
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Received:  from 82.41.193.249 ([61.181.239.240]) by
mailscanner.mydomain.com (8.12.10/8.12.10) with SMTP id i2O2ZkS9003849
for <user>; Wed, 24 Mar 2004 02:35:53 GMT
X-MimeOLE: Produced By Microsoft Exchange V6.5.6944.0
Content-class: urn:content-classes:message
Subject: Make Your Love Life Better - Get Instant Growth Formula tBCzd
Date: Wed, 24 Mar 2004 03:34:31 +0100
Message-ID: <676561144113.pQUKi5 at Bart>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: Make Your Love Life Better - Get Instant Growth Formula
tBCzd
Thread-Index: AcQRSMAMTAsPPY/IQXyiCG/b97RyOg==
From: "Stephen i. Keen" <EvaySwain at gummerus.fi>
To: "Bart J. Smit" <user>
Reply-To: "Stephen i. Keen" <EvaySwain at gummerus.fi>

<html>
<body>
<b><h3>Is your John.son too Inad.equate</h3>
<br>
<br>
<h2><b><a href=3D"http://b9UZkTWRp.pimpstars.com/p/p.php">Get =
IGF2(Instant Growth Formula), O.rder Here</a></h2></b>
<br><br><p><br>
<font style=3Dfont-size:1px>trapezium ramada vacuolate infinite courtney
=
antithetic convalescent matson guarantor pompey gershwin byers cave =
ceramium aerospace disco armadillo macdougall ax chairwoman bottom hutch
=
iconoclast sprint arty suffolk awaken blossom improvident reservoir =
stayed headroom jill clarity constant tying cognac wastebasket angelfish
=
retrospect nearsighted burlesque charlemagne bunch mass proclivity =
collude elves cometh potent forfeiture phlox blotch babe chickadee =
ambuscade moderate democratic putty drib foist gecko petition deferrable
=
allegro surjective polarimeter handymen parrot downdraft perchance lush
=
warden coarse stanford b's mange contempt emphases breakwater caught =
detain infidel amorous contretemps climatology sidewise grisly shark =
cheesecake sensor toefl aldehyde miasma abutted barnabas bechtel =
baptiste tumble becalm contralto merrill automatic retroactive =
collaborate swenson circumcircle jolla escalate terpsichorean projector
=
pragmatist australi!
 te codicil hillmen piece amateur collide lambert scrutiny crescent =
mildred alcestis avocation downriver conch combustible frothy allyn =
nietzsche isothermal adventurous gil bidden cyclops chine aldebaran =
mince aforesaid cancelled scotsman debauch maine salubrious diagrammatic
=
evade bridgework biaxial dey neve trichrome bite bolton watch uptake =
tinkle cortical applicant admission wherefore argumentation sloppy =
prefab courtier tenth usable ackley epsom translate batwing hungry =
cheeky gules leatherwork meredith strabismus clergy standish wilt attest
=
aggressive catv hackett algebra wife haunch ministry person concert =
ehrlich ayers berenices batavia celebes genre instructor possum blowup =
metabolism gibe groan cautionary elisha cankerworm chance aspirin =
hydrochemistry maine despotic strewn delirium greensward kane sci =
scrumptious firemen woodside aim boeotia botulin bile wiseacre anxiety =
liqueur nolan partial compare egress linda obey puritan classify clarke
=
farmington isabel spre!
 e cobb dod barnard illiterate informant childhood guise aboriginal dar
edevil compleat ligament grapple backgammon biltmore grandniece stagnate
=
aborigine taft skullduggery tachometer huxley muslim apply irish muggy =
drosophila deposition morley content admit drib impervious secular =
feverish phantom downplay rightful philanthropy amble allowance =
concurred kankakee gladdy rosy adposition cattlemen antares hypothesis =
aggrieve veritable aileron camelopard tiptoe coward palindrome =
marionette inaugurate sachs cringe jacobsen desperado dearborn =
contretemps morose shakedown kilgore sonny jubilate auditor inputting =
usgs merry waddle adenosine alto atrocity reagan workbook pravda =
renegotiable elder lake crony vulcan plop chalcedony fraught bellmen =
sober deferent saline rocco botany functorial swiss humboldt conduit =
boxcar cater topmost hillman aplomb birgit dualism natty inconsequential
=
appendix digress chomp voluntarism crap core antipode selectmen backside
=
congratulatory edinburgh galactose memorabilia snowflake muskoxen =
sorensen athlete weatherbeaten d!
 usenbury dewitt dalhousie creed sobriety alkene humpback pupate bini =
transcription dispelled silica malaprop description rhapsody cassette =
marketeer quartile breakaway signal tensional breeches aftereffect =
bloomington transcribe stenographer floury uniaxial blunt youthful alloy
=
bookbind kimono ryder citation epitaxy demented seminal inference eclat
=
cast batten flaunt elves demonstrable affectionate christendom aitken =
chaise bilge main jazzy somewhere bridgetown gigaherz chromosphere =
elmhurst cormorant magnolia announce swordfish denton victor checkmate =
felicitous gull calculable sabbatical women grumble infirm salt =
accompanist shenandoah disparage doppler agouti mario bashful hemlock =
adherent elongate immemorial pack existent basin buddhist grainy grady =
desolate cancelled quintet elijah albacore brimful reman lice thorstein
=
case articulatory spinodal boa combustible prudent nehru chile wiremen =
didn't simmons cacao krause threadbare allege immanent saxony floral =
wildfire nyu!
  spray blurry geriatric inertia isotropic blackjack irrational wan ine
scapable ripley mynah dynamo audrey pariah ply jenny backyard arrest =
diligent demiscible conquistador fruitful chelate bloke referable stubby
=
arabia stoic gillespie drawback scribe construct elisha longhand coupon
=
marketwise lorelei luminosity aflame cashier functor cryostat phosphate
=
altogether marty mcnaughton sportswear conklin celsius methanol =
anharmonic repentant behold emphasis abbot chaparral colt appear hem =
busch pornographer if saxifrage thenceforth hypothetic comb elizabeth =
nail botfly registrant expurgate </font>
</body>
</html>

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
Behalf Of Spicer, Kevin
Posted At: 29 March 2004 10:29
Posted To: MailScanner
Conversation: Mailscanner-4.28.6-1 and SPAM Actions= attachment deliver
problems
Subject: Re: Mailscanner-4.28.6-1 and SPAM Actions= attachment deliver
problems

MailScanner wrote:
> On Exchange you have better options than forward. Create public 
> folders (e.g. goodmail for FP's and junkmail for FN's) and ask your 
> users to drag and drop the messages into those. This will give you 
> access to full message headers. To preserve single instance storage 
> the Exchange server moves the pointer for the message into the public 
> folder; you are seeing the exact message the users received.
> 
> I have modified an IMAP retrieval script to pull these messages 
> automagically for sa-learn. Search the list archive for 'folderdump'.

That works fine on exchange 5.5 (from what I've heard) but exchange 2000
messes up the message format when accessed through imap or pop (from
personal experience)

BMRB International
http://www.bmrb.co.uk
+44 (0)20 8566 5000
_________________________________________________________________
This message (and any attachment) is intended only for the recipient and
may contain confidential and/or privileged material.  If you have
received this in error, please contact the sender and delete this
message immediately.  Disclosure, copying or other action taken in
respect of this email or in reliance on it is prohibited.  BMRB
International Limited accepts no liability in relation to any personal
emails, or content of any email which does not directly relate to our
business.