Large emails being tagged as spam - false positives

[Glenn Steen]

On 29/09/06, Alex Broens <ms-list at alexb.ch> wrote:
> On 9/29/2006 1:25 AM, Matt Kettler wrote:
> > Gordon Colyn wrote:
> >> Here is an example, a legitimate 6.9M email that is classified as spam;
> >>
> >>       cached  not
> >>      score=8.424
> >>       8  required
> >>       -3.00 BAYES_00 Bayesian spam probability is 0 to 1%
> >>       0.14 FORGED_RCVD_HELO Received: contains a forged HELO
> >>       0.00 HTML_MESSAGE HTML included in message
> >>       1.82 MISSING_SUBJECT Missing Subject: header
> >>       2.60 RCVD_IN_DSBL Received via a relay in list.dsbl.org
> >>       1.95 RCVD_IN_NJABL_DUL NJABL: dialup sender did non-local SMTP
> >>       0.72 RCVD_IN_NJABL_PROXY NJABL: sender is an open proxy
> >>       2.05 RCVD_IN_SORBS_DUL SORBS: sent directly from dynamic IP address
> >>       2.16 RCVD_IN_SORBS_SOCKS SORBS: sender is open SOCKS proxy server
> >>
> >
> > Question: Have you checked your trust path?
> >
> > If this message wasn't direct-delivered to your network from a home-user type
> > machine, and was properly relayed through an ISP's mailserver, then you likely
> > have a broken trust path.
> >
>
> just as a side note:
>
> Had MailScanner not scanned this msg, due to its overall size, this FP
> (any possibly others) could have been easily avoided.
>
> - Supports the SpamC logic of NOT sending msgs larger than X thru SA -
>
> sorry.. had to let it out...
>
> Alex

Alex, apart from the Subject of this thread, Gordons problems have
nothing to do with size (of the message... :). So your comment is
pretty irrelevant in this context (it didn't FP due to MS clipping
somewhere in the middle).

Likely Matt is quit corerect, and this is just one of the non-obvious
ways a faulty trust path can bite you. I should've picked up on that
possibility:/. Oh well.

-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se