Watermarking questions

Fri Sep 14 18:05:50 IST 2007

Hello everybody,

Like many users I've bumped into the new watermarking false-positives
issue. Now I'm a mailing list subscriber :)
First, a complaint. Why can't any of the developpers find a 5 minute
slot to create a simple wiki entry to explain the feature and it's
caveats and save all of us newbies half hour (=2 month) of flashbacking
in the mailing list archives? Just a couple of lines that show up when
you search for watermark in the wiki.

I've been looking at some of the false positives after disabling the
"Treat Invalid Watermarks With No Sender as Spam" option. I was
experiencing problems with my server wich is a incoming and outgoing
relay (postfix + fecthmail). The server I relay mail to/from (wich I
don't control) is also running spamassassin with qmail, and is probably
responsible for the header's removal. I've noticed that the watermark
header isn't present in the bounce-message's headers but it's still in
the original message's header.

Is this setup supose to work?
Does the watermark engine search for the watermark in the original
message or only in the destination/relay server's message reply?
If the server I relay mail to/from starts using watermarking will all my
messages be flagged as spam?

False positive message follows (notice that neither Outlook or Exchange
are present):

(CEST)
Received: (qmail 25899 invoked by uid 2526); 13 Sep 2007 18:22:25 +0200
Received: from 127.0.0.1 by XXXXXXXXXXXX (envelope-from <>, uid 2522)
with qmail-scanner-2.01st (clamdscan: 0.90.2/4260. spamassassin: 3.1.9.
perlscan: 2.01st. Clear:RC:1(127.0.0.1):. Processed in 0.105389 secs);
13 Sep 2007 16:22:25 -0000
Date: 13 Sep 2007 18:22:25 +0200
From: MAILER-DAEMON at XXXXXXXX
To: XXXXX at XXXXXXX
Subject: failure notice
X-Qmail-Scanner-Message-ID: <118970054599325891 at XXXXXXXXX>
Message-Id: <20070913162453.32D9F6E0001 at XXXXXXXXX>

Hi. This is the qmail-send program at XXXXXXXXXXXXXX.
I'm afraid I wasn't able to deliver your message to the following
addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

<XXXXX at XXXXXXXXXXX>:
XXXXXXXXXXXXX does not like recipient.
Remote host said: 550 RCPT TO:<XXXXXXXX at XXXXXXXXXXXXXX> User unknown
Giving up on XXXXXXXXXXX.

--- Below this line is a copy of the message.

Return-Path: <XXXX at XXXXXXX>
Received: (qmail 25884 invoked by uid 2526); 13 Sep 2007 18:22:23 +0200
Received: from XXXXXX by XXXXXX (envelope-from <XXXXX at XXXX>, uid 2020) with qmail-scanner-2.01st 
 (clamdscan: 0.90.2/4260. spamassassin: 3.1.9. perlscan: 2.01st.  
 Clear:RC:0(XXXXXXXXX):SA:0(-1.2/7.0):. 
 Processed in 14.880337 secs); 13 Sep 2007 16:22:23 -0000
X-Spam-Status: No, hits=-1.2 required=7.0
Received: from XXXXXXXXXXXXXX (HELO XXXXXXXXX) (XXXXXXXXXXX)
  by XXXXXXXXXXXX with SMTP; 13 Sep 2007 18:22:07 +0200
Received: from [127.0.0.1] (unknown [192.168.1.8])
	by XXXXXXXXXXXXX (Postfix) with ESMTP id EF0886E0001
	for <XXXXXXXXXXXXX>; Thu, 13 Sep 2007 18:21:55 +0200
(CEST)
Message-ID: <46E96340.8000703 at XXXXXXXXXXXX>
Date: Thu, 13 Sep 2007 18:20:16 +0200
From:  XXXXXXX at XXXXXXXXX
User-Agent: Thunderbird 2.0.0.6 (Windows/20070728)
MIME-Version: 1.0
To: xxx <XXX at XXXXXXXXXXX>
Subject: blablabla
Content-Type: multipart/mixed;
 boundary="------------000606020001090209010502"
X-MyDomain-MailScanner-Watermark: 1190305315.99936 at NxseHU+Nufs+D87fwdbY8A

....EOF...

Sorry for the long mail and thanks for your time,

João Mota

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 187 bytes
Desc: OpenPGP digital signature
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070914/f96b8bdb/signature.bin