Trouble with mails from Blackberry

[Mark Sapiro]

On 06/08/2017 09:10 AM, Gao wrote:
> 
> There are several cases that MailScanner give high score for incoming
> email send from Blackberry device. I don't know how to deal with this. I
> set the spam score is 5.0 and those blackberry email seems always get
> identified as spam.


What version of SpamAssassin is this?


...>
envelope-from="SRS0=HaG/vD=5N=mydomain.com=gjv at srs.bis6.us.blackberry.com";
...
> Jun  7 23:16:32 zeta MailScanner[27196]: Message 449B320030FB3.A5EA6
> from 74.82.85.4
> (srs0=hag/vd=5n=mydomain.com=gjv at srs.bis6.us.blackberry.com) to
> mydomain.com is spam, SpamAssassin (not cached, score=5.08, required 4,
> BAYES_00 -1.90, FSL_HELO_BARE_IP_2 1.00, HEADER_FROM_DIFFERENT_DOMAINS
> 1.00, RATWARE_EFROM 3.00, RCVD_IN_DNSWL_NONE -0.00, RDNS_DYNAMIC 0.98,
> SPF_PASS -0.00, XPRIO_SHORT_SUBJ 1.00)


Your largest score is RATWARE_EFROM 3.00. Without it the message would
score 2.08.

The reason I ask about version is this score comes from

Mail::SpamAssassin::Plugin::HeaderEval::check_ratware_envelope_from()

Which in SA 3.4.1 at least has

return 0 if $from =~ /^SRS\d=/;

per
<https://fossies.org/dox/Mail-SpamAssassin-3.4.1/classMail_1_1SpamAssassin_1_1Plugin_1_1HeaderEval.html#ab8531c37621db88b28eb3c7dc5c97d58>

which seems to be designed to exempt envelope senders beginning with
SRS, a digit and = as this message does.

If the issue is an older SA and you can't upgrade, you can always set
the score for RATWARE_EFROM to zero.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan