Trouble with mails from Blackberry

[Gao]

On 2017-06-08 01:02 PM, Mark Sapiro wrote:
> On 06/08/2017 09:10 AM, Gao wrote:
>> There are several cases that MailScanner give high score for incoming
>> email send from Blackberry device. I don't know how to deal with this. I
>> set the spam score is 5.0 and those blackberry email seems always get
>> identified as spam.
>
> What version of SpamAssassin is this?
>
>
> ...>
> envelope-from="SRS0=HaG/vD=5N=mydomain.com=gjv at srs.bis6.us.blackberry.com";
> ...
>> Jun  7 23:16:32 zeta MailScanner[27196]: Message 449B320030FB3.A5EA6
>> from 74.82.85.4
>> (srs0=hag/vd=5n=mydomain.com=gjv at srs.bis6.us.blackberry.com) to
>> mydomain.com is spam, SpamAssassin (not cached, score=5.08, required 4,
>> BAYES_00 -1.90, FSL_HELO_BARE_IP_2 1.00, HEADER_FROM_DIFFERENT_DOMAINS
>> 1.00, RATWARE_EFROM 3.00, RCVD_IN_DNSWL_NONE -0.00, RDNS_DYNAMIC 0.98,
>> SPF_PASS -0.00, XPRIO_SHORT_SUBJ 1.00)
>
> Your largest score is RATWARE_EFROM 3.00. Without it the message would
> score 2.08.
>
> The reason I ask about version is this score comes from
>
> Mail::SpamAssassin::Plugin::HeaderEval::check_ratware_envelope_from()
>
> Which in SA 3.4.1 at least has
>
> return 0 if $from =~ /^SRS\d=/;
>
> per
> <https://fossies.org/dox/Mail-SpamAssassin-3.4.1/classMail_1_1SpamAssassin_1_1Plugin_1_1HeaderEval.html#ab8531c37621db88b28eb3c7dc5c97d58>
>
> which seems to be designed to exempt envelope senders beginning with
> SRS, a digit and = as this message does.
>
> If the issue is an older SA and you can't upgrade, you can always set
> the score for RATWARE_EFROM to zero.
>
Thank you for the help.
I am using SpamAssassin Version:3.4.0. I am not sure where to check for 
the code you mentioned. I'll make a rule to adjust the RATWARE_EFROM score.

Gao
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20170612/9ca5fd13/attachment.html>