<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
You can either include something like:<br>
<br>
score URIBL_BLACK 0.00<br>
<br>
in your /etc/mail/spamassassin/local.cf and ignore those rules, or
you can fix whatever's being added or included in your otherwise
legitimate mails that is being listed at the URIBL lists as "url's
common in spam e-mail".<br>
<br>
I'm guessing, so I'm probably wrong. But it's probably a
"disclaimer" or "signature" with a URL that's being added to most
e-mails going through your server (such as your "This electronic
mail (including any attachments) may contain information that is
privileged, confidential, and/or otherwise protected from disclosure
to anyone other than its intended recipient(s). Any dissemination or
use of this electronic email or its contents (including any
attachments) by persons other than the intended recipient(s) is
strictly prohibited. If you have received this message in error,
please notify us immediately by reply email so that we may correct
our internal records. Please then delete the original message
(including any attachments) in its entirety. Thank you.", which is
not really enforceable neither technically nor legally, and is only
a waste of electrons) - which is being sent to spamtraps and marked
as "spammy" by the URIBL lists. Unfortunately without more
information I don't think we could guess what is actually triggering
these rules.<br>
<br>
The URIBL lists work by listing known SPAM URL's... If a spammer
decides to send out spams saying "buy this thing that will make you
bigger down there" or something like that, with a URL saying "visit
soandso.com", the URIBL list will add "soandso.com" to it's
database. If another e-mail - even with a different text - comes
with "visit soandso.com" the URIBL list rules will "hit", adding an
X amount of points towards the "6" you "believe" to be the default
setting.<br>
<br>
That means something is being added - by your users, or by your
server - that triggers this rule. Without the original messages,
there's no way of knowing, especially since it's "strictly
prohibited" to disseminate this electronic mail or its contents.<br>
<br>
The fact that this happened "since yesterday" means something made
the URIBL lists "aware" of the URL's being added somewhere within
the messages (could be a signature) as something used by spammers
(not necessarily you or your server).<br>
<br>
This means that even if you score these rules as "0.0", others might
throw your messages in the junk mail folder since they still follow
the original rules.<br>
<br>
On 3/22/2011 7:47 PM, Sumit Bhattacharjee wrote:
<blockquote cite="mid:E353A70D9C0F437FB3D8479BC6020638@sl500"
type="cite">
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
<meta name="GENERATOR" content="MSHTML 8.00.6001.19019">
<div><font size="2" face="Arial"><span class="906323200-23032011">Hello
All,</span></font></div>
<div><font size="2" face="Arial"><span class="906323200-23032011"></span></font> </div>
<div><font size="2" face="Arial"><span class="906323200-23032011">I
have been using MailScanner for several months now and it
has been working very well. However, since yesterday,
almost all inbound messages are getting marked marked as
Spam. I have the SpamAssassin threshold set to 6 (default I
believe), and following are a couple of examples of the spam
report (email from different domains/IP's):</span></font></div>
<div><font size="2" face="Arial"><span class="906323200-23032011"></span></font> </div>
<div><font size="2" face="Arial"><span class="906323200-23032011">X-cospringsitcom-MailScanner-SpamCheck:
spam, SpamAssassin (not cached,<br>
score=7.983, required 6, FREEMAIL_FROM 0.00, HTML_MESSAGE
0.00,<br>
MIME_QP_LONG_LINE 0.00, RCVD_IN_DNSWL_NONE -0.00,<br>
T_TO_NO_BRKTS_FREEMAIL 0.01, URIBL_BLACK 1.77, URIBL_RED
0.00,<br>
URIBL_RHS_DOB 0.28, URIBL_SEM_FRESH 0.81,
URIBL_SEM_FRESH_10 1.01,<br>
URIBL_SEM_FRESH_15 4.10)<br>
X-cospringsitcom-MailScanner-SpamScore: 7</span></font></div>
<div><font size="2" face="Arial"><span class="906323200-23032011"></span></font> </div>
<div><font size="2" face="Arial"><span class="906323200-23032011">X-cospringsitcom-MailScanner-SpamCheck:
spam, SpamAssassin (not cached,<br>
score=9.235, required 6, HTML_MESSAGE 0.00,
RCVD_IN_DNSWL_NONE -0.00,<br>
URIBL_BLACK 1.77, URIBL_RED 0.00, URIBL_RHS_DOB 0.28,
URIBL_SEM 1.26,<br>
URIBL_SEM_FRESH 0.81, URIBL_SEM_FRESH_10 1.01,<br>
URIBL_SEM_FRESH_15 4.10, URIBL_SEM_RED 0.00)<br>
X-cospringsitcom-MailScanner-SpamScore: 9<br>
</span></font></div>
<div><font size="2" face="Arial"><span class="906323200-23032011">The
commonality that I am seeing is that the URIBL_BLACK is
1.77 for almost all messages and URIBL_SEM_FRESH_15 is
4.10. But I am not sure what has changed (nothing should
have).</span></font></div>
<div><font size="2" face="Arial"><span class="906323200-23032011"></span></font> </div>
<div><font size="2" face="Arial"><span class="906323200-23032011">I'd
much appreciate any debugging steps recommended by experts
on this list.</span></font></div>
<div><font size="2" face="Arial"><span class="906323200-23032011"></span></font> </div>
<div><font size="2" face="Arial"><span class="906323200-23032011">Regards,</span></font></div>
<div><font size="2" face="Arial"><span class="906323200-23032011">Sumit
Bhattacharjee</span></font></div>
<br>
<p style="font-family: arial; color: blue; font-size: 10px;">This
electronic mail (including any attachments) may contain
information that is privileged, confidential, and/or otherwise
protected from disclosure to anyone other than its intended
recipient(s). Any dissemination or use of this electronic email
or its contents (including any attachments) by persons other
than the intended recipient(s) is strictly prohibited. If you
have received this message in error, please notify us
immediately by reply email so that we may correct our internal
records. Please then delete the original message (including any
attachments) in its entirety. Thank you.</p>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Alex Neuman van der Hans
Reliant Technologies / Vida Digital
<a class="moz-txt-link-freetext" href="http://vidadigital.com.pa/">http://vidadigital.com.pa/</a>
+507-6781-9505
+507-832-6725
+1-440-253-9789 (USA)
Follow @AlexNeuman on Twitter
<a class="moz-txt-link-freetext" href="http://facebook.com/vidadigital">http://facebook.com/vidadigital</a></pre>
</body>
</html>