<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";
mso-believe-normal-left:yes;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Courier New";
color:#1F497D;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Courier New";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><![if mso 9]><style>p.MsoNormal
{margin-left:3.0pt;}
</style><![endif]><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple style='margin-left:3.0pt;margin-top:3.0pt;margin-right:3.0pt;margin-bottom:.75pt'><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'>It might be instructive to look at the original message that Tim McCord sent to Paul Imkamp rather than just the delivery report for it. That way you could verify that the watermark went out on it. Do you have multiple paths out or just the one? Your message to gmail did look fine <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'>Rather than setting the action to high scoring spam, maybe try setting it to a value – say 1. The other spamassassin tests should push it over the top if it’s actually spam, and if it’s not, adding a little to the score shouldn’t hurt too much. Play with the score until you find a value that catches spam w/o incurring false positive. Ultimately, you can’t control what the far end does.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'>One thing though. The mail coming in lacking a watermark shouldn’t trigger the rule. My understanding is, it fires when there’s an invalid watermark AND no from user. I have many messages that don’t have anything in the “from field” (envelope from). That’s a normal thing in an NDR and such but they come right through just fine. I don’t see anything in the post on pastebin to indicate that it failed because of the watermark. Why do you think that’s the case?<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;color:#1F497D'> ...Kevin<br>--<br>Kevin Miller<br>Network/email Administrator, CBJ MIS Dept.<br>155 South Seward Street<br>Juneau, Alaska 99801<br>Phone: (907) 586-0242, Fax: (907) 586-4500<br>Registered Linux User No: 307357</span><span style='color:#1F497D'> </span><span style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'><o:p></o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] <b>On Behalf Of </b>Shawn Iverson<br><b>Sent:</b> Monday, February 24, 2014 2:54 PM<br><b>To:</b> 'MailScanner discussion'<br><b>Subject:</b> RE: Treat Invalid Watermarks with No Sender as Spam<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Segoe UI","sans-serif"'>Use Watermarking = yes<o:p></o:p></span></p></div><div><p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Segoe UI","sans-serif"'>Add Watermark = yes<br>Check Watermarks With No Sender = yes<br>Treat Invalid Watermarks With No Sender as Spam = high-scoring spam<o:p></o:p></span></p></div><div><p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Segoe UI","sans-serif"'>Check Watermarks To Skip Spam Checks = yes<br>Watermark Secret = mysecret<o:p></o:p></span></p></div><div><p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Segoe UI","sans-serif"'>Watermark Lifetime = 604800<br>Watermark Header = X-%org-name%-MailScanner-EFA-Watermark:<br><br>Message sent to my gmail from inside has a watermark...appears to be watermarking outbound emails ok.<o:p></o:p></span></p></div><div><p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Segoe UI","sans-serif"'><a href="http://pastebin.com/CmiShz59">http://pastebin.com/CmiShz59</a><o:p></o:p></span></p></div><div><p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Segoe UI","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Segoe UI","sans-serif"'>Valid Delivery Success Notification from remote server that was blocked, watermark not there...my X headers are gone...<o:p></o:p></span></p></div><div><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:0in'><span style='font-size:10.0pt;font-family:"Segoe UI","sans-serif"'><a href="http://pastebin.com/UxnAKb3F">http://pastebin.com/UxnAKb3F</a><o:p></o:p></span></p></div><div><p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Segoe UI","sans-serif"'> <o:p></o:p></span></p></div><div><div><p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Segoe UI","sans-serif"'>Shawn Iverson<br>Rush County Schools<br>District Technology Coordinator<br><a href="mailto:iversons@rushville.k12.in.us">iversons@rushville.k12.in.us</a><o:p></o:p></span></p></div><p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Segoe UI","sans-serif"'>>>> Kevin Miller <<a href="mailto:Kevin_Miller@ci.juneau.ak.us">Kevin_Miller@ci.juneau.ak.us</a>> 2/21/2014 8:23 PM >>><o:p></o:p></span></p></div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'>What are your watermark settings in MailScanner.conf? The idea behind a watermark is outbound mail gets watermarked. Bounces include the original headers so the watermark should be in it if it came from you. If there’s no watermark it implies it’s a forged NDR. (You probably already understand all that – just being pedantic.)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Courier New";color:#1F497D'>Can you check your outbound messages to verify they’re getting watermarked? Maybe post some examples to pastebin. It’s hard to say w/o seeing the actual message headers. Post your watermark settings too. Naturally you’ll want to munge the “Watermark Secret” to something other than the actual value you use.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;color:#1F497D'> ...Kevin<br>--<br>Kevin Miller<br>Network/email Administrator, CBJ MIS Dept.<br>155 South Seward Street<br>Juneau, Alaska 99801<br>Phone: (907) 586-0242, Fax: (907) 586-4500<br>Registered Linux User No: 307357</span><span style='color:#1F497D'> </span><o:p></o:p></p><p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'> <o:p></o:p></p><p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><span style='font-size:10.0pt;font-family:"Segoe UI","sans-serif"'><br>-- <br>This message has been scanned for viruses and dangerous content by <br><a href="http://www.efa-project.org"><b>E.F.A. Project</b></a>, and is believed to be clean. <o:p></o:p></span></p></div></body></html>