<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi,<br>
<br>
There are several cases that MailScanner give high score for
incoming email send from Blackberry device. I don't know how to deal
with this. I set the spam score is 5.0 and those blackberry email
seems always get identified as spam.<br>
<br>
Should I make a custom rule to lower the score for all mail from
"blackberry.com"? Please help.<br>
<br>
For example, here is an email's (spam score 5.08) header:<br>
<font face="Courier New, Courier, monospace">Received-SPF: pass
(srs.bis6.us.blackberry.com: 74.82.85.4 is authorized to use
'<a class="moz-txt-link-abbreviated" href="mailto:SRS0=HaG/vD=5N=mydomain.com=gjv@srs.bis6.us.blackberry.com">SRS0=HaG/vD=5N=mydomain.com=gjv@srs.bis6.us.blackberry.com</a>' in
'mfrom' identity (mechanism 'ip4:74.82.64.0/19' matched))
receiver=zeta.mydomain.com; identity=mailfrom;
envelope-from=<a class="moz-txt-link-rfc2396E" href="mailto:SRS0=HaG/vD=5N=mydomain.com=gjv@srs.bis6.us.blackberry.com">"SRS0=HaG/vD=5N=mydomain.com=gjv@srs.bis6.us.blackberry.com"</a>;
helo=smtp04.bis6.na.blackberry.com; client-ip=74.82.85.4<br>
Received: from smtp04.bis6.na.blackberry.com
(74-82-85-4.rdns.blackberry.net [74.82.85.4])<br>
by zeta.mydomain.com (Postfix) with ESMTP id 449B320030FB3<br>
for <a class="moz-txt-link-rfc2396E" href="mailto:gjv@mydomain.com"><gjv@mydomain.com></a>; Wed, 7 Jun 2017 23:16:25 -0700
(PDT)<br>
Received: from b2.c1.bise6.blackberry ([192.168.0.102])<br>
by srs.bis6.us.blackberry.com (8.13.7 TEAMON/8.13.7) with
ESMTP id v586GO8v012308<br>
for <a class="moz-txt-link-rfc2396E" href="mailto:gjv@mydomain.com"><gjv@mydomain.com></a>; Thu, 8 Jun 2017 06:16:24 GMT<br>
Received: from 172.29.194.175 (cmp5.c1.bise6.blackberry
[172.29.194.175])<br>
by b2.c1.bise6.blackberry (8.13.7 TEAMON/8.13.7) with ESMTP
id v586GNj0000839<br>
for <a class="moz-txt-link-rfc2396E" href="mailto:gjv@mydomain.com"><gjv@mydomain.com></a>; Thu, 8 Jun 2017 06:16:23 GMT<br>
X-rim-org-msg-ref-id: 586172512<br>
Disposition-Notification-To: <a class="moz-txt-link-abbreviated" href="mailto:gjv@mydomain.com">gjv@mydomain.com</a><br>
Message-ID:
<a class="moz-txt-link-rfc2396E" href="mailto:586172512-1496902582-cardhu_decombobulator_blackberry.rim.net-658104992-@b14.c1.bise6.blackberry"><586172512-1496902582-cardhu_decombobulator_blackberry.rim.net-658104992-@b14.c1.bise6.blackberry></a><br>
Reply-To: <a class="moz-txt-link-abbreviated" href="mailto:gjv@mydomain.com">gjv@mydomain.com</a><br>
X-Priority: Normal<br>
Sensitivity: Normal<br>
Importance: Normal<br>
Subject: Keys<br>
To: "First Last" <a class="moz-txt-link-rfc2396E" href="mailto:gjv@mydomain.com"><gjv@mydomain.com></a><br>
From: <a class="moz-txt-link-abbreviated" href="mailto:gjv@mydomain.com">gjv@mydomain.com</a><br>
Date: Thu, 8 Jun 2017 06:16:22 +0000<br>
Content-Type: text/plain<br>
MIME-Version: 1.0</font><br>
<br>
And the maillog:<br>
<font face="Courier New, Courier, monospace">Jun 7 23:16:25 zeta
postfix/smtpd[28147]: connect from
74-82-85-4.rdns.blackberry.net[74.82.85.4]<br>
Jun 7 23:16:26 zeta postfix/policy-spf[28155]: Policy
action=PREPEND Received-SPF: pass (srs.bis6.us.blackberry.com:
74.82.85.4 is authorized to use
'<a class="moz-txt-link-abbreviated" href="mailto:SRS0=HaG/vD=5N=mydomain.com=gjv@srs.bis6.us.blackberry.com">SRS0=HaG/vD=5N=mydomain.com=gjv@srs.bis6.us.blackberry.com</a>' in
'mfrom' identity (mechanism 'ip4:74.82.64.0/19' matched))
receiver=zeta.mydomain.com; identity=mailfrom;
envelope-from=<a class="moz-txt-link-rfc2396E" href="mailto:SRS0=HaG/vD=5N=mydomain.com=gjv@srs.bis6.us.blackberry.com">"SRS0=HaG/vD=5N=mydomain.com=gjv@srs.bis6.us.blackberry.com"</a>;
helo=smtp04.bis6.na.blackberry.com; client-ip=74.82.85.4<br>
Jun 7 23:16:26 zeta postfix/smtpd[28147]: 449B320030FB3:
client=74-82-85-4.rdns.blackberry.net[74.82.85.4]<br>
Jun 7 23:16:26 zeta postfix/cleanup[28159]: 449B320030FB3: hold:
header Received: from smtp04.bis6.na.blackberry.com
(74-82-85-4.rdns.blackberry.net [74.82.85.4])??by
zeta.mydomain.com (Postfix) with ESMTP id 449B320030FB3??for
<a class="moz-txt-link-rfc2396E" href="mailto:gjv@mydomain.com"><gjv@mydomain.com></a>; Wed, 7 Jun 2017 from
74-82-85-4.rdns.blackberry.net[74.82.85.4];
from=<a class="moz-txt-link-rfc2396E" href="mailto:SRS0=HaG/vD=5N=mydomain.com=gjv@srs.bis6.us.blackberry.com"><SRS0=HaG/vD=5N=mydomain.com=gjv@srs.bis6.us.blackberry.com></a>
to=<a class="moz-txt-link-rfc2396E" href="mailto:gjv@mydomain.com"><gjv@mydomain.com></a> proto=ESMTP
helo=<smtp04.bis6.na.blackberry.com><br>
Jun 7 23:16:26 zeta postfix/cleanup[28159]: 449B320030FB3:
message-id=<a class="moz-txt-link-rfc2396E" href="mailto:586172512-1496902582-cardhu_decombobulator_blackberry.rim.net-658104992-@b14.c1.bise6.blackberry"><586172512-1496902582-cardhu_decombobulator_blackberry.rim.net-658104992-@b14.c1.bise6.blackberry></a><br>
Jun 7 23:16:26 zeta opendkim[2218]: 449B320030FB3:
74-82-85-4.rdns.blackberry.net [74.82.85.4] not internal<br>
Jun 7 23:16:26 zeta opendkim[2218]: 449B320030FB3: not
authenticated<br>
Jun 7 23:16:26 zeta opendkim[2218]: 449B320030FB3: no signature
data<br>
Jun 7 23:16:31 zeta postfix/smtpd[28147]: disconnect from
74-82-85-4.rdns.blackberry.net[74.82.85.4]<br>
Jun 7 23:16:32 zeta MailScanner[27196]: Message
449B320030FB3.A5EA6 from 74.82.85.4
(<a class="moz-txt-link-abbreviated" href="mailto:srs0=hag/vd=5n=mydomain.com=gjv@srs.bis6.us.blackberry.com">srs0=hag/vd=5n=mydomain.com=gjv@srs.bis6.us.blackberry.com</a>) to
mydomain.com is spam, SpamAssassin (not cached, score=5.08,
required 4, BAYES_00 -1.90, FSL_HELO_BARE_IP_2 1.00,
HEADER_FROM_DIFFERENT_DOMAINS 1.00, RATWARE_EFROM 3.00,
RCVD_IN_DNSWL_NONE -0.00, RDNS_DYNAMIC 0.98, SPF_PASS -0.00,
XPRIO_SHORT_SUBJ 1.00)<br>
Jun 7 23:16:32 zeta MailScanner[27196]: Spam Checks: Found 1 spam
messages<br>
Jun 7 23:16:32 zeta MailScanner[27196]: Spam Actions: message
449B320030FB3.A5EA6 actions are store<br>
Jun 7 23:16:32 zeta MailScanner[27196]: Deleted 1 messages from
processing-database<br>
Jun 7 23:16:32 zeta MailScanner[27196]: Logging message
449B320030FB3.A5EA6 to SQL<br>
Jun 7 23:16:32 zeta MailScanner[27636]: 449B320030FB3.A5EA6:
Logged to MailWatch SQL</font><br>
<br>
</body>
</html>