rejected email to list

Art Fore

29 Jun 2005 29 Jun '05

15:22

Can anyone tell me why my email is being rejected as spam from the suse mail list? : ezmlm-reject: fatal: message already has a Mailing-List header (maybe I should be a sublist) (#5.7.2) --- Below this line is a copy of the message. Return-Path: Received: (qmail 26996 invoked from network); 29 Jun 2005 15:18:38 -0000 Received: from unknown (HELO Relay2.suse.de) (195.135.221.8) by 0 with SMTP; 29 Jun 2005 15:18:38 -0000 Received: from Relay2.suse.de (localhost [127.0.0.1]) by Relay2.suse.de (Postfix) with ESMTP id 41B43451E for ; Wed, 29 Jun 2005 17:18:38 +0200 (CEST) Received: from Relay2.suse.de ([127.0.0.1]) by Relay2.suse.de (Relay2 [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 06960-09 for ; Wed, 29 Jun 2005 17:18:37 +0200 (CEST) Received: from mx2.suse.de (ns2.suse.de [195.135.220.15]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by Relay2.suse.de (Postfix) with ESMTP id 150234509 for ; Wed, 29 Jun 2005 17:18:36 +0200 (CEST) Received: from sccrmhc14.comcast.net (sccrmhc14.comcast.net [204.127.202.59]) by mx2.suse.de (Postfix) with ESMTP id 9B6951D29B for ; Wed, 29 Jun 2005 17:18:36 +0200 (CEST) Received: from [192.168.121.33] (adsl-71-129-145-33.dsl.pltn13.pacbell.net[71.129.145.33]) by comcast.net (sccrmhc14) with ESMTP id <20050629151826014003p666e>; Wed, 29 Jun 2005 15:18:32 +0000 Message-ID: <42C2BBBB.5080804@comcast.net> Date: Wed, 29 Jun 2005 08:18:19 -0700 From: Art Fore User-Agent: Mozilla Thunderbird 1.0.2 (Windows/20050317) X-Accept-Language: en-us, en MIME-Version: 1.0 To: suse-linux-e@suse.com Subject: SPAM: Evolution-Thunderbird Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new at Relay2.suse.de X-Spam-Status: Yes, hits=5.4 tagged_above=-20.0 required=5.0 tests=BAYES_80, DNS_FROM_RFC_POST, DNS_FROM_RFC_WHOIS X-Spam-Level: ***** X-Spam-Flag: YES

Show replies by date

Patrick Shanahan

29 Jun 29 Jun

15:48

New subject: [SLE] rejected email to list

* Art Fore [06-29-05 10:25]:

...

Can anyone tell me why my email is being rejected as spam from the suse mail list?

: ezmlm-reject: fatal: message already has a Mailing-List header (maybe I should be a sublist) (#5.7.2)

Appears that you have opened and edited an existing post from the list (from above: message already has....), instead of responding to the post. -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711 Photo Album: http://wahoo.no-ip.org/gallery

Art Fore

15:53

New subject: [SLE] rejected email to list

No, I did not, but I think lower down, it thinks it is spam as the X-Spam-Flag: YES. Guess it does not like Evolution and Thunderbird. Art Patrick Shanahan wrote:

...

* Art Fore [06-29-05 10:25]:

...
Can anyone tell me why my email is being rejected as spam from the suse mail list?

: ezmlm-reject: fatal: message already has a Mailing-List header (maybe I should be a sublist) (#5.7.2)

Appears that you have opened and edited an existing post from the list (from above: message already has....), instead of responding to the post.

Tim Hanson

1 Jul 1 Jul

02:22

New subject: [SLE] rejected email to list

It happened to me with kmail (reply to list only), but now it appears to be all right.

...

No, I did not, but I think lower down, it thinks it is spam as the X-Spam-Flag: YES. Guess it does not like Evolution and Thunderbird.

Art

Patrick Shanahan wrote:

...
* Art Fore [06-29-05 10:25]:

...
Can anyone tell me why my email is being rejected as spam from the suse mail list?

: ezmlm-reject: fatal: message already has a Mailing-List header (maybe I should be a sublist) (#5.7.2)

Appears that you have opened and edited an existing post from the list (from above: message already has....), instead of responding to the post.

-- All power corrupts, but we need electricity.

L. Mark Stone

29 Jun 29 Jun

16:00

New subject: [SLE] rejected email to list

On Wednesday, June 29, 2005 11:22 am, Art Fore wrote:

...

Can anyone tell me why my email is being rejected as spam from the suse mail list?

Art, Use your ISP's smtp server for outbound email in your email client, not your local postfix installation. Or, configure postfix to relay through your ISP's smtp server and not to try to send to the final destination directly. YaST > Network Services > Mail Transfer Agent > Outgoing Mail (2nd screen) insert the ip address or hostname in square brackets of your ISP's smtp server. E.g. [smtp-server.maine.rr.com] 192.168.121.33 is a private IP address; you can't have the A record behind an MX record reference a non-routable IP address, so you are not a "real" email server. Look at the spam rules that were invoked in the header: DNS. You want your email to appear to originate from an email server that is properly configured in public DNS space. That server will need an A record, an MX record, and increasingly a PTR record. Mark <snip>

...

Received: from [192.168.121.33] (adsl-71-129-145-33.dsl.pltn13.pacbell.net[71.129.145.33]) by comcast.net (sccrmhc14) with ESMTP id <20050629151826014003p666e>; Wed, 29 Jun 2005 15:18:32 <snip> X-Spam-Status: Yes, hits=5.4 tagged_above=-20.0 required=5.0 tests=BAYES_80, DNS_FROM_RFC_POST, DNS_FROM_RFC_WHOIS X-Spam-Level: ***** X-Spam-Flag: YES

-- _________________________________________________________ A Message From... L. Mark Stone Reliable Networks of Maine, LLC "We manage your network so you can manage your business." 477 Congress Street Portland, ME 04101 Tel: (207) 772-5678 Web: http://www.rnome.com

Art Fore

16:06

New subject: [SLE] rejected email to list

I am sending it with smtp.comcast.net as the mail server which I have to authenticate, same as I did this one. I am using thundrbird in windows (unfortunately windows since I am work) so it does not make any sense. Art L. Mark Stone wrote:

...

On Wednesday, June 29, 2005 11:22 am, Art Fore wrote:

...
Can anyone tell me why my email is being rejected as spam from the suse mail list?

Art, Use your ISP's smtp server for outbound email in your email client, not your local postfix installation. Or, configure postfix to relay through your ISP's smtp server and not to try to send to the final destination directly.

YaST > Network Services > Mail Transfer Agent > Outgoing Mail (2nd screen) insert the ip address or hostname in square brackets of your ISP's smtp server. E.g. [smtp-server.maine.rr.com]

192.168.121.33 is a private IP address; you can't have the A record behind an MX record reference a non-routable IP address, so you are not a "real" email server. Look at the spam rules that were invoked in the header: DNS.

You want your email to appear to originate from an email server that is properly configured in public DNS space. That server will need an A record, an MX record, and increasingly a PTR record.

Mark

<snip>

...
Received: from [192.168.121.33] (adsl-71-129-145-33.dsl.pltn13.pacbell.net[71.129.145.33]) by comcast.net (sccrmhc14) with ESMTP id <20050629151826014003p666e>; Wed, 29 Jun 2005 15:18:32

<snip>

...
X-Spam-Status: Yes, hits=5.4 tagged_above=-20.0 required=5.0 tests=BAYES_80, DNS_FROM_RFC_POST, DNS_FROM_RFC_WHOIS X-Spam-Level: ***** X-Spam-Flag: YES

Art Fore

16:10

New subject: [SLE] rejected email to list

I am sending via Tbird with mail server as smtp.comcast.net. eems like every time I spell out Tbird it get rejected. May reject Tbird too. Art L. Mark Stone wrote:

...

On Wednesday, June 29, 2005 11:22 am, Art Fore wrote:

...
Can anyone tell me why my email is being rejected as spam from the suse mail list?

Art, Use your ISP's smtp server for outbound email in your email client, not your local postfix installation. Or, configure postfix to relay through your ISP's smtp server and not to try to send to the final destination directly.

YaST > Network Services > Mail Transfer Agent > Outgoing Mail (2nd screen) insert the ip address or hostname in square brackets of your ISP's smtp server. E.g. [smtp-server.maine.rr.com]

192.168.121.33 is a private IP address; you can't have the A record behind an MX record reference a non-routable IP address, so you are not a "real" email server. Look at the spam rules that were invoked in the header: DNS.

You want your email to appear to originate from an email server that is properly configured in public DNS space. That server will need an A record, an MX record, and increasingly a PTR record.

Mark

<snip>

...
Received: from [192.168.121.33] (adsl-71-129-145-33.dsl.pltn13.pacbell.net[71.129.145.33]) by comcast.net (sccrmhc14) with ESMTP id <20050629151826014003p666e>; Wed, 29 Jun 2005 15:18:32

<snip>

...
X-Spam-Status: Yes, hits=5.4 tagged_above=-20.0 required=5.0 tests=BAYES_80, DNS_FROM_RFC_POST, DNS_FROM_RFC_WHOIS X-Spam-Level: ***** X-Spam-Flag: YES

Art Fore

16:14

New subject: [SLE] rejected email to list

Why do some emails go through and others not with no change in outgoing server? Art L. Mark Stone wrote:

...

On Wednesday, June 29, 2005 11:22 am, Art Fore wrote:

...
Can anyone tell me why my email is being rejected as spam from the suse mail list?

Art, Use your ISP's smtp server for outbound email in your email client, not your local postfix installation. Or, configure postfix to relay through your ISP's smtp server and not to try to send to the final destination directly.

YaST > Network Services > Mail Transfer Agent > Outgoing Mail (2nd screen) insert the ip address or hostname in square brackets of your ISP's smtp server. E.g. [smtp-server.maine.rr.com]

192.168.121.33 is a private IP address; you can't have the A record behind an MX record reference a non-routable IP address, so you are not a "real" email server. Look at the spam rules that were invoked in the header: DNS.

You want your email to appear to originate from an email server that is properly configured in public DNS space. That server will need an A record, an MX record, and increasingly a PTR record.

Mark

<snip>

...
Received: from [192.168.121.33] (adsl-71-129-145-33.dsl.pltn13.pacbell.net[71.129.145.33]) by comcast.net (sccrmhc14) with ESMTP id <20050629151826014003p666e>; Wed, 29 Jun 2005 15:18:32

<snip>

...
X-Spam-Status: Yes, hits=5.4 tagged_above=-20.0 required=5.0 tests=BAYES_80, DNS_FROM_RFC_POST, DNS_FROM_RFC_WHOIS X-Spam-Level: ***** X-Spam-Flag: YES

Brad Bourn

16:22

New subject: [SLE] rejected email to list

I don't know if this is the issue or not, hope it helps. I had a situation where my ISP flagged incoming list mail as spam. I was still able to get it because I ignored the headers that said it was spam. However, when I responded to a message, then my response now included the spam tag and was received as spam. Of course this didn't happen when I created a message from scratch. B=) On Wednesday 29 June 2005 10:14 am, Art Fore wrote:

...

Why do some emails go through and others not with no change in outgoing server?

Art

Jerry Feldman

19:01

New subject: [SLE] rejected email to list

On Wednesday 29 June 2005 12:14 pm, Art Fore wrote:

...

Why do some emails go through and others not with no change in outgoing server? I suspect that SuSE's SPAM filter looks at the body of the message, and somehow yours was given a high enough score to be rejected.

-- Jerry Feldman Boston Linux and Unix user group http://www.blu.org PGP key id:C5061EA9 PGP Key fingerprint:053C 73EC 3AC1 5C44 3E14 9245 FB00 3ED5 C506 1EA9

Ken Schneider

21:09

New subject: [SLE] rejected email to list

On Wed, 2005-06-29 at 15:01 -0400, Jerry Feldman wrote:

...

On Wednesday 29 June 2005 12:14 pm, Art Fore wrote:

...
Why do some emails go through and others not with no change in outgoing server? I suspect that SuSE's SPAM filter looks at the body of the message, and somehow yours was given a high enough score to be rejected.

Other items that will up the spam score is html email and email that has the date off by more than a couple of hours. -- Ken Schneider UNIX since 1989, linux since 1994, SuSE since 1998 "The day Microsoft makes something that doesn't suck is probably the day they start making vacuum cleaners." -Ernst Jan Plugge

Art Fore

22:52

New subject: [SLE] rejected email to list

I send only text email and my computer time is right on Pacific time. Art Ken Schneider wrote:

...

On Wed, 2005-06-29 at 15:01 -0400, Jerry Feldman wrote:

...
On Wednesday 29 June 2005 12:14 pm, Art Fore wrote:

...
Why do some emails go through and others not with no change in outgoing server?

I suspect that SuSE's SPAM filter looks at the body of the message, and somehow yours was given a high enough score to be rejected.

Other items that will up the spam score is html email and email that has the date off by more than a couple of hours.

Carlos E. R.

30 Jun 30 Jun

03:31

New subject: [SLE] rejected email to list

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Wednesday 2005-06-29 at 08:22 -0700, Art Fore wrote:

...

Can anyone tell me why my email is being rejected as spam from the suse mail list?

Yes... kind of. I have seen it quite often :-( The reason given is not the real reason:

...

: ezmlm-reject: fatal: message already has a Mailing-List header (maybe I should be a sublist) (#5.7.2)

This other is the real reason.

...

Subject: SPAM: Evolution-Thunderbird Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new at Relay2.suse.de X-Spam-Status: Yes, hits=5.4 tagged_above=-20.0 required=5.0 tests=BAYES_80, DNS_FROM_RFC_POST, DNS_FROM_RFC_WHOIS X-Spam-Level: ***** X-Spam-Flag: YES

The amavis filter at Relay2.suse.de flags your email as spam. You are triggering three notches: BAYES_80 score 0 0 3.608 2.0 DNS_FROM_RFC_POST score 0 1.376 0 1.614 DNS_FROM_RFC_WHOIS score 0 0.492 0 0.296 total: 3.91 No, they must be using an older version; 3.0.2 perhaps? score BAYES_80 0 0 3.608 2.087 score DNS_FROM_RFC_POST 0 1.376 0 1.614 score DNS_FROM_RFC_WHOIS 0 0.492 0 0.296 total: 3.997 Well, they may be using an altered scoring. What can you do about it? Let us see. describe DNS_FROM_RFC_POST Envelope sender in postmaster.rfc-ignorant.org describe DNS_FROM_RFC_WHOIS Envelope sender in whois.rfc-ignorant.org Heh! It seems your ISP is an ignorant of the rfc. Exactly why, I dunno. Perhaps browsing in those addresses would yield some info. About the bayes_80... I posted here about that a few days back, so find out that thread, and send your rejection email to this list admin (-owner), because they are studying that thing right now, as far as I know. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFCw2entTMYHG2NR9URAuB8AJsEcVgnXvVzzvQqBmmyoEL1p+ACLQCfazFN lhODBJpSlPzghVKLGtjVta8= =yEBN -----END PGP SIGNATURE-----

Ken Schneider

12:27

New subject: [SLE] rejected email to list

On Thu, 2005-06-30 at 05:31 +0200, Carlos E. R. wrote:

...

The amavis filter at Relay2.suse.de flags your email as spam. You are triggering three notches:

BAYES_80 score 0 0 3.608 2.0 DNS_FROM_RFC_POST score 0 1.376 0 1.614 DNS_FROM_RFC_WHOIS score 0 0.492 0 0.296 total: 3.91

No, they must be using an older version; 3.0.2 perhaps?

score BAYES_80 0 0 3.608 2.087 score DNS_FROM_RFC_POST 0 1.376 0 1.614 score DNS_FROM_RFC_WHOIS 0 0.492 0 0.296 total: 3.997

Well, they may be using an altered scoring. What can you do about it? Let us see.

describe DNS_FROM_RFC_POST Envelope sender in postmaster.rfc-ignorant.org describe DNS_FROM_RFC_WHOIS Envelope sender in whois.rfc-ignorant.org

The MAJOR problem with this is they (rfc-ignorant.org) expect everyone, including spammers, to play nice and not send spam to the postmaster address. They also expect the spammers to play nice and not harvest addresses from the whois data bases. This is the reason that rfc-ignorant.org is going to have problems. Perhaps someone needs to add their postmaster or abuse address to a spam list and see how fast they shutdown the addresses. You cannot fight the spammers by simply playing fair because the spammers never will play fair. Because of this poeple are going to hide their whois contact info or use phony info and they will block their postmaster and abuse address. -- Ken Schneider UNIX since 1989, linux since 1994, SuSE since 1998 "The day Microsoft makes something that doesn't suck is probably the day they start making vacuum cleaners." -Ernst Jan Plugge

Carlos E. R.

12:53

New subject: [SLE] rejected email to list

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Thursday 2005-06-30 at 08:27 -0400, Ken Schneider wrote:

...

...
describe DNS_FROM_RFC_POST Envelope sender in postmaster.rfc-ignorant.org describe DNS_FROM_RFC_WHOIS Envelope sender in whois.rfc-ignorant.org

The MAJOR problem with this is they (rfc-ignorant.org) expect everyone, including spammers, to play nice and not send spam to the postmaster address. They also expect the spammers to play nice and not harvest addresses from the whois data bases. This is the reason that rfc-ignorant.org is going to have problems. Perhaps someone needs to add their postmaster or abuse address to a spam list and see how fast they shutdown the addresses.

I don't understand. Could you expand on it? I mean, why rfc-ignorant.org list or not list a server? I don't know what they do and why. A link, perhaps? I can guess from what you said that comcast has removed the postmaster address, and then rfc-ignorant.org list them. Is that it?

...

You cannot fight the spammers by simply playing fair because the spammers never will play fair. Because of this poeple are going to hide their whois contact info or use phony info and they will block their postmaster and abuse address.

Mmm. But mailers send automatically bounces to those addresses. They must exist! Else, other servers will have secondary bounces. Not that it does matter... I think many server, including major ISPs just dump email sent to postmaster... and that's why, many times, they are included in RBL lists, because they do not respond to spam related complaints. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFCw+tHtTMYHG2NR9URAiF/AJ92IEkRFeL2zmfF3Nx9RxF1CLBTUQCeIZ5y 3Q9CJy+FN3cmh0DC2yI71RQ= =X8zs -----END PGP SIGNATURE-----

Ken Schneider

14:27

New subject: [SLE] rejected email to list

On Thu, 2005-06-30 at 14:53 +0200, Carlos E. R. wrote:

...

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

The Thursday 2005-06-30 at 08:27 -0400, Ken Schneider wrote:

...
...
describe DNS_FROM_RFC_POST Envelope sender in postmaster.rfc-ignorant.org describe DNS_FROM_RFC_WHOIS Envelope sender in whois.rfc-ignorant.org

The MAJOR problem with this is they (rfc-ignorant.org) expect everyone, including spammers, to play nice and not send spam to the postmaster address. They also expect the spammers to play nice and not harvest addresses from the whois data bases. This is the reason that rfc-ignorant.org is going to have problems. Perhaps someone needs to add their postmaster or abuse address to a spam list and see how fast they shutdown the addresses.

I don't understand. Could you expand on it? I mean, why rfc-ignorant.org list or not list a server? I don't know what they do and why. A link, perhaps?

Because they expect ALL email servers to be properly setup, which not all are. And the main problem is spammers are sending spam to abuse@some.domain, postmaster@some.domain (you fill in the domain part) and the owners of the domains receiving the spam are expected to just receive the spam with no ability to reject it (the spam that is).

...

I can guess from what you said that comcast has removed the postmaster address, and then rfc-ignorant.org list them. Is that it?

This has nothing to do directly with comcast, this is only an example of what is wrong with postmaster.rfc-ignorant.org's thinking. That domain owners are expected to accept any and all spam sent to the postmaster address with no recourse.

...

...
You cannot fight the spammers by simply playing fair because the spammers never will play fair. Because of this poeple are going to hide their whois contact info or use phony info and they will block their postmaster and abuse address.

Mmm. But mailers send automatically bounces to those addresses. They must exist! Else, other servers will have secondary bounces.

Not that it does matter... I think many server, including major ISPs just dump email sent to postmaster...

Exactly my point. what is the difference if you bounce or /dev/null email to the postmaster address? I guess in order to make my domain rfc compliant I will start accepting email again and just /dev/null it (and any other system account that receives spam including abuse). -- Ken Schneider UNIX since 1989, linux since 1994, SuSE since 1998 "The day Microsoft makes something that doesn't suck is probably the day they start making vacuum cleaners." -Ernst Jan Plugge

Patrick Shanahan

13:00

New subject: [SLE] rejected email to list

* Ken Schneider [06-30-05 07:33]: ...

...

The MAJOR problem with this is they (rfc-ignorant.org) expect everyone, including spammers, to play nice and not send spam to the postmaster address. They also expect the spammers to play nice and not harvest addresses from the whois data bases. This is the reason that rfc-ignorant.org is going to have problems.

No, rfc-ignorant.org is an rbl database which rejects posts which have non-rfc compliant headers. It is a blacklist. -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711 Photo Album: http://wahoo.no-ip.org/gallery

Ken Schneider

14:03

New subject: [SLE] rejected email to list

On Thu, 2005-06-30 at 08:00 -0500, Patrick Shanahan wrote:

...

* Ken Schneider [06-30-05 07:33]: ...

...
The MAJOR problem with this is they (rfc-ignorant.org) expect everyone, including spammers, to play nice and not send spam to the postmaster address. They also expect the spammers to play nice and not harvest addresses from the whois data bases. This is the reason that rfc-ignorant.org is going to have problems.

No, rfc-ignorant.org is an rbl database which rejects posts which have non-rfc compliant headers. It is a blacklist.

One that expects the spammers to play nice as well as everyone else. -- Ken Schneider UNIX since 1989, linux since 1994, SuSE since 1998 "The day Microsoft makes something that doesn't suck is probably the day they start making vacuum cleaners." -Ernst Jan Plugge

Ken Schneider

14:06

New subject: [SLE] rejected email to list

On Thu, 2005-06-30 at 10:03 -0400, Ken Schneider wrote:

...

On Thu, 2005-06-30 at 08:00 -0500, Patrick Shanahan wrote:

...
* Ken Schneider [06-30-05 07:33]: ...

...
The MAJOR problem with this is they (rfc-ignorant.org) expect everyone, including spammers, to play nice and not send spam to the postmaster address. They also expect the spammers to play nice and not harvest addresses from the whois data bases. This is the reason that rfc-ignorant.org is going to have problems.

No, rfc-ignorant.org is an rbl database which rejects posts which have non-rfc compliant headers. It is a blacklist.

One that expects the spammers to play nice as well as everyone else.

Also, fighting spammers is like fighting mother nature, you will never win. -- Ken Schneider UNIX since 1989, linux since 1994, SuSE since 1998 "The day Microsoft makes something that doesn't suck is probably the day they start making vacuum cleaners." -Ernst Jan Plugge

Patrick Shanahan

14:24

New subject: [SLE] rejected email to list

* Ken Schneider [06-30-05 09:12]:

...

One that expects the spammers to play nice as well as everyone else.

I do not understand your point. Spammers *frequently* deliver mail with non-rfc compliant headers. The rbl is just a manner to filter out posts which are not kosher header wise. A truer statement would be that they *expect* spammers to be sloppy. -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711 Photo Album: http://wahoo.no-ip.org/gallery

Ken Schneider

14:32

New subject: [SLE] rejected email to list

On Thu, 2005-06-30 at 09:24 -0500, Patrick Shanahan wrote:

...

* Ken Schneider [06-30-05 09:12]:

...
One that expects the spammers to play nice as well as everyone else.

I do not understand your point. Spammers *frequently* deliver mail with non-rfc compliant headers. The rbl is just a manner to filter out posts which are not kosher header wise. A truer statement would be that they *expect* spammers to be sloppy.

Actually they -hope- spammers will always be sloppy so they can be RBL'ed. What about the one's that are ligit (sorta) but provide no opt-out link? Any how this is now OT so I will not respond to any further on this subject. -- Ken Schneider UNIX since 1989, linux since 1994, SuSE since 1998 "The day Microsoft makes something that doesn't suck is probably the day they start making vacuum cleaners." -Ernst Jan Plugge

Theo v. Werkhoven

20:52

New subject: [SLE] rejected email to list

Thu, 30 Jun 2005, by suse-list@bout-tyme.net:

...

On Thu, 2005-06-30 at 08:00 -0500, Patrick Shanahan wrote:

...
* Ken Schneider [06-30-05 07:33]: ...

...
The MAJOR problem with this is they (rfc-ignorant.org) expect everyone, including spammers, to play nice and not send spam to the postmaster address. They also expect the spammers to play nice and not harvest addresses from the whois data bases. This is the reason that rfc-ignorant.org is going to have problems.

No, rfc-ignorant.org is an rbl database which rejects posts which have non-rfc compliant headers. It is a blacklist.

One that expects the spammers to play nice as well as everyone else.

No, one that expects hosts with an MX record in DNS to properly follow the RFC requirements for a mailserver. Postmaster is a "required" account, just as 'abuse' is, and having falsified info in whois nulls all rights to deliver mails send to (at least my) domain(s). Not following these RFCs is a valid reason for blacklisting IMO. Saying that 'postmaster' is sometimes abused doesn't change a thing, if you can't maintain a decent spamfilter then you shouldn't even be responsible for a mailserver. Btw: I can't remember receiving any abuse to required accounts at all, at any time. Only to usenet MessageIDs and From addresses, dictionary attacks and mal-ware combi-addresses (local part from any harvested address, combined with my domains etc). Theo -- Theo v. Werkhoven Registered Linux user# 99872 http://counter.li.org ICBM 52 13 26N , 4 29 47E. + ICQ: 277217131 SUSE 9.2 + Jabber: muadib@jabber.xs4all.nl Kernel 2.6.8 + See headers for PGP/GPG info. Claimer: any email I receive will become my property. Disclaimers do not apply.

Greg Wallace

12:25

New subject: [SLE] rejected email to list

On Wednesday, June 29, 2005 @ 7:23 AM, Art Fore wrote:

...

: ezmlm-reject: fatal: message already has a Mailing-List header (maybe I should be a sublist) (#5.7.2)

...

--- Below this line is a copy of the message.

...

Return-Path: Received: (qmail 26996 invoked from network); 29 Jun 2005 15:18:38 -0000 Received: from unknown (HELO Relay2.suse.de) (195.135.221.8) by 0 with SMTP; 29 Jun 2005 15:18:38 -0000 Received: from Relay2.suse.de (localhost [127.0.0.1]) by Relay2.suse.de (Postfix) with ESMTP id 41B43451E for ; Wed, 29 Jun 2005 17:18:38 +0200 (CEST) Received: from Relay2.suse.de ([127.0.0.1]) by Relay2.suse.de (Relay2 [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 06960-09 for ; Wed, 29 Jun 2005 17:18:37 +0200 (CEST) Received: from mx2.suse.de (ns2.suse.de [195.135.220.15]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by Relay2.suse.de (Postfix) with ESMTP id 150234509 for ; Wed, 29 Jun 2005 17:18:36 +0200 (CEST) Received: from sccrmhc14.comcast.net (sccrmhc14.comcast.net [204.127.202.59]) by mx2.suse.de (Postfix) with ESMTP id 9B6951D29B for ; Wed, 29 Jun 2005 17:18:36 +0200 (CEST) Received: from [192.168.121.33] (adsl-71-129-145-33.dsl.pltn13.pacbell.net[71.129.145.33]) by comcast.net (sccrmhc14) with ESMTP id <20050629151826014003p666e>; Wed, 29 Jun 2005 15:18:32 +0000 Message-ID: <42C2BBBB.5080804@comcast.net> Date: Wed, 29 Jun 2005 08:18:19 -0700 From: Art Fore User-Agent: Mozilla Thunderbird 1.0.2 (Windows/20050317) X-Accept-Language: en-us, en MIME-Version: 1.0 To: suse-linux-e@suse.com Subject: SPAM: Evolution-Thunderbird Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new at Relay2.suse.de X-Spam-Status: Yes, hits=5.4 tagged_above=-20.0 required=5.0 tests=BAYES_80, DNS_FROM_RFC_POST, DNS_FROM_RFC_WHOIS X-Spam-Level: ***** X-Spam-Flag: YES

This line seems to stick out -- Received: from [192.168.121.33] Why is there no name attached to 192.168.121.33? To a spam filter, it would seem it would look like it was coming from an address with no real sender (maybe like it's being generated from some sort of spam engine). Sort of like you getting a note from me and the "From" being blank. Greg Wallace

Carlos E. R.

12:47

New subject: [SLE] rejected email to list

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Thursday 2005-06-30 at 04:25 -0800, Greg Wallace wrote:

...

This line seems to stick out --

Received: from [192.168.121.33]

Why is there no name attached to 192.168.121.33? To a spam filter, it would seem it would look like it was coming from an address with no real sender (maybe like it's being generated from some sort of spam engine). Sort of like you getting a note from me and the "From" being blank.

No, that is of no consequence. The lines are: Received: from sccrmhc14.comcast.net (sccrmhc14.comcast.net [204.127.202.59]) by mx2.suse.de (Postfix) with ESMTP id 9B6951D29B for ; Wed, 29 Jun 2005 17:18:36 +0200 (CEST) Received: from [192.168.121.33] (adsl-71-129-145-33.dsl.pltn13.pacbell.net[71.129.145.33]) by comcast.net (sccrmhc14) with ESMTP id <20050629151826014003p666e>; Wed, 29 Jun 2005 15:18:32 +0000 It only means that the computer sending to comcast.net by an adsl link was on a private network. That's normal. The only server authorized to accept or reject that connection is comcast.net. Then, later (read "received" bottom-up), SuSE gets the email from comcast on a normal internet IP. No problem there. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFCw+nltTMYHG2NR9URAq6lAJ9qkatDMIJqLHh+v9XiZCZuFfi5DgCcDLou SU5XiAx033qBsIdtSJv+Lvk= =rYpY -----END PGP SIGNATURE-----

6881

Age (days ago)

6883

Last active (days ago)

List overview

Download

23 comments

10 participants

participants (10)

Art Fore
Brad Bourn
Carlos E. R.
Greg Wallace
Jerry Feldman
Ken Schneider
L. Mark Stone
Patrick Shanahan
Theo v. Werkhoven
Tim Hanson