Problem with Spamassassin dynamic IP blocking.

nima · Dec 9, 2005

Hi,

I use plesk 7.5.4 with Spamassassin in following versions :
- psa 7.5.4-fc2.build75050824.12
- psa-spamassassin 7.5.4-fc2.build75050927.15

The problem is that SA marks as spam mails from legitimate users.
I have this problem with my own mails when using my plesk box SMTP server to send mails from home. I tested to send myself a mail using this SMTP configuration.
At home I have a cabled connection and so a dynamic IP. When I use my ISP's SMTP, my mails are not marked as spam by SA, but when using my plesk box SMTP, it marks it as spam.
How is it possible ?
I send bellow headers for mails marked as spam and headers for emails not marked. (replaced sender mail by [email protected], recipient mail by [email protected], my smtp server name by nsxxx.ovh.net and my dynamic IP on the cable network by 81.64.184.xxx)

Thanks for all !

Code:

From: Lisa-Joan <[email protected]>
To: Nicolas <[email protected]>
Subject: *****SPAM***** Re: [Fwd: Re: Salon du livre jeunesse.]
Date: Fri, 25 Nov 2005 15:20:30 +0100
Message-Id: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_43871C90.337AC05A"

This is a multi-part message in MIME format.

------------=_43871C90.337AC05A
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: 8bit

Content preview:  bla bla  [...] 

Content analysis details:   (5.3 points, 3.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 0.8 HTML_30_40             BODY: Message is 30% to 40% HTML
 0.0 HTML_MESSAGE           BODY: HTML included in message
 0.1 HTML_TAG_EXISTS_TBODY  BODY: HTML has "tbody" tag
 0.5 HTML_TITLE_EMPTY       BODY: HTML title contains no text
 0.1 HTML_FONTCOLOR_RED     BODY: HTML font color is red
 1.1 MAILTO_TO_SPAM_ADDR    URI: Includes a link to a likely spammer email
 2.5 RCVD_IN_DYNABLOCK      RBL: Sent directly from dynamic IP address
                            [81.64.184.xxx listed in dnsbl.sorbs.net]
 0.1 RCVD_IN_SORBS          RBL: SORBS: sender is listed in SORBS
                            [81.64.184.xxx listed in dnsbl.sorbs.net]

------------=_43871C90.337AC05A
Content-Type: message/rfc822; x-spam-type=original
Content-Description: original message before SpamAssassin
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit

Received: (qmail 12244 invoked from network); 25 Nov 2005 15:15:44 +0100
Received: from mxxx.net81-64-184.noos.fr (HELO ?192.168.0.4?) (81.64.184.xxx)
  by nsxxx.ovh.net.161.251.213.in-addr.arpa with SMTP; 25 Nov 2005 15:15:44 +0100
Message-ID: <[email protected]>
Date: Fri, 25 Nov 2005 15:20:30 +0100
From: Lisa-Joan <xxxxxxxxxx.xxx>
User-Agent: Thunderbird 1.5 (Windows/20051025)
MIME-Version: 1.0
To: Nicolas <[email protected]>
Subject: Re: [Fwd: Re: Salon du livre jeunesse.]
References: <[email protected]>
In-Reply-To: <[email protected]>
Content-Type: multipart/alternative;
 boundary="------------020206030602000804030708"

cmaxwell · Dec 9, 2005

This page should have the answer that you are looking for:

http://wiki.apache.org/spamassassin/DynablockIssues

Because SpamAssassin knows your IP is in a dynamic block of IPs from your ISP, this creates a positive score on your spam hits.

SpamAssassin is smart, because a lot of spammers use their home broadband connections because they think their ISP will not notice.

Therefore it is in your best interests to continue to use the Dynablock list in SpamAssassin but add your ISP's block of addresses as a trusted network (instructions in the link above).

- Chris

nima · Dec 9, 2005

Thanks Chris,

I think the issues "I'm an ISP, and mails from our customers, using authenticated connections..." and "I'm not an ISP, but I do have a mail server ..." answers my problem, I just have to try that.

Problem with Spamassassin dynamic IP blocking.

nima

Guest

cmaxwell

Regular Pleskian

nima

Guest

Similar threads