thr3ads.net - dovecot - sieve filter move wrong email to Junk folder [Dec 2017]

If this information is useful, please help other people find it:
Share via:

Gao

2017-Dec-14 17:47 UTC

sieve filter move wrong email to Junk folder

I use a sieve filter to move spam email to user's Junk folder:
# cat spam_to_junk.sieve
require "fileinto";
 ? if exists "X-Spam-Status" {
 ????????? if header :contains "X-Spam-Status" "YES" {
 ????????? fileinto "Junk";
 ????????? stop;
 ????????? } else {
 ????? }
 ? }
 ? if header :contains "subject" ["SPAM?"] {
 ??? fileinto "Junk";
 ??? stop;
 ? }

Most time this filter works fine but occasionally it move non-spam in to 
Junk folder. Here is an example, this email is from dovecot mailling 
list and it end up in my Junk folder. Mailllog and header here. Would 
someone help me to figure out what went wrong here?

Thanks.

Gao



=======Header========Dovecot Mailing List <dovecot at dovecot.org>
References: <c2562504-d5ae-cf3b-3e71-35ef0df15b79 at rename-it.nl>
 ?<e804da79-6bdc-fb21-8ed4-7c1385ea8936 at gmx.com>
From: sender name <sender at rename-it.nl>
Message-ID: <9100b497-7f3e-8129-9f8f-c675296e2bd7 at rename-it.nl>
Date: Thu, 14 Dec 2017 11:54:19 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 ?Thunderbird/52.5.0
MIME-Version: 1.0
In-Reply-To: <e804da79-6bdc-fb21-8ed4-7c1385ea8936 at gmx.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
X-SA-Exim-Connect-IP: 217.119.239.130
X-SA-Exim-Mail-From: sender at rename-it.nl
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on sogo.guto.nl
X-Spam-Level:
X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00
 ?autolearn=ham version=3.3.2, No
Subject: Re: New Dovecot service: SMTP Submission (RFC6409)
X-SA-Exim-Version: 4.2.1 (built Mon, 26 Dec 2011 16:24:06 +0000)
X-SA-Exim-Scanned: Yes (on sogo.guto.nl)
X-BeenThere: dovecot at dovecot.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Dovecot Mailing List <dovecot.dovecot.org>
List-Unsubscribe: <https://dovecot.org/mailman/options/dovecot>,
 ?<mailto:dovecot-request at dovecot.org?subject=unsubscribe>
List-Archive: <https://dovecot.org/pipermail/dovecot/>
List-Post: <mailto:dovecot at dovecot.org>
List-Help: <mailto:dovecot-request at dovecot.org?subject=help>
List-Subscribe: <https://dovecot.org/mailman/listinfo/dovecot>,
 ?<mailto:dovecot-request at dovecot.org?subject=subscribe>
Errors-To: dovecot-bounces at dovecot.org
Sender: "dovecot" <dovecot-bounces at dovecot.org>
X-mydomain-MailScanner-Information: Please contact the administrator for 
more information
X-mydomain-MailScanner-ID: D6773400AB09.ADBA7
X-mydomain-MailScanner: Found to be clean
X-mydomain-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
 ??? score=-4.598, required 5, autolearn=not spam, BAYES_00 -1.90,
 ??? DCC_CHECK 1.10, HEADER_FROM_DIFFERENT_DOMAINS 0.00,
 ??? KAM_LAZY_DOMAIN_SECURITY 1.00, KAM_SHORT 0.00,
 ??? RCVD_IN_DNSWL_MED -2.30, RCVD_IN_HOSTKARMA_W -2.50)
X-mydomain-MailScanner-From: dovecot-bounces at dovecot.org

=====End of header======


=======Maillog========Dec 14 02:54:51 mail postfix/postscreen[19236]: CONNECT
from
[94.237.32.243]:40818 to [10.11.22.68]:25
Dec 14 02:54:52 mail postfix/postscreen[19236]: PASS OLD 
[94.237.32.243]:40818
Dec 14 02:54:52 mail postfix/smtpd[19244]: connect from 
wursti.dovecot.fi[94.237.32.243]
Dec 14 02:54:52 mail policyd-spf[19248]: None; identity=helo; 
client-ip=94.237.32.243; helo=mail.dovecot.fi; 
envelope-from=dovecot-bounces at dovecot.org; receiver=gao at pztop.com
Dec 14 02:54:52 mail policyd-spf[19248]: None; identity=mailfrom; 
client-ip=94.237.32.243; helo=mail.dovecot.fi; 
envelope-from=dovecot-bounces at dovecot.org; receiver=gao at pztop.com
Dec 14 02:54:52 mail postfix/smtpd[19244]: D6773400AB09: 
client=wursti.dovecot.fi[94.237.32.243]
Dec 14 02:54:53 mail postfix/cleanup[19249]: D6773400AB09: hold: header 
Received: from mail.dovecot.fi (wursti.dovecot.fi [94.237.32.243])??by 
mail.mydomain.com (Postfix) with ESMTP id D6773400AB09??for 
<gao at pztop.com>; Thu, 14 Dec 2017 02:54:52 -0800 (PST) from 
wursti.dovecot.fi[94.237.32.243]; from=<dovecot-bounces at dovecot.org> 
to=<gao at pztop.com> proto=ESMTP helo=<mail.dovecot.fi>
Dec 14 02:54:53 mail postfix/cleanup[19249]: D6773400AB09: 
message-id=<9100b497-7f3e-8129-9f8f-c675296e2bd7 at rename-it.nl>
Dec 14 02:54:53 mail opendkim[1706]: D6773400AB09: wursti.dovecot.fi 
[94.237.32.243] not internal
Dec 14 02:54:53 mail opendkim[1706]: D6773400AB09: not authenticated
Dec 14 02:54:53 mail opendkim[1706]: D6773400AB09: no signature data
Dec 14 02:54:53 mail postfix/smtpd[19244]: disconnect from 
wursti.dovecot.fi[94.237.32.243] ehlo=1 mail=1 rcpt=1 data=1 quit=1 
commands=5
Dec 14 02:54:53 mail MailScanner[18700]: New Batch: Scanning 1 messages, 
7572 bytes
Dec 14 02:54:53 mail MailScanner[18700]: Virus and Content Scanning: 
Starting
Dec 14 02:54:53 mail MailScanner[18700]: Spam Checks: Starting
Dec 14 02:54:53 mail MailScanner[18700]: MailWatch: Blacklist refresh 
time reached
Dec 14 02:54:53 mail MailScanner[18700]: MailWatch: Starting up 
MailWatch SQL Blacklist
Dec 14 02:54:53 mail MailScanner[18700]: MailWatch: Read 0 blacklist entries
Dec 14 02:54:56 mail MailScanner[18700]: Requeue: D6773400AB09.ADBA7 to 
24EDE400AABD
Dec 14 02:54:56 mail MailScanner[18700]: Uninfected: Delivered 1 messages
Dec 14 02:54:56 mail postfix/qmgr[1756]: 24EDE400AABD: 
from=<dovecot-bounces at dovecot.org>, size=6784, nrcpt=1 (queue active)
Dec 14 02:54:56 mail MailScanner[18700]: Deleted 1 messages from 
processing-database
Dec 14 02:54:56 mail MailScanner[18700]: MailWatch: Logging message 
D6773400AB09.ADBA7 to SQL
Dec 14 02:54:56 mail MailScanner[18962]: MailWatch: D6773400AB09.ADBA7: 
Logged to MailWatch SQL
Dec 14 02:54:56 mail dovecot: lmtp(19259): Connect from local
Dec 14 02:54:56 mail dovecot: lmtp(gao at pztop.com): 
AHqjGYBYMlo7SwAAlqGq+A: sieve: 
msgid=<9100b497-7f3e-8129-9f8f-c675296e2bd7 at rename-it.nl>: stored mail 
into mailbox 'Junk'
Dec 14 02:54:56 mail dovecot: lmtp(19259): Disconnect from local: 
Successful quit
Dec 14 02:54:56 mail postfix/lmtp[19258]: 24EDE400AABD: 
to=<gao at pztop.com>, relay=mail.mydomain.com[private/dovecot-lmtp], 
delay=3.9, delays=3.8/0.01/0.01/0.06, dsn=2.0.0, status=sent (250 2.0.0 
<gao at pztop.com> AHqjGYBYMlo7SwAAlqGq+A Saved)
Dec 14 02:54:56 mail postfix/qmgr[1756]: 24EDE400AABD: removed
Dec 14 02:54:56 mail dovecot: indexer-worker(gao at pztop.com): Indexed 1 
messages in Junk (UIDs 11..11)
======End of Maillog======

Alex JOST

2017-Dec-15 13:36 UTC

head link

sieve filter move wrong email to Junk folder

Am 14.12.2017 um 18:47 schrieb Gao:> I use a sieve filter to move spam email to user's Junk folder:
> # cat spam_to_junk.sieve
> require "fileinto";
>  ? if exists "X-Spam-Status" {
>  ????????? if header :contains "X-Spam-Status" "YES" {
>  ????????? fileinto "Junk";
>  ????????? stop;
>  ????????? } else {
>  ????? }
>  ? }
>  ? if header :contains "subject" ["SPAM?"] {
>  ??? fileinto "Junk";
>  ??? stop;
>  ? }
> 
> Most time this filter works fine but occasionally it move non-spam in to 
> Junk folder. Here is an example, this email is from dovecot mailling 
> list and it end up in my Junk folder. Mailllog and header here. Would 
> someone help me to figure out what went wrong here?
> X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00
>  ?autolearn=ham version=3.3.2, No
AFAIK, header matching is case-insensitive. That's why 'YES' matches
'BAYES' and triggers the action.
-- 
Alex JOST

Olaf Hopp

2017-Dec-15 14:35 UTC

head link

sieve filter move wrong email to Junk folder

On 12/15/2017 02:36 PM, Alex JOST wrote:> Am 14.12.2017 um 18:47 schrieb Gao:
>> I use a sieve filter to move spam email to user's Junk folder:
>> # cat spam_to_junk.sieve
>> require "fileinto";
>> ?? if exists "X-Spam-Status" {
>> ?????????? if header :contains "X-Spam-Status"
"YES" {
>> ?????????? fileinto "Junk";
>> ?????????? stop;
>> ?????????? } else {
>> ?????? }
>> ?? }
>> ?? if header :contains "subject" ["SPAM?"] {
>> ???? fileinto "Junk";
>> ???? stop;
>> ?? }
>>
>> Most time this filter works fine but occasionally it move non-spam in
to Junk folder. Here is an example, this email is from dovecot mailling list and
it end up in my Junk folder. Mailllog and header here. Would someone help me to
figure out what went wrong here?
> 
>> X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00
>> ??autolearn=ham version=3.3.2, No
> 
> AFAIK, header matching is case-insensitive. That's why 'YES'
matches 'BAYES' and triggers the action.
So any spammer might simply add a Header "X-Spam-Status: No"
and the Mail gets into the INBOX ?

Thats why my exim / spamasssassin combination adds the
header "X-Spam-Status:" with all the various checks and
if and only if the score is above e.g. 5 points it additionally adds
the header "X-Spam-Flag: YES" .
Ham mail is not affected with this "X-Spam-Flag".

My global sieve filter only checks for the existance of
the header line - not the value. I think this can't be
circumvented by the spammers.

Regards, Olaf

-- 
Karlsruher Institut f?r Technologie (KIT)
ATIS - Abt. Technische Infrastruktur, Fakult?t f?r Informatik

Dipl.-Geophys. Olaf Hopp
- Leitung IT-Dienste -

Am Fasanengarten 5, Geb?ude 50.34, Raum 009
76131 Karlsruhe
Telefon: +49 721 608-43973
Fax: +49 721 608-46699
E-Mail: Olaf.Hopp at kit.edu
atis.informatik.kit.edu

www.kit.edu

KIT ? Die Forschungsuniversit?t in der Helmholtz-Gemeinschaft

Das KIT ist seit 2010 als familiengerechte Hochschule zertifiziert.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5304 bytes
Desc: S/MIME Cryptographic Signature
URL:
<https://dovecot.org/pipermail/dovecot/attachments/20171215/65cd1857/attachment.p7s>

Maybe Matching Threads

Search for more seemingly similar threads

dovecot - Dec 2017 - sieve filter move wrong email to Junk folder

sieve filter move wrong email to Junk folder

sieve filter move wrong email to Junk folder

sieve filter move wrong email to Junk folder

Maybe Matching Threads