Improve spam score check

[dagelf]

Delivered-To: [email protected]
Received: by 2002:ac8:2b39:0:0:0:0:0 with SMTP id 54csp899310qtu;
Sat, 16 Mar 2019 15:49:54 -0700 (PDT)
X-Google-Smtp-Source: APXvYqwOeHT0oocITXgX8uR9/drVkOg56ZbltCLxDHCm6hZ6Q09MyD9QaJt9ZzWl5oA9aWIm02wE
X-Received: by 2002:aed:21cc:: with SMTP id m12mr8288539qtc.203.1552776594041;
Sat, 16 Mar 2019 15:49:54 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; t=1552776594; cv=none;
d=google.com; s=arc-20160816;
b=0hYFDHRxy2JIH/5/l0FBX55yF7bDoXRq1qrJOZCfQyIW4U33o5jmoWWr6I2dj36mYf
DguIj9OnyIMNa7IqpVhWe7pPv68cHU3nIDriuqpjJSk2VQjOw+AoPOWVQS5twrCAsNR1
qXq7a10sD/6RUP+o3y4Wdbo8hz9OjdvOCL6j0r3qUvYcrA5xt+0jvVl/zrLj7Wu4bo3G
GiqFa8lgA3eiq6gAY7g19DpdS0G7rDz/z1JKZUtiX9cgo9YM0Ieo/Cc8mNr01q/LrqQV
TlKCau7E/ED0e+EHdcyPffzYVwiRXHaboS5d6PSRFYdK9GIwuo4fsj/HPx77YetCI0E5
8nDQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
h=mime-version:date:message-id:subject:to:from
:content-transfer-encoding:dkim-signature;
bh=TZJ4wcQ0Zg92CFIu1eoWovpdQzLmEdTZMgVmtMKGpoc=;
b=Hy89KsGHIDyvOTz7/Z5ZFeUHuVGe80QPzoKw8hxBzV/85GHZMmlB6kgaB3DD1BffYK
0iPUCBm+Y06EAlZ8ym/cfvACJig42N1XWcP63u9LGXRDz1Cfqpaw3ORI6gJbzH4IYtoA
EHOO7HKF4O0XCdpnFUidPaXBjUoVTGbQgteSAlwcrYUTejqHEY6FV9rwKmmOfWwDuouN
8sRYfbNCHfTj2h+lXj4Wwrti4/g6Wi1J0T/Ki7GkMO7VYEL+jJGTlf87XnXktS++z4bT
OJRuzNwS8H7RvsG3NdWYZMajm+v4NDAUz2LI7Fk4USqYVZl3x3iLna9pmBLMJFOBfOUO
qnRw==
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass [email protected] header.s=default header.b=TdxCL3HK;
spf=pass (google.com: domain of [email protected] designates 178.128.149.101 as permitted sender) smtp.mailfrom=[email protected];
dmarc=pass (p=REJECT sp=NONE dis=NONE) header.from=forwardemail.net
Return-Path: [email protected]
Received: from mx1.forwardemail.net (mx1.forwardemail.net. [178.128.149.101])
by mx.google.com with ESMTPS id d14si71057qkl.100.2019.03.16.15.49.53
for [email protected]
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Sat, 16 Mar 2019 15:49:54 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 178.128.149.101 as permitted sender) client-ip=178.128.149.101;
Authentication-Results: mx.google.com;
dkim=pass [email protected] header.s=default header.b=TdxCL3HK;
spf=pass (google.com: domain of [email protected] designates 178.128.149.101 as permitted sender) smtp.mailfrom=[email protected];
dmarc=pass (p=REJECT sp=NONE dis=NONE) header.from=forwardemail.net
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=forwardemail.net; q=dns/txt; s=default; bh=TZJ4wcQ0Zg92CFIu1eoWovpdQzLmEdTZMgVmtMKGpoc=; h=from:subject:date:message-id:to:mime-version:content-type:content-transfer-encoding; b=TdxCL3HKn0gPnA4/mqvuoypP0Ii1YbaJDlHbvbU6v7o45Jmq+kz508HGXLNFADo2uxLtkGJN8 w3mUmTsUOq1HiCrk3mugAzF8l8qFJGCFfLA1+M8HrSgPhC17QxQye8JRAictHPVvXRNCeoKvbnG xCMCo6izZhrTdHG5DrOzlxg=
Content-Type: text/plain
Received: from [167.88.7.7] (unknown [167.88.7.7]) by pub.localdomain (Postfix) with ESMTPA id D8731648A004 for [email protected]; Sat, 16 Mar 2019 22:29:29 +0000 (UTC)
X-Bounce-Tracking-Info: <aWRlYXRlCQkJaWRlYXRlQG1hbm1ha2VtYWNoaW5lLmNvbQlSRTogV2UgaGF2ZSBnb3QgYW4gaW50ZXJlc3RpbmcgcGxhdGZvcm0gZm9yIHlvdS4JMTUJCTE0Nzc0NQlib3VuY2UJbm8Jbm8=>
Content-Transfer-Encoding: quoted-printable
From: Victoria Miller [email protected]
To: me [email protected]
Subject: RE: We have got an interesting platform for you.
Message-ID: [email protected]
Date: Sat, 16 Mar 2019 21:31:11 +0000
MIME-Version: 1.0

Hi, =3D0B=3D0Bwe can quickly promote your website=3D2E=3D0B=3D0BWe can plac=
e your web=3Dsite on top of the Natural Listings on Google, Yahoo and Bing=
=3D2E=3D0B=3D0BWe do=3D
not use "link farms" or "black hat" methods that Google and the other sear=
=3D
ch engines frown upon and can use to de-list or ban your site=3D2E Our pric=
es=3D
are less than half of what other companies charge=3D2E=3D0B=3D0BWe would be=
happ=3D
y to send you a proposal using the top search phrases for your area of expe=
=3D
rtise=3D2E=3D0B=3D0BThanks & Regards, =3D0BVictoria Miller

[niftylettuce]

Hi Coenraad! Thanks for reaching out about this to let me know. Are you receiving a lot of emails like this? Perhaps I can try to get my SpamAssasin implementation working better. I recently made SPF/DKIM more relaxed, and as a result things like this happen.

[dagelf]

Hi, I think this was the first. I didn't really have a chance to look at the details yet, but thought I would just share it so long so I don't forget.

[dagelf]

I have been receiving about 3 of these a day starting on the 14th. They all have the [email protected] in common... I guess it would be fine to outright block [email protected] - if its not something you would ever have a need for.

[niftylettuce]

Definitely do NOT block [email protected]. This is the result of a "Friendly From" rewrite in order for emails to actually get in your inbox. Because we have to abide by SPF, DKIM, and DMARC, we do something where we rewrite the "From" of the email to have "$name [email protected]" and then add a "Reply-To" to the email being forwarded with the original "From" address.

I will look at improving our spam checking when I get time.

[dagelf]

Aha, so they do not reach you with that address. (If they do, surely they can be blocked... worth checking, I suppose.) I'm not up to date with the workings of DKIM and DMARC, will catch up and contribute then...

[niftylettuce]

I am looking at combining reports sent to [email protected] (e.g. from Microsoft) along with setting up a Feedback Loop system in compliance with Gmail, and also writing my own bayesian spam filter using https://github.com/73rhodes/dclassify. If anything wants to chime in with any thoughts let me know.

[niftylettuce]

See previous comment - obviously we are having to do this because SpamAssassin and spamd are not viable solutions.

[niftylettuce]

I just wanted to follow up on this. I ended up writing my own spam scanner @spamscanner. Will be implementing it as soon as I'm confident in the hit rate.

[niftylettuce]

Closing for organization purposes in favor of #189 where this will be added very shortly as a release checklist item. Please follow/subscribe to that issue for further updates.