Spam Filtering

[#1]

Quote from: ddunford

@wolfcub + Regarding what Chris said, this does not apply to you because ive checked your postini settings and no addresses are whitelisted.

Dan, I thought this problem was caused by the Plusnet org whitelist not working properly? Nothing to do with our user whitelists? Bob got me to click 'Update' even though I hadn't changed anything or whitelisted anything at that stage, and abracadabra, my spoofed-from-plusnet spam started getting tagged again.

[#2]

Chris..
No, the original problem that was raised was because i automatically whitelisted all plusnets domains (plus.com, f9.. etc), so i then rolled a fix that stopped it from doing this. That is why we advised customers to go in and click update again just to ensure the domains were removed from the whitelist.
Im not sure what bob suggested as i cannot see how/why it would sort anything else. All clicking update does it make a few entries into the database and then makes a request to postini, i know exactly whats sent/updated cos i wrote it 😉

[#3]

OK Dan, I have updated my spam settings several times over the past few days and I still seem to be spamming myself.

Quote

Envelope-to: me@myuserid.plus.com Delivery-date: Tue, 08 Apr 2008 16:52:10 +0100 Received: from exprod5mx249.postini.com ([64.18.0.169] helo=psmtp.com)     by pih-sunmxcore16.plus.net with smtp (PlusNet MXCore v2.00) id 1JjG7F-0005en-RA     for me@myuserid.plus.com; Tue, 08 Apr 2008 16:52:10 +0100 Received: from source ([201.254.188.68]) by exprod5mx249.postini.com ([64.18.4.10]) with SMTP;     Tue, 08 Apr 2008 10:52:07 CDT X-Originating-IP: [201.254.188.68] X-Originating-Email: [me@myuserid.plus.com] X-Sender: me@myuserid.plus.com Received: (qmail 3043 by uid 306); Tue, 8 Apr 2008 12:52:11 -0300 Message-Id: <20080408095211.3045.qmail@abc> To: <me@myuserid.plus.com> From: <me@myuserid.plus.com> MIME-Version: 1.0 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit X-pstn-levels: (S: 0.00000/91.37315 CV:99.9000 R:95.9108 P:95.9108 M:97.0282 C:60.2565 ) X-pstn-settings: 1 (0.1500:0.1500) cv gt3 gt2 gt1 r p m C X-pstn-addresses: from <me@myuserid.plus.com> forward (org good) [33/1] X-PN-Virus-Filtered: by PlusNet MXCore (v4.00) X-PN-Spam-Filtered: by PlusNet MXCore (v4.00) Subject: RE: Gucci 2425380

As you can see, I am still getting the forward (org good)
Any further ideas on this?

[#4]

@gofaster.
This was the problem I originally reported when I started this thread. However, it seems to have been hijacked by a separate problem with '-' in front of whitelist entries.

[#5]

@gofaster
Interesting, that implies that those domains are being whitelisted at org level (i didn't set the orgs up in postini, so dont know for certain), when the user has personally whitelisted stuff it gets set to 'forward (user good)'. I'll bring this up with our networks team tomorrow as it was them that initally setup the orgs, which i suspect certain domains have been whitelisted.

[#6]

Dan, you're now catching up with what I was trying to say 
Plusnet-to-Plusnet email is _supposed_ to be whitelisted at the org level, BUT with a check that the mail is really coming from a Plusnet server and is not just being spoofed.
When you added Plusnet domains to the user whitelists by default, it caused spoofs to bypass the spam filter. You quickly put this right, though we then needed to go in and click 'Update' to get rid of the domains wrongly whitelisted in our profiles. This seems to have worked for me, but other people are still seeing spoofs getting past the filter -- ie. they are still being 'passed (org good)' even if they didn't come from a Plusnet server.

[#7]

And, btw, at least one person is getting yhe opposite problem -- ie. genuine Plusnet-to-Plusnet email tagged as spam 
http://community.plus.net/forum/index.php/topic,63287.0.html

[#8]

Problem 51041 raised to investigate a solution for this.

[#9]

Thanks for raising the problem.
As well as the spoofed address spam I am getting quite a bit through to my inbox that has been tagged by postini with

Quote

X-pstn-neptune-cave-rslt: qtine

Is there any chance that the Plus Net scoring routine can use this header to identify the message as spam?

[#10]

Quote from: ChrisL

And, btw, at least one person is getting yhe opposite problem -- ie. genuine Plusnet-to-Plusnet email tagged as spam  http://community.plus.net/forum/index.php/topic,63287.0.html

As the poster of the link referred to in the above quote, I have just tried again to send myself an email and the same thing is happening, ie its being marked as spam.

[#11]

paulgul ,
Can you please provide us with some headers of the received emails so that we can check this please.
When you are sending the email are you actually using your plus.com address, domain address hosted with us, or some other domain address that we dont hold/host.
Thanks.

[#12]

Quote from: ddunford

paulgul , Can you please provide us with some headers of the received emails so that we can check this please.

Just PM'd them to you

[#13]

Thanks,
Ok ive checked the headers out, it does look strange.. however our network engineers rolled out some fixes  earlier today regarding something similar to this. Could you retest and let me know asap?
Thanks.

[#14]

Just done the retest and it went to the inbox ok.
Paul