cancel
Showing results for 
Search instead for 
Did you mean: 

Spam Filtering

ChrisL
Grafter
Posts: 743
Thanks: 4
Registered: ‎13-12-2007

Re: Spam Filtering

Quote from: ddunford
@wolfcub
+ Regarding what Chris said, this does not apply to you because ive checked your postini settings and no addresses are whitelisted.

Dan, I thought this problem was caused by the Plusnet org whitelist not working properly? Nothing to do with our user whitelists? Bob got me to click 'Update' even though I hadn't changed anything or whitelisted anything at that stage, and abracadabra, my spoofed-from-plusnet spam started getting tagged again.
ddunford
Grafter
Posts: 114
Registered: ‎05-04-2007

Re: Spam Filtering

Chris..
No, the original problem that was raised was because i automatically whitelisted all plusnets domains (plus.com, f9.. etc), so i then rolled a fix that stopped it from doing this. That is why we advised customers to go in and click update again just to ensure the domains were removed from the whitelist.
Im not sure what bob suggested as i cannot see how/why it would sort anything else. All clicking update does it make a few entries into the database and then makes a request to postini, i know exactly whats sent/updated cos i wrote it ;-)
gofaster
Rising Star
Posts: 367
Thanks: 12
Registered: ‎01-08-2007

Re: Spam Filtering

OK Dan, I have updated my spam settings several times over the past few days and I still seem to be spamming myself.
Quote
Envelope-to: me@myuserid.plus.com
Delivery-date: Tue, 08 Apr 2008 16:52:10 +0100
Received: from exprod5mx249.postini.com ([64.18.0.169] helo=psmtp.com)
    by pih-sunmxcore16.plus.net with smtp (PlusNet MXCore v2.00) id 1JjG7F-0005en-RA
    for me@myuserid.plus.com; Tue, 08 Apr 2008 16:52:10 +0100
Received: from source ([201.254.188.68]) by exprod5mx249.postini.com ([64.18.4.10]) with SMTP;
    Tue, 08 Apr 2008 10:52:07 CDT
X-Originating-IP: [201.254.188.68]
X-Originating-Email: [me@myuserid.plus.com]
X-Sender: me@myuserid.plus.com
Received: (qmail 3043 by uid 306); Tue, 8 Apr 2008 12:52:11 -0300
Message-Id: <20080408095211.3045.qmail@abc>
To: <me@myuserid.plus.com>
From: <me@myuserid.plus.com>
MIME-Version: 1.0
Content-Type: text/html; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
X-pstn-levels: (S: 0.00000/91.37315 CV:99.9000 R:95.9108 P:95.9108 M:97.0282 C:60.2565 )
X-pstn-settings: 1 (0.1500:0.1500) cv gt3 gt2 gt1 r p m C
X-pstn-addresses: from <me@myuserid.plus.com> forward (org good) [33/1]
X-PN-Virus-Filtered: by PlusNet MXCore (v4.00)
X-PN-Spam-Filtered: by PlusNet MXCore (v4.00)
Subject: RE: Gucci 2425380

As you can see, I am still getting the forward (org good)
Any further ideas on this?
waldron
Grafter
Posts: 348
Registered: ‎28-07-2007

Re: Spam Filtering

@gofaster.
This was the problem I originally reported when I started this thread. However, it seems to have been hijacked by a separate problem with '-' in front of whitelist entries.
ddunford
Grafter
Posts: 114
Registered: ‎05-04-2007

Re: Spam Filtering

@gofaster
Interesting, that implies that those domains are being whitelisted at org level (i didn't set the orgs up in postini, so dont know for certain), when the user has personally whitelisted stuff it gets set to 'forward (user good)'. I'll bring this up with our networks team tomorrow as it was them that initally setup the orgs, which i suspect certain domains have been whitelisted.
ChrisL
Grafter
Posts: 743
Thanks: 4
Registered: ‎13-12-2007

Re: Spam Filtering

Dan, you're now catching up with what I was trying to say  Cheesy
Plusnet-to-Plusnet email is _supposed_ to be whitelisted at the org level, BUT with a check that the mail is really coming from a Plusnet server and is not just being spoofed.
When you added Plusnet domains to the user whitelists by default, it caused spoofs to bypass the spam filter. You quickly put this right, though we then needed to go in and click 'Update' to get rid of the domains wrongly whitelisted in our profiles. This seems to have worked for me, but other people are still seeing spoofs getting past the filter -- ie. they are still being 'passed (org good)' even if they didn't come from a Plusnet server.
ChrisL
Grafter
Posts: 743
Thanks: 4
Registered: ‎13-12-2007

Re: Spam Filtering

And, btw, at least one person is getting yhe opposite problem -- ie. genuine Plusnet-to-Plusnet email tagged as spam  Shocked
http://community.plus.net/forum/index.php/topic,63287.0.html
ddunford
Grafter
Posts: 114
Registered: ‎05-04-2007

Re: Spam Filtering

Problem 51041 raised to investigate a solution for this.
gofaster
Rising Star
Posts: 367
Thanks: 12
Registered: ‎01-08-2007

Re: Spam Filtering

Thanks for raising the problem.
As well as the spoofed address spam I am getting quite a bit through to my inbox that has been tagged by postini with
Quote
X-pstn-neptune-cave-rslt: qtine

Is there any chance that the Plus Net scoring routine can use this header to identify the message as spam?
paulgul
Rising Star
Posts: 605
Fixes: 1
Registered: ‎05-04-2007

Re: Spam Filtering

Quote from: ChrisL
And, btw, at least one person is getting yhe opposite problem -- ie. genuine Plusnet-to-Plusnet email tagged as spam  Shocked
http://community.plus.net/forum/index.php/topic,63287.0.html

As the poster of the link referred to in the above quote, I have just tried again to send myself an email and the same thing is happening, ie its being marked as spam.
ddunford
Grafter
Posts: 114
Registered: ‎05-04-2007

Re: Spam Filtering

paulgul ,
Can you please provide us with some headers of the received emails so that we can check this please.
When you are sending the email are you actually using your plus.com address, domain address hosted with us, or some other domain address that we dont hold/host.
Thanks.
paulgul
Rising Star
Posts: 605
Fixes: 1
Registered: ‎05-04-2007

Re: Spam Filtering

Quote from: ddunford
paulgul ,
Can you please provide us with some headers of the received emails so that we can check this please.


Just PM'd them to you
ddunford
Grafter
Posts: 114
Registered: ‎05-04-2007

Re: Spam Filtering

Thanks,
Ok ive checked the headers out, it does look strange.. however our network engineers rolled out some fixes  earlier today regarding something similar to this. Could you retest and let me know asap?
Thanks.
paulgul
Rising Star
Posts: 605
Fixes: 1
Registered: ‎05-04-2007

Re: Spam Filtering

Just done the retest and it went to the inbox ok.
Paul