Postini Email Security Trial

[#1]

Phil Webb,
Are you able to give a date for the end of this trial please?
Even an approximation would help.
I ask because I am confused with regard to progress. I read the 'very long' replies and the subsequent questions etc. You will appreciate that being a simple chap, I have difficulty understanding how things are proceeding.
Can you give an update please on how you are getting on, it would help me and possibly other ignorant customers. I don't beleive that you are trying to puzzle us for one moment.
I assume anyway that when you come to the end you will have a clear, understandable set of instructions for the uninstructed people like me. I don't really want to run into problems, and I know you wouldn't want me to.
Yours simply,
Bob Milton

[#2]

Question for Phil or Bob,
Here are the Postini headers from a piece of blatant spam:

X-pstn-neptune: 359/289/0.81/86
X-pstn-levels:     (S: 0.48112/99.74107 R:95.9108 P:95.9108 M:97.0282 C:98.6951 )
X-pstn-settings: 1 (0.1500:0.1500) gt3 gt2 gt1 r p m c 
X-pstn-addresses: from <appeasewew@positiveservices.com> [18/1] 
X-pstn-neptune-rslt: qtine

Will that be tagged as spam by Plusnet?

[#3]

Quote from: Bob

Phil Webb, Are you able to give a date for the end of this trial please?

If it helps, my own answer is that we should stop calling it a trial now. As MikeB and plenty of others have pointed out, it actually stopped being a trial when we committed to implementing it. What is true is that it's still in beta testing and we haven't yet done the work to make it available to everyone yet.
I would imagine we are looking at another three to four weeks for us to finish the implementation completely and have the supporting documentation in place. During that time many more people will be moved over to have their mail processed by Postini. After that time, there will be ongoing improvements that we will continue to make, much of which will be based on customer feedback.
Our single biggest consideration will be to make the implementation transparent to the vast majority of users. People shouldn't need to do anything and should have no problems as a result of the changes we are making. For us to meet our success criteria, the only effect people should notice is a radical reduction in Spam arriving in their email inboxes. Of course, as with the current anti-spam system there will always be imperfections in the live system and improvements that need to be made. I can't see it ever being 100% right for every customer.
In short, I think the answer to your question is "Within the next month, although most people should see the benefits before the end of this month".
Does that help?
Ian

[#4]

Ian,
Yes, it does. Thank you.
Bob Milton

[#5]

Quote from: Ian

Quote from: Bob Phil Webb, Are you able to give a date for the end of this trial please? If it helps, my own answer is that we should stop calling it a trial now. As MikeB and plenty of others have pointed out, it actually stopped being a trial when we committed to implementing it. What is true is that it's still in beta testing and we haven't yet done the work to make it available to everyone yet. I would imagine we are looking at another three to four weeks for us to finish the implementation completely and have the supporting documentation in place. During that time many more people will be moved over to have their mail processed by Postini. After that time, there will be ongoing improvements that we will continue to make, much of which will be based on customer feedback. Our single biggest consideration will be to make the implementation transparent to the vast majority of users. People shouldn't need to do anything and should have no problems as a result of the changes we are making. For us to meet our success criteria, the only effect people should notice is a radical reduction in Spam arriving in their email inboxes. Of course, as with the current anti-spam system there will always be imperfections in the live system and improvements that need to be made. I can't see it ever being 100% right for every customer. In short, I think the answer to your question is "Within the next month, although most people should see the benefits before the end of this month". Does that help? Ian

Perhaps reading this may give you an overall view of progress. It is difficult isn't it when news? about Postini is scattered all over the place.
With respect I think that jelv has a pretty fair idea of what is happening. In the absence of Bob Pullen or Phil Webb, he may be the best avenue of information.

[#6]

I have received a message from a genuine vendor from whom I receive a  regular and wanted newsletter containing a list of guitar instruction DVD titles he has available.
His message says that his newsletter bounced back as undeliverable and he has therefore removed my e-mail address from his database.
It seems that even if I resubscribe to his database, postini settings will by default bounce back his newsletter and there is nothing I can do about this.
Is this true?
So, is the only way to ensure that this doesn't happen to cancel my postini trial?
Thanks
James   

[#7]

Has he forwarded the bounce message in it's entirety to you?

[#8]

This seems to be the way to evade both Postini and DSPAM checking - I have received one of these on each of the past 2 days.  They spoof the forwarded from address which they set to mine to get past Postini.  The message appears to come from admin@viagra.com in OE.  Only by  examining the headers did I find this out!

X-Daemon-Classification: INNOCENT
Envelope-to: xxxxx@xxxxxxxxx.plus.com
Delivery-date: Sat, 12 Jan 2008 12:37:53 +0000
Received: from exprod5mx212.postini.com ([64.18.0.71] helo=psmtp.com)
	  by pih-sunmxcore19.plus.net with smtp (PlusNet MXCore v2.00) id 1JDfcW-0000PE-9B 
	  for xxxxx@xxxxxxxxx.plus.com; Sat, 12 Jan 2008 12:37:52 +0000
Received: from source ([212.129.98.48]) by exprod5mx212.postini.com ([64.18.4.14]) with SMTP;
	Sat, 12 Jan 2008 04:37:40 PST
X-Originating-IP: [47.51.028.30] 
X-Originating-Email: [xxxxx@xxxxxxxxx.plus.com] 
X-Sender: xxxxx@xxxxxxxxx.plus.com
Received: (qmail 13262 by uid 424); Sat, 12 Jan 2008 03:37:54 +0300
Message-Id: <20080112063754.13264.qmail@MS-48-98.dyn-ip.SPb.SkyLink.RU>
To: <xxxxx@xxxxxxxxx.plus.com>
Subject: SALE 72% OFF on Pfizer 
From: admin@Viagra.com <xxxxx@xxxxxxxxx.plus.com>
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-pstn-levels: (S: 0.00000/38.08230 R:95.9108 P:95.9108 M:97.0282 C:51.8443 )
X-pstn-settings: 1 (0.1500:0.1500) gt3 gt2 gt1 r p m C 
X-pstn-addresses: from <xxxxx@xxxxxxxxx.plus.com> forward (user good) [18/1] 
X-pn-pstn: Spam 2
X-PN-VirusFiltered: by PlusNet MXCore (v4.00)
X-DSPAM-Result: Innocent
X-DSPAM-Processed: Sat Jan 12 12:37:53 2008
X-DSPAM-Confidence: 0.5537
X-DSPAM-Improbability: 1 in 125 chance of being spam
X-DSPAM-Probability: 0.3362
X-DSPAM-Factors: 27,
	X-pstn-addresses*forward, 0.00071,
	X-pstn-addresses*good), 0.00071,
	Received*helo=psmtp.com), 0.00324,
	X-pn-pstn*2, 0.99000,
	Received*0000PE, 0.99000,
	From*xxxxxxxxx.plus.com>, 0.99000,
	Subject*72%, 0.99000,
	X-pn-pstn*Spam, 0.99000,
	To*<xxxxx, 0.01890,
	abu, 0.03056,
	X-pstn-settings*(0.1500, 0.96044,
	X-pstn-settings*0.1500), 0.96044,
	X-pstn-settings*1, 0.96044,
	Received*source, 0.05735,
	X-pstn-levels*P, 0.05741,
	X-pstn-levels*C, 0.05741,
	X-pstn-levels*95.9108, 0.05741,
	X-pstn-levels*95.9108, 0.05741,
	X-pstn-levels*M, 0.05741,
	X-pstn-levels*R, 0.05741,
	X-pstn-levels*(S, 0.05741,
	X-pstn-levels*), 0.05741,
	X-pstn-settings*p, 0.05856,
	X-pstn-settings*r, 0.05986,
	X-pstn-settings*m, 0.05986,
	X-pstn-addresses*from, 0.05986,
	X-pstn-settings*gt1, 0.05986

X-Daemon-Classification: INNOCENT
Envelope-to: xxxxx@xxxxxxxxx.plus.com
Delivery-date: Sun, 13 Jan 2008 07:41:42 +0000
Received: from exprod5mx223.postini.com ([64.18.0.82] helo=psmtp.com)
	  by pih-sunmxcore18.plus.net with smtp (PlusNet MXCore v2.00) id 1JDxTS-000668-4k 
	  for xxxxx@xxxxxxxxx.plus.com; Sun, 13 Jan 2008 07:41:42 +0000
Received: from source ([80.250.220.126]) by exprod5mx223.postini.com ([64.18.4.10]) with SMTP;
	Sun, 13 Jan 2008 01:41:39 CST
X-Originating-IP: [97.5.0.81] 
X-Originating-Email: [xxxxx@xxxxxxxxx.plus.com] 
X-Sender: xxxxx@xxxxxxxxx.plus.com
Received: (qmail 2759 by uid 345); Sun, 13 Jan 2008 10:37:14 +0300
Message-Id: <20080113133714.2761.qmail@comp9>
To: <xxxxx@xxxxxxxxx.plus.com>
Subject: RE: SALE 70% OFF on Pfizer 
From: admin@viagra.com <xxxxx@xxxxxxxxx.plus.com>
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-pstn-levels: (S: 0.00000/52.81371 R:95.9108 P:95.9108 M:97.0282 C:51.8443 )
X-pstn-settings: 1 (0.1500:0.1500) gt3 gt2 gt1 r p m C 
X-pstn-addresses: from <xxxxx@xxxxxxxxx.plus.com> forward (user good) [18/1] 
X-pn-pstn: Spam 2
X-PN-VirusFiltered: by PlusNet MXCore (v4.00)
X-DSPAM-Result: Innocent
X-DSPAM-Processed: Sun Jan 13 07:41:43 2008
X-DSPAM-Confidence: 0.6568
X-DSPAM-Improbability: 1 in 192 chance of being spam
X-DSPAM-Probability: 0.0000
X-DSPAM-Factors: 27,
	X-pstn-addresses*good), 0.00085,
	X-pstn-addresses*forward, 0.00085,
	Received*helo=psmtp.com), 0.00321,
	X-pstn-settings*r, 0.00520,
	X-pstn-settings*m, 0.00520,
	X-pstn-addresses*from, 0.00520,
	X-pstn-settings*p, 0.00520,
	X-pstn-settings*gt1, 0.00520,
	X-pstn-settings*gt3, 0.00542,
	X-pstn-settings*gt2, 0.00693,
	Received*source, 0.00733,
	X-pstn-levels*P, 0.00734,
	X-pstn-levels*C, 0.00734,
	X-pstn-levels*95.9108, 0.00734,
	X-pstn-levels*95.9108, 0.00734,
	X-pstn-levels*M, 0.00734,
	X-pstn-levels*R, 0.00734,
	X-pstn-levels*(S, 0.00734,
	X-pstn-levels*), 0.00734,
	X-pstn-levels*97.0282, 0.00748,
	X-pn-pstn*2, 0.99000,
	From*xxxxxxxxx.plus.com>, 0.99000,
	X-pn-pstn*Spam, 0.99000,
	From*viagra.com, 0.99000,
	To*<xxxxx, 0.02237,
	Received*000668, 0.05206,
	Sullivan, 0.06664

According to the Postini analysis system both give the same result:
Approved/Blocked Senders Approved Sender=xxxxx@xxxxxxxxx.plus.com Trigger=user good
Disposition Delivered Message delivered: see spam scores below for more information.
Passed Blatant Spam Blocking No Message scores as blatant spam: if delivered, make sure blatant spam blocking is enabled and that another filter is not approving the message.
Spam Score 0.00000 Calculated by Perimeter Manager Range: 0(Spam) - 100(Legitimate)
Commercial Offer Triggered 51.8443

Even though the spam score is 0.00000 (Spam) it gets marked as Spam 2 and is delivered. By marking me as the approved sender it gets delivered.
DSPAM, which is useless when combined with Postini, is partly evaded because it is told by Postini that the addresses are good!
So, it appears this will always be delivered and it is up to me to apply extra filtering.

[#9]

No, both of these would have been tagged by Postini, if Postini was enabled for spam tagging (which it will be VERY SOON I hope!). The DSPAM checking is useless and we can wish it good riddance....
(edited to change "spam blocking" to "spam tagging")

[#10]

Quote from: jnwright

So, it appears this will always be delivered and it is up to me to apply extra filtering.

Which is precisely the way I am currently dealing with this same email bearing in mind that I have DSPAM turned off and have had for some time.

[#11]

Reading the Postini advice on the Troubleshoot Spam that Gets Through page the following is stated:

Was the sender's address in the user- or org-level Approved Senders list?
If the sender or sender’s domain is on an Approved Senders list—either the user’s personal list,
or a list defined for the user’s org—messages from those senders will be delivered,
regardless of spam-like content.
This is also the case if the spammer has spoofed the sender address so it matches an Approved sender.
Review the user- and org-level lists and delete any known spammers.
Remember that users don’t have visibility of their org’s Approved Senders list,
so they might be confused as to why spam from a sender on this list would not be filtered.

So unless I want to remove myself from the approved senders list I will have to put up with this.    This is a way to ruin Postini's minimum service level if they all do it!

[#12]

When Plusnet turn on the tagging based on Postini, this message will be tagged as [-SPAM-] in the subject and will deleted, delivered to your spam folder or delivered to your normal folder according to how you have spam detection set in your mailbox configuration.

[#13]

That was my understanding of the "spam 2" label added by PlusNet....  But it is interesting that postini regards the mail as "Approved. Trigger=user good."  Have the spammers found a weakness here that postini should be looking at? (I don't think it has anything to do with whitelists, though...?)

[#14]

Approved in that case just means it wasn't completely blocked - as it appears to be a person to person email it is delivered, but Postini is 100% certain it is spam and is saying it should be treated as spam.

[#15]

If Postini is 100% sure it is spam then they could delete it, but the Approved Sender Trigger=user good makes sure it has to go somewhere because that will always override anything else.
A gift to the spammer!