mail filter, why didn't this work?

General discussions and other topics.
10 posts Page 1 of 1
by dukeofur » Thu Sep 20, 2018 6:54 pm
I get lots of automatic mail, some I want, some I don't. SpamAssassin has been really good about keeping the true junk out, and so I'm not complaining about that.

Every day between midnight and 1 AM, I get 20 messages from a site (they're supposed to come through so it's ok) with the subject line "Geocaching: Your Pocket Query, California ### is now available." with ### being a changing value between 1-100, and they mean that something has happened on a server somewhere. They come from "noreply@geocaching.com" - I'd like to filter those 20 out, so that I don't have to delete them every time. I only value the copy on the server anyhow.

Ordinarily I'd just use SA to just blacklist that sender, but the problem is, that I get several other desired emails with different subjects, and related to different topics, but from the same sending address through the day. So I can't filter on that sending address.

I tried blacklist subject on "Your Pocket Query" and it didn't work even though it's part of every undesired email. The filter doesn't seem to catch those. I don't know why. - does anyone know why?

How can I fix this?
by drew.phillips » Fri Sep 21, 2018 8:53 am
If you view the headers of the message that is getting through, does it show "SUBJECT_IN_BLACKLIST" in the X-Spam-Status header?

There may be another whitelist rule that is counteracting the subject blacklist. Unless the encoding of the subject is unusual and it is not plain text, that should work to block the message.

If you can, post the entire X-Spam-Status header and we can take a further look at why they are not getting caught by the rules.

Feel free to PM me directly as well with any details.
Drew Phillips
Programmer / System Operations, Sonic.net
by dukeofur » Mon Sep 24, 2018 3:57 pm
Sorry, was out of town for the weekend.

So, I used to know how to view headers when I used Firebird, but haven't in a while. Do you know how to view headers either through web mail or ios?
by drew.phillips » Mon Sep 24, 2018 4:02 pm
In Thunderbird, Control+U will open the message source. From webmail, right-click on the message and select More >> View Source (or click More from the top menu bar). I am not sure about on iOS.

Let me know if those don't do the trick for you.
Drew Phillips
Programmer / System Operations, Sonic.net
by dukeofur » Mon Sep 24, 2018 4:07 pm
Sorry, I meant Thunderbird. I haven't used it in a couple years.

Now I just use web mail and mail on my iphone.
by dukeofur » Mon Sep 24, 2018 4:12 pm
X-Spam-Status: No, score=-1.0 required=4.0 tests=DCC_CHECK,DKIMWL_WL_HIGH,
DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,HTML_MESSAGE,
MIME_HTML_ONLY,RCVD_IN_DNSWL_MED,SNF4SA,SONIC_FRIEND,
SUBJECT_IN_BLACKLIST,USER_IN_WHITELIST autolearn=disabled version=3.4.2
by drew.phillips » Mon Sep 24, 2018 5:11 pm
Thanks for posting the headers.

It shows SUBJECT_IN_BLACKLIST,USER_IN_WHITELIST so this means the subject blacklist is working, but there is also a user whitelist rule so that cancels out the subject blacklist.

The solution here would be to remove the sender from the whitelist. They should generally not go into Graymail so this should be okay. There's only a small chance that one of their future messages goes to Graymail if they were to send something that triggered multiple SpamAssassin rules that amounted to more than 4.0 points.
Drew Phillips
Programmer / System Operations, Sonic.net
by dukeofur » Mon Sep 24, 2018 10:59 pm
Wow, I wonder when I put that in. I deleted it, and we'll see what happens tonight. It would be awesome if there were dates when those were established and counters for how many times they were used. That might be very useful information to know.
by dukeofur » Tue Sep 25, 2018 3:55 pm
Yes, it seems to have worked. Thank you so much.
by drew.phillips » Tue Sep 25, 2018 5:08 pm
Glad that did the trick. If you don't remember adding it manually, it may have been added as a result of using the Graymail web tool to "whitelist and deliver" a message that was once caught as spam.

For better or worse, at this time we don't keep audit logs of when various spam rules are created/modified/removed, nor do we keep stats on which rules are triggered so we can't provide any further details as to when it was added or the frequency it was applied.
Drew Phillips
Programmer / System Operations, Sonic.net
10 posts Page 1 of 1

Who is online

In total there are 31 users online :: 0 registered, 0 hidden and 31 guests (based on users active over the past 5 minutes)
Most users ever online was 999 on Mon May 10, 2021 1:02 am

Users browsing this forum: No registered users and 31 guests