Spam filtering hiccup?

[patty1]

I've gotten several spam emails in my Sonic inbox today that are exactly the sort that usually end up in graymail. I haven't made any changes to my graymail settings recently. Is Sonic's filtering system maybe having a bad day?

[seth.lohr]

Likely related to: https://sonicstatus.com/2024/03/27/part ... 3-26-3-27/

[apl]

Possibly related to that migration, but the issue with spam is ongoing.
Over the past two days, I have seen:
38 spam emails caught by SpamAssassin and diverted to graymail
1 false negative (spam delivered to my inbox, with SpamAssassin headers showing score < 5)
8 spams delivered to my inbox with no SpamAssassin headers

The most recent failure was at 9:36 PDT this morning, so whatever is causing emails to not get scored is intermittent and still happening.

[patty1]

Thanks for the detailed information, apl.

I've only gotten two spams in my inbox today. One had been analyzed by SpamAssassin and was just under the score for rejection. The other didn't have SA headers but was marked as suspected junk by Apple Mail.

Like you, I have nearly 40 messages in my Sonic graymail folder.

Seth may be correct that yesterday's work on the mail system affected SA. Anyway, the situation is much better today, so let's hope that continues!

[advmkt]

Hello,

I came here specifically to see if others were having similar issues. My issue doesn't seem to be exactly the same as anyone else that posted here but there is definitely an issue.

I'm not getting any spams in my inbox, luckily. I am getting WAY more landing in my Graymail. I know that my Graymail is 99.99% garbage but I do keep my eye on it in the rare case that something legit lands in there. On most days I seem to get 10 to 20 Graymail, but today I already have 60 emails in there, and based on this rate, I'll probably have about 70 by the end of the work day (5:00). This makes me think that some blocklist or filtering mechanism is not currently functioning. It also could just be that the spammers are in overdrive today.

I'd appreciate any insight on this, but maybe it's just me ¯\_(ツ)_/¯

Thanks for reading,
Pilvi

[virtualmike]

I just had several go directly to Graymail. Here's what's consistent among them, in the Content analysis details:

Code: Select all

 0.9 SPF_FAIL               SPF: sender does not match SPF record (fail)
[SPF failed: Please see http://www.openspf.net/Why?s=mfrom;id=20240329010557837fb35642a84fec8eee128a4620p0na-c3qxrykmz0quxh%40bounces.amazon.com;ip=157.131.0.49;r=g.spam.sonic.net]

Attempts to go to www.openspf.net get either a "refused to connect" or "took too long...."

Down for Everyone or Just Me reports it's not just me.

I suspect the spam filters are interpreting "unable to access http://www.openspf.net/ as "invalid SPF."

[linelle]

Jeez Louise. For the past 3-4 days I’m getting porn images in my regular inbox. Graphic. Should be a no brainer to stop that stuff on Sonic’s end of things. I’m recovering from surgery so I’m not able to put my own thinking cap on to tweak things. Please make this stuff stop. Nothing changed at my end. Har har.

[kgc]

There's a couple of problems that we're seeing but haven't been able to completely isolate yet. The main issue is that some group of (spam) messages that are getting delivered are taking unusually long to process. This is most likely due to slow or timing out DNS or other network tests, when a burst of these come in at once, concurrency spikes and had been hitting a few limits. Message processing is designed to fail open so that's why some messages may not have been processed by SpamAssassin. Only a fraction of a percent isn't getting scanned.

We've blocked at least once source of these problem messages but that's just whack-a-mole and are focusing our efforts on figuring out why they take an unusual amount of time to scan.

Initially we were concerned this was related to the same migration that lead to the MOTD. :/

[linelle]

Kelsey, thanks for your reply. It has settled down slightly today. In was an onslaught a couple of days ago in my hospital bed.

[patty1]

My thanks also to Kelsey for the additional information. My inbox has been pretty quiet the last couple of days, so it was apparently just a temporary issue. As Kelsey said, some sort of "failing open."