Can we figure out why this was sent to graymail?

General discussions and other topics.
24 posts Page 2 of 3
by jordan.m » Tue May 21, 2024 11:16 am
That's unfortunate. I was hoping that would do the trick. Please keep me updated on whether or not Graymail continues to intercept mail from so I can continue to investigate.
Jordan M.
Community and Escalations Specialist
by virtualmike » Tue May 21, 2024 12:40 pm
Absolutely! I'll have an update next Saturday. :geek:
by virtualmike » Wed May 22, 2024 11:56 pm
In the meantime... :)

Just this week, I added *@* to my WelcomeList. Today, I received a message from <>, and X-Spam-Status in the Internet headers says "USER_IN_WELCOMELIST."

It's definitely not the wildcard.

Pondering... the domain is on the longer side. It's the longest in my WelcomeList. Is it possible that there's a limit on the length of the string to be compared? Either entries in the WelcomeList or the address extracted from the "From:" line? ...cheers!
by virtualmike » Sat May 25, 2024 10:42 pm
I received the next issue of the Android Apps Weekly newsletter.

With the WelcomeList entry of *, I see this in the Internet headers:

Code: Select all

X-Spam-Status: No, score=-96.5 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	SPF_HELO_NONE,USER_IN_WELCOMELIST autolearn=disabled version=4.0.0
So... why does * work and *@* doesn't, even though wildcards work with other domains?
by apl » Sun May 26, 2024 3:03 pm
So... why does * work and *@* doesn't,
It is probably just (as I suggested in the first place) that
*@* doesn't match because the latter doesn't have the "." before androidauthority.

You dismissed this, saying that in another case *@* matched email from, which likewise doesn't have the subdomain and the "."
Looking into that example a little more, I suspect it is because the spamassassin welcomelist_from looks at not only the literal "From" line but also a few other headers that indicate the source of the mail.
So probably *@* is not actually matching the header
From: "" <>
but instead the other header
which does have the extra "."
by virtualmike » Sun May 26, 2024 6:13 pm
I appreciate your attempts to help, but unless you're looking at the source code, you can only conjecture on the cause (which is all I can do).

I would doubt that the Welcomelist From entries look at other headers, as there is a separate Welcomelist From Received, which specifically inspects the "Received:" headers.

The documentation on the Welcomelist Address page states, "Used to specify addresses that send mail that is tagged incorrectly as spam." If this means it matches any address within the Internet headers, then it should be updated to reflect that. Most people don't even know what the Internet headers are. As well, I can easily see a case where a message that is really spam happens to have a Welcomelisted address somewhere in the headers, which would lead to its being delivered to the Inbox, which I'm sure is not an expected result.

As well, a "Return-Path:" simply tells the receiving mail server where to send a bounce message and is not intended to be a alternate "sender" address. Many of the newsletters I receive have Return-Paths to completely different domains (typically, the services that processes the mailing lists).

Only an engineer at Sonic will be able to determine what' exactly should be happening and what really is happening. I'm sure this isn't the most critical issue at the moment, so in the meantime, I'm providing whatever information I can to help them narrow down the possibilities.
by jordan.m » Tue May 28, 2024 1:04 pm
Thank you for going through all those steps for me. This is a bizarre one, but we should be able to figure out why it is happening. I'll pass this on to our internal team and reach back out here once I have an update. Thanks once again!
Jordan M.
Community and Escalations Specialist
by apl » Tue May 28, 2024 3:40 pm
I am not looking at the source code, but I am looking at the documentation, which (although not always 100% clear) agrees with everything I have said.

On the "welcomelist_from" headers checked:
The headers checked for welcomelist addresses are as follows: if Resent-From is set, use that; otherwise check all addresses taken from the following set of headers:

In addition, the "envelope sender" data, taken from the SMTP envelope data where this is available, is looked up. See envelope_sender_header.
The entry for envelope_sender_header fields includes "Return-Path" as one of the fields it may use.
That point was kind of tangential anyway.

On the wildcard matching:
Welcomelist and blocklist addresses are now file-glob-style patterns, so, *, or * will all work. Specifically, * and ? are allowed, but all other metacharacters are not. Regular expressions are not used for security reasons. Matching is case-insensitive.
Emphasis added to the two key points.
(In reverse order) 1. ".'" is not in any way a special character.
2. Absent other information, one should expect it to work the same way glob wildcard matching works on the command line in any unix shell.

The latter is easy enough (though maybe overkill) to check by creating a filename that looks like an email address and seeing if it matches various wildcard patterns.

Code: Select all

[apl@sh:/tmp] touch
[apl@sh:/tmp] ls *
[apl@sh:/tmp] ls *@*
[apl@sh:/tmp] ls *@*
ls: No match.
No match for the last one because of the extra dot, as expected.

So it appears that spamassassin's wildcard matching is working exactly as should be expected. Nothing bizarre about it.
by virtualmike » Tue May 28, 2024 4:12 pm
I personally thought the domain wildcard would make more sence as "*@*" but Sonic's Welcomelist page says:

Used to specify addresses that send mail that is tagged incorrectly as spam. Entries in the form "", "*", or "*@*" will all work. Specifically, "*" and "?" are allowed, but all other metacharacters are not.


Welcomelist From
Welcomelist From friend@*
Welcomelist From *
Welcomelist From *@*

As a test, I have changed my Welcomelist entry to "*@*" -- let's see how SpamAssassin likes them apples.
by virtualmike » Sat Jun 01, 2024 10:26 pm
*@* seems to work--today's issue has this in the headers:

Code: Select all

X-Spam-Status: No, score=-96.6 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	T_SCC_BODY_TEXT_LINE,[b]USER_IN_WELCOMELIST[/b] autolearn=disabled
I've edited another Welcomelist entry similarly to see if that will still work. Emails arrive from <>, so I'll see on Monday if they are recognized.
24 posts Page 2 of 3

Who is online

In total there are 3 users online :: 2 registered, 0 hidden and 1 guest (based on users active over the past 5 minutes)
Most users ever online was 999 on Mon May 10, 2021 1:02 am

Users browsing this forum: Ahrefs [Bot], Semrush [Bot] and 1 guest