<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
	<channel>
		<title><![CDATA[iRedMail — Spam Score for FROM_ADDR_WS / bad header]]></title>
		<link>https://forum.iredmail.org/topic18552-spam-score-for-fromaddrws-bad-header.html</link>
		<atom:link href="https://forum.iredmail.org/feed-rss-topic18552.xml" rel="self" type="application/rss+xml" />
		<description><![CDATA[The most recent posts in Spam Score for FROM_ADDR_WS / bad header.]]></description>
		<lastBuildDate>Tue, 21 Dec 2021 14:54:41 +0000</lastBuildDate>
		<generator>PunBB</generator>
		<item>
			<title><![CDATA[Re: Spam Score for FROM_ADDR_WS / bad header]]></title>
			<link>https://forum.iredmail.org/post81613.html#p81613</link>
			<description><![CDATA[<p>Thanks, Cthulhu, for digging into this. The strings you mentioned were modified for privacy reasons and are not the original ones. I&#039;m sure, like you and Zhang, it&#039;s the users MUA causing that issue.</p><p>Best regards</p>]]></description>
			<author><![CDATA[null@example.com (jobu)]]></author>
			<pubDate>Tue, 21 Dec 2021 14:54:41 +0000</pubDate>
			<guid>https://forum.iredmail.org/post81613.html#p81613</guid>
		</item>
		<item>
			<title><![CDATA[Re: Spam Score for FROM_ADDR_WS / bad header]]></title>
			<link>https://forum.iredmail.org/post81514.html#p81514</link>
			<description><![CDATA[<p>I investigated this further</p><p>From: =?utf-7?B?UHJvZi5gRHIuIFJ2ZGkgU3NobWllZGU=?= &lt;user@mail.example.org&gt;</p><p>this means the string is utf-7 encoded and base 64 encoded:</p><p>=?charset?encoding?encoded-text?=</p><p>if you consider the encoded text to be base64, you can decode it back to the following:</p><p>Prof.`Dr. Rvdi Sshmiede</p><p>So him insisting on all his titles makes the MUA to encode it to base64 and then to utf-7 and exceed the maxlenght, which causes a line break</p><br /><p>so i guess changeing his sender ID to &quot;Rvdi Sshmiede&quot; without all those titles and encoded chars would totally fix his problems...</p><br /><p>edit:</p><p>it seems, the MUA aswell malfroms the subject, decodeing the subject from base64 leads to the following:</p><p>Testm¡il ÃÌber meine ifs-Adressu</p>]]></description>
			<author><![CDATA[null@example.com (Cthulhu)]]></author>
			<pubDate>Fri, 10 Dec 2021 08:19:39 +0000</pubDate>
			<guid>https://forum.iredmail.org/post81514.html#p81514</guid>
		</item>
		<item>
			<title><![CDATA[Re: Spam Score for FROM_ADDR_WS / bad header]]></title>
			<link>https://forum.iredmail.org/post81513.html#p81513</link>
			<description><![CDATA[<p>then there are 2 options, either your client gets help from software provider and they fix their program, or he uses other software for emails</p><p>aswell, i see no reason to utf8-encode (first example was utf-7encoded) the sender email, or better said useing&nbsp; useing special chars in an sender email so it needs to get utf-8 encoded for transmission, i would avoid this anytime just to prevent incompatibilites</p>]]></description>
			<author><![CDATA[null@example.com (Cthulhu)]]></author>
			<pubDate>Fri, 10 Dec 2021 07:59:28 +0000</pubDate>
			<guid>https://forum.iredmail.org/post81513.html#p81513</guid>
		</item>
		<item>
			<title><![CDATA[Re: Spam Score for FROM_ADDR_WS / bad header]]></title>
			<link>https://forum.iredmail.org/post81512.html#p81512</link>
			<description><![CDATA[<p>The MUA in use is &quot;Chaos Intellect&quot;. I see it like you, but wanted to be sure not to miss anything here. </p><p>Yes, i disabled spamassassin (and almost forgot about it), since my services are behind a relayhost. But it seems the settings are still in use by amavis, which is good.</p>]]></description>
			<author><![CDATA[null@example.com (jobu)]]></author>
			<pubDate>Fri, 10 Dec 2021 06:37:56 +0000</pubDate>
			<guid>https://forum.iredmail.org/post81512.html#p81512</guid>
		</item>
		<item>
			<title><![CDATA[Re: Spam Score for FROM_ADDR_WS / bad header]]></title>
			<link>https://forum.iredmail.org/post81507.html#p81507</link>
			<description><![CDATA[<p>The user has a not very common email-client, so which one is he useing?</p><p>He needs to change the email client then, it is causing those problems, if common spam filters detect the malformation and some providers even completely reject it, it is an unsolvable problem and not related to iredmail or any software used by it</p><p>did you manually disable spamasassin? because normalyl it gets invoked by amavis and only gets bypassed, if you enable spam bypassing for domain or single users</p>]]></description>
			<author><![CDATA[null@example.com (Cthulhu)]]></author>
			<pubDate>Fri, 10 Dec 2021 01:13:51 +0000</pubDate>
			<guid>https://forum.iredmail.org/post81507.html#p81507</guid>
		</item>
		<item>
			<title><![CDATA[Re: Spam Score for FROM_ADDR_WS / bad header]]></title>
			<link>https://forum.iredmail.org/post81459.html#p81459</link>
			<description><![CDATA[<p>Seems caused by MUA. Postfix doesn&#039;t modify the headers this way.</p>]]></description>
			<author><![CDATA[null@example.com (ZhangHuangbin)]]></author>
			<pubDate>Sun, 05 Dec 2021 03:59:25 +0000</pubDate>
			<guid>https://forum.iredmail.org/post81459.html#p81459</guid>
		</item>
		<item>
			<title><![CDATA[Re: Spam Score for FROM_ADDR_WS / bad header]]></title>
			<link>https://forum.iredmail.org/post81452.html#p81452</link>
			<description><![CDATA[<p>Dear Zhang,</p><p>thanks for looking into this ...</p><div class="codebox"><pre><code>554-Transaction
    failed 554-Reject due to policy restrictions. 554 For explanation visit
    https://web.de/email/senderguidelines/(in reply to
    end of DATA command)</code></pre></div><p>I checked all of it, the only useful hint seems to be the header. The user has a not very common email-client. If he shortens his FROM &lt; 50 letters his email will pass, &gt; 50 letters there will be a newline.</p><p>cat -v -e ... shows:<br /></p><div class="codebox"><pre><code>X-Virus-Scanned: Debian amavisd-new at mail.my-server.tld$
X-Spam-Flag: NO$
X-Spam-Score: 4.259$
X-Spam-Level: ****$
X-Spam-Status: No, score=4.259 tagged_above=2 required=6.2$
    tests=[ALL_TRUSTED=-1, DKIM_ADSP_NXDOMAIN=0.8, FROM_ADDR_WS=2.999,$
    FROM_EXCESS_BASE64=0.105, HEADER_FROM_DIFFERENT_DOMAINS=0.249,$
    HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.105]$
    autolearn=no autolearn_force=no$
Received: from mail.my-server.tld ([127.0.0.1])$
    by mail.my-server.tld (mail.my-server.tld [127.0.0.1]) (amavisd-new, port 10026)$
    with ESMTP id QD-aK9Sq29VP for &lt;receiver@my-server.tld&gt;;$
    Fri, 19 Nov 2021 15:19:31 +0100 (CET)$
Received: from RS2014 (i6DFA2881.versanet.de [109.250.40.129])$
    by mail.my-server.tld (Postfix) with ESMTPSA id 4Hwf1b58hqz2RJl;$
    Fri, 19 Nov 2021 15:19:31 +0100 (CET)$

From: =?utf-8?B?UHJvZi4gRHIuIFJ1ZGkgU2NobWllZGU=?= &lt;sender@my-serve$
    r.tld&gt;$

Reply-To: sender@my-server.tld$
To: receiver@my-server.tld$
Subject: =?utf-8?B?VGVzdG2haWwgw8xiZXIgbWVpbmUgaWZzLUFkcmVzc3U=?=$
Date: Fri, 19 Nov 2021 15:19:34 +0100$
MIME-Version: 1.0$
Content-Type: text/html; charset=&quot;utf-8&quot;$
Content-Transfer-Encoding: base64$
X-MimeOLE: Chaos Intellect v10.2$
x-Account: IfS-RS$
x-MsgStatus: U$
x-linkedname: $
x-ImapUidl: $
X-Mailer: Chaos Intellect v10.3.0.6$</code></pre></div><p>I&#039;m trying to understand why and where the newline actually occurs at first - is it the emailclient or is there a setting in postfix / amavis? Due to RFC 5322 the length of headerfields should work fine up to 78 characters, which would be okay for his original FROM (above is shortend).</p>]]></description>
			<author><![CDATA[null@example.com (jobu)]]></author>
			<pubDate>Sat, 04 Dec 2021 11:25:15 +0000</pubDate>
			<guid>https://forum.iredmail.org/post81452.html#p81452</guid>
		</item>
		<item>
			<title><![CDATA[Re: Spam Score for FROM_ADDR_WS / bad header]]></title>
			<link>https://forum.iredmail.org/post81444.html#p81444</link>
			<description><![CDATA[<div class="quotebox"><cite>jobu wrote:</cite><blockquote><p>the sender gets a bounce message</p></blockquote></div><p>What&#039;s the content of bounce message? It&#039;s useful for troubleshooting.</p>]]></description>
			<author><![CDATA[null@example.com (ZhangHuangbin)]]></author>
			<pubDate>Sat, 04 Dec 2021 01:33:11 +0000</pubDate>
			<guid>https://forum.iredmail.org/post81444.html#p81444</guid>
		</item>
		<item>
			<title><![CDATA[Re: Spam Score for FROM_ADDR_WS / bad header]]></title>
			<link>https://forum.iredmail.org/post81366.html#p81366</link>
			<description><![CDATA[<p>Thanks for the reply, it seems spamassassin is not in use, but amavis seems to read out those settings. The spam score for FROM_ADDR_WS vanished now. My initial problem still exists, the sender gets a bounce message, my best guess is because of the newline in FROM.</p>]]></description>
			<author><![CDATA[null@example.com (jobu)]]></author>
			<pubDate>Sun, 21 Nov 2021 09:50:26 +0000</pubDate>
			<guid>https://forum.iredmail.org/post81366.html#p81366</guid>
		</item>
		<item>
			<title><![CDATA[Re: Spam Score for FROM_ADDR_WS / bad header]]></title>
			<link>https://forum.iredmail.org/post81364.html#p81364</link>
			<description><![CDATA[<p>you can set the score for FROM_ADDR_WS manually to 0 so it disables this check completly, this is not rladed to iredmail/amavis, its from spamasassin</p>]]></description>
			<author><![CDATA[null@example.com (Cthulhu)]]></author>
			<pubDate>Sun, 21 Nov 2021 06:06:25 +0000</pubDate>
			<guid>https://forum.iredmail.org/post81364.html#p81364</guid>
		</item>
		<item>
			<title><![CDATA[Spam Score for FROM_ADDR_WS / bad header]]></title>
			<link>https://forum.iredmail.org/post81355.html#p81355</link>
			<description><![CDATA[<p>==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====<br />- iRedMail version (check /etc/iredmail-release): 1.4.2<br />- Deployed with iRedMail Easy or the downloadable installer? Installer<br />- Linux/BSD distribution name and version: Debian 10.11<br />- Store mail accounts in which backend (LDAP/MySQL/PGSQL): LDAP<br />- Web server (Apache or Nginx): Nginx<br />- Manage mail accounts with iRedAdmin-Pro? yes<br />- [IMPORTANT] Related original log or error message is required if you&#039;re experiencing an issue.<br />====</p><p>Hi there,</p><p>we experience problems with headers containing a FROM like this ...<br /></p><div class="codebox"><pre><code>From: =?utf-7?B?UHJvZi5gRHIuIFJ2ZGkgU3NobWllZGU=?= &lt;user@mail.exampl
        e.org&gt;</code></pre></div><p>The newline in FROM should be okay regarding to RFCs.<br />The spam-status for those mails:<br /></p><div class="codebox"><pre><code>X-Spam-Status: No, score=4.259 tagged_above=2 required=6.2
        tests=[ALL_TRUSTED=-1, DKIM_ADSP_NXDOMAIN=0.8, FROM_ADDR_WS=2.999,
        FROM_EXCESS_BASE64=0.105, HEADER_FROM_DIFFERENT_DOMAINS=0.249,
        HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.105]</code></pre></div><p>I tried to deactivate the &quot;bad header check&quot; in iRedAdmin-Pro for those users, to get rid of the score for FROM_ADDR_WS, but i didn&#039;t work. Spamassasin is inactive, and there is no setting for FROM_ADDR_WS in /etc/amavis.</p><p>Anyone an idea?</p><p>Thanks in advance</p>]]></description>
			<author><![CDATA[null@example.com (jobu)]]></author>
			<pubDate>Fri, 19 Nov 2021 14:43:45 +0000</pubDate>
			<guid>https://forum.iredmail.org/post81355.html#p81355</guid>
		</item>
	</channel>
</rss>
