Re: [exim] SPAM report

Top Page
Delete this message
Reply to this message
Author: George L. Yermulnik
Date:  
To: exim-users
Subject: Re: [exim] SPAM report
Hello!

On Sun, 30 Sep 2018 at 21:40:49 (+0300), Александр Кириллов via Exim-users wrote:

> Thanks for sharing, George! The idea is to split the report into several
> headers. Got it.


Yup, the idea is to split report into a correspondent amount of header lines to make it readable and to not overflow single header line length. E.g.:
X-nb-Spam-Score: 5.1 [+++++] (nb)
X-nb-SA: host=spamassassin.host score=5.1
X-nb-SA: 1.0 INVALID_DATE -> Invalid Date: header (not RFC 2822)
X-nb-SA: 1.0 MISSING_HEADERS -> Missing To: header
X-nb-SA: 0.8 BAYES_50 -> BODY: Bayes spam probability is 40 to 60% [score: 0.5307]
X-nb-SA: 0.5 MISSING_MID -> Missing Message-Id: header
X-nb-SA: 0.8 RDNS_NONE -> Delivered to internal network by a host with no rDNS
X-nb-SA: 1.0 MISSING_FROM -> Missing From: header

> I wonder if it's possible to pad the report lines so they
> would fold naturally at the right places.


It's not anything to do with Exim. Exim just consumes what SpamAssassin
outputs and makes it possible to insert SpamAssassin's report into headers.
Just keep in mind that length of single header line is limited.

> вс, 30 сент. 2018 г. в 20:51, George L. Yermulnik via Exim-users <
> exim-users@???>:


> > Hello!


> > On Sun, 30 Sep 2018 at 18:44:36 (+0300), Александр Кириллов via Exim-users
> > wrote:


> > > Hi! There're no line breaks in spam report. Is there a way to make it
> > more
> > > readable?


> > Here's what I use to make report readable:


> > main config:
> > SHORTNAME       = ${extract{1}{.}{$primary_hostname}}


> > acl_check_content:
> >         [...]
> >         add_header      = X-SHORTNAME-SA:
> > ${sg{${sg{${sg{$spam_report}{\N\n\s*\[\N}{ [}}}{\N\n\s*(-?\d+\.\d+
> > [[:upper:][:digit:]_]+)\N}{\nX-SHORTNAME-SA: \$1 -> }}}{\N(\s{2,}|\t)\N}{ }}


> > As I've got several Exim hosts with SpamAssassin checks configured custom
> > X-header is used to determine which host added the report, so you can
> > easily replace "X-SHORTNAME-SA" with more common "X-Spam-Report" for you.
> > SpamAssassin itself is configured to not output report header. Try it and
> > tune to your needs if needed =)


> > > X-Spam-Report: Content analysis details:   (5.4 points, 5.0 required) pts
> > >  rule name              description ---- ----------------------
> > >  -------------------------------------------------- -0.5 BAYES_05


> > >   BODY: Bayes spam probability is 1 to 5% [score: 0.0355] -0.1
> > > DKIM_VALID_AU
> > >         Message has a valid DKIM or DK signature from author's domain
> > -0.1
> > >  DKIM_VALID             Message has at least one valid DKIM or DK
> > signature
> > >  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not
> > >  necessarily valid 0.0 FREEMAIL_FROM          Sender email is commonly
> > > abused
> > >  enduser mail provider (xxxxxxxx[at]gmail.com) 5.0 GTUBE
> > >  BODY: Generic Test for Unsolicited Bulk Email 0.0 HTML_MESSAGE
> > >  BODY: HTML included in message -0.0 RCVD_IN_DNSWL_NONE     RBL: Sender
> > > listed
> > >  at http://www.dnswl.org/, no trust [209.85.221.42 listed in
> > list.dnswl.org]
> > >  1.0 FROM_EXCESS_BASE64     From: base64 encoded unnecessarily


> > --
> > George L. Yermulnik
> > [YZ-RIPE]


> > --
> > ## List details at https://lists.exim.org/mailman/listinfo/exim-users
> > ## Exim details at http://www.exim.org/
> > ## Please use the Wiki with this list - http://wiki.exim.org/


--
George L. Yermulnik
[YZ-RIPE]