Re: [exim] SPAM report

Top Page
Delete this message
Reply to this message
Author: Александр Кириллов
Date:  
To: exim-users
Subject: Re: [exim] SPAM report
Well, I've tried this padding thing:

warn add_header = X-Spam-Score: $spam_score\n\
                  X-Spam-Report:
--------------------------------------------------------------\n\
                  ${map{<\n $spam_report}{ ${length_77:$item
                                                              }}}


And this is the best I could do:

X-Spam-Report:
--------------------------------------------------------------
 -1.9 BAYES_00               BODY: Bayes spam probability is 0 to 1%


[score: 0.0011]

 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
aut
 domain


 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK
signatu
 0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not
necessaril
 0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail
provi
 (xxxxxxxx[at]gmail.com)


 5.0 GTUBE                  BODY: Generic Test for Unsolicited Bulk Email


 0.0 HTML_MESSAGE           BODY: HTML included in message


 -0.0 RCVD_IN_DNSWL_NONE     RBL: Sender listed at http://www.dnswl.org/,
no
 trust


[209.85.128.45 listed in list.dnswl.org]

 1.0 FROM_EXCESS_BASE64     From: base64 encoded unnecessarily



It turned to be difficult to preserve the original formatting as exim
functions do not care about leading white space.


вс, 30 сент. 2018 г. в 23:26, George L. Yermulnik via Exim-users <
exim-users@???>:

> Hello!
>
> On Sun, 30 Sep 2018 at 21:40:49 (+0300), Александр Кириллов via Exim-users
> wrote:
>
> > Thanks for sharing, George! The idea is to split the report into several
> > headers. Got it.
>
> Yup, the idea is to split report into a correspondent amount of header
> lines to make it readable and to not overflow single header line length.
> E.g.:
> X-nb-Spam-Score: 5.1 [+++++] (nb)
> X-nb-SA: host=spamassassin.host score=5.1
> X-nb-SA: 1.0 INVALID_DATE -> Invalid Date: header (not RFC 2822)
> X-nb-SA: 1.0 MISSING_HEADERS -> Missing To: header
> X-nb-SA: 0.8 BAYES_50 -> BODY: Bayes spam probability is 40 to 60%
> [score: 0.5307]
> X-nb-SA: 0.5 MISSING_MID -> Missing Message-Id: header
> X-nb-SA: 0.8 RDNS_NONE -> Delivered to internal network by a host with
> no rDNS
> X-nb-SA: 1.0 MISSING_FROM -> Missing From: header
>
> > I wonder if it's possible to pad the report lines so they
> > would fold naturally at the right places.
>
> It's not anything to do with Exim. Exim just consumes what SpamAssassin
> outputs and makes it possible to insert SpamAssassin's report into headers.
> Just keep in mind that length of single header line is limited.
>
> > вс, 30 сент. 2018 г. в 20:51, George L. Yermulnik via Exim-users <
> > exim-users@???>:
>
> > > Hello!
>
> > > On Sun, 30 Sep 2018 at 18:44:36 (+0300), Александр Кириллов via
> Exim-users
> > > wrote:
>
> > > > Hi! There're no line breaks in spam report. Is there a way to make it
> > > more
> > > > readable?
>
> > > Here's what I use to make report readable:
>
> > > main config:
> > > SHORTNAME       = ${extract{1}{.}{$primary_hostname}}

>
> > > acl_check_content:
> > >         [...]
> > >         add_header      = X-SHORTNAME-SA:
> > > ${sg{${sg{${sg{$spam_report}{\N\n\s*\[\N}{ [}}}{\N\n\s*(-?\d+\.\d+
> > > [[:upper:][:digit:]_]+)\N}{\nX-SHORTNAME-SA: \$1 ->
> }}}{\N(\s{2,}|\t)\N}{ }}

>
> > > As I've got several Exim hosts with SpamAssassin checks configured
> custom
> > > X-header is used to determine which host added the report, so you can
> > > easily replace "X-SHORTNAME-SA" with more common "X-Spam-Report" for
> you.
> > > SpamAssassin itself is configured to not output report header. Try it
> and
> > > tune to your needs if needed =)
>
> > > > X-Spam-Report: Content analysis details:   (5.4 points, 5.0
> required) pts
> > > >  rule name              description ---- ----------------------
> > > >  -------------------------------------------------- -0.5 BAYES_05

>
> > > >   BODY: Bayes spam probability is 1 to 5% [score: 0.0355] -0.1
> > > > DKIM_VALID_AU
> > > >         Message has a valid DKIM or DK signature from author's domain
> > > -0.1
> > > >  DKIM_VALID             Message has at least one valid DKIM or DK
> > > signature
> > > >  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not
> > > >  necessarily valid 0.0 FREEMAIL_FROM          Sender email is
> commonly
> > > > abused
> > > >  enduser mail provider (xxxxxxxx[at]gmail.com) 5.0 GTUBE
> > > >  BODY: Generic Test for Unsolicited Bulk Email 0.0 HTML_MESSAGE
> > > >  BODY: HTML included in message -0.0 RCVD_IN_DNSWL_NONE     RBL:
> Sender
> > > > listed
> > > >  at http://www.dnswl.org/, no trust [209.85.221.42 listed in
> > > list.dnswl.org]
> > > >  1.0 FROM_EXCESS_BASE64     From: base64 encoded unnecessarily

>
> > > --
> > > George L. Yermulnik
> > > [YZ-RIPE]
>
> > > --
> > > ## List details at https://lists.exim.org/mailman/listinfo/exim-users
> > > ## Exim details at http://www.exim.org/
> > > ## Please use the Wiki with this list - http://wiki.exim.org/
>
> --
> George L. Yermulnik
> [YZ-RIPE]
>
> --
> ## List details at https://lists.exim.org/mailman/listinfo/exim-users
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://wiki.exim.org/
>