Bug 4801 - message from @microsoft.com users are classified as spam by SA 3.1.0
Summary: message from @microsoft.com users are classified as spam by SA 3.1.0
Status: RESOLVED DUPLICATE of bug 4798
Alias: None
Product: Spamassassin
Classification: Unclassified
Component: Rules (show other bugs)
Version: 3.1.0
Hardware: Other Linux
: P5 critical
Target Milestone: Undefined
Assignee: SpamAssassin Developer Mailing List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2006-02-17 11:01 UTC by Stephane Lentz
Modified: 2006-05-05 02:08 UTC (History)
0 users


Attachment Type Modified Status Actions Submitter/CLA Status
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Stephane Lentz 2006-02-17 11:01:34 UTC 
FP Classification for messages from Microsoft .

Technical Details
Content analysis details:   (10.1 hits, 6.0 required)
 1.4 RCVD_NUMERIC_HELO      Received: contains an IP address used for HELO
 3.1 RATWARE_OUTLOOK_NONAME Bulk email fingerprint (Outlook no name)
                            found
 3.1 MSGID_DOLLARS          Message-Id has pattern used in spam

Message headers (with just adresses altered) :

Received: from mail-eur.microsoft.com (mail-eur.microsoft.com [213.199.128.145])
        by mailgate2.company.fr (AL) with ESMTP id k1G9TZe1000984
        for <g.o@company.fr>
Comment 1 Martin Blapp 2006-02-19 22:52:23 UTC 
Hi,

I'm sure your problem are watchguard firewalls at senders place. Those
stupid firewalls have a mail gateway which strips the Outlook name
out of the mails and thus leads to false positives in SA.

There is only one workaround - we had to do the same. Lower the
scores of those three rules ...

Martin
Comment 2 eriker-sa 2006-05-05 07:49:57 UTC 
Could somebody with the suitable privileges please mark 4798 and 4799 as
duplicates of this one? For the record, 4798 contains full headers, so maybe
that one should be the "proper" bug for this?
Comment 3 Sidney Markowitz 2006-05-05 09:08:16 UTC 

*** This bug has been marked as a duplicate of 4798 ***