On 2/7/07, Craig White wrote: > > On Wed, 2007-02-07 at 19:55 -0700, Mike Schwartz wrote: > > > ---- > > I don't know how Google scored it - there didn't seem to be > > anything > > amiss or that would cause it to score a big number with > > spamassassin but > > generally, spamassassin configuration would include the > > scoring > > information in the headers if it scored high enough to be > > flagged as > > spam. Thus if you want to contribute information back to the > > OP - you > > should include the spamassassin scores which will indicate > > which > > rulesets marked it as spam. > > > > Craig > > --------------------------------------------------- > > PLUG-discuss mailing list - [...] > > > > another comment from Mike: > > Maybe it had something to do with those "dotted quad" > > IP addresses (which some e-mail systems, > > including gmail apparently, turn in to clickable hyper > > links, to a URL with Prefix of "http://", and the IP > > address instead of a domain name, and just a "/" > > suffix). > > Some Spam messages probably tend to contain > > URLs with a [numeric] IP address where the domain > > name usually goes. Maybe there is some robot "rule" > > that "cries wolf" when it spots anything even remotely > > like that. > > It might also be affected by the fact that, going to > > the PLUG-Discuss list, it was probably seen many > > times, that is, several copies of the message being > > sent to different subscribers. > > Just a guess... > ---- > Mike - you missed my point. > > There is no need/reason to guess at all. > > Unless someone takes extra measures to prevent this (and it would be > foolish to do so), the actual scoring of an e-mail that is scored > sufficiently to register as spam will include the actual rules and the > score values for triggering those rules in the header and I know that > gmail has an option to view all of the header information (like all > other programs, the headers are minimized by default). If you choose to > view all of the headers, you will see the spamassassin scoring and can > report back specifically. > > Why indulge in speculation when the reality is in front of you? > > Craig > > --------------------------------------------------- > PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us > To subscribe, unsubscribe, or to change you mail settings: > http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss > OK, I may have misunderstood. I am not familiar with Spamassassin and the only way I know of to get the "full headers" for a message in my gmail mailbox, is to use the feature called "show original" - - which I do not do very often. /// ======= start of "show original" ======== /// Delivered-To: mike.l.schwartz@gmail.com Received: by 10.78.148.13 with SMTP id v13cs24699hud; Wed, 7 Feb 2007 10:21:14 -0800 (PST) Received: by 10.70.113.13 with SMTP id l13mr16027635wxc.1170872473906; Wed, 07 Feb 2007 10:21:13 -0800 (PST) Return-Path: Received: from pluglist.macrosift.com (wsip-68-14-243-59.ph.ph.cox.net [68.14.243.59]) by mx.google.com with ESMTP id 3si1712779aga.2007.02.07.10.20.59; Wed, 07 Feb 2007 10:21:13 -0800 (PST) Received-SPF: neutral (google.com: 68.14.243.59 is neither permitted nor denied by best guess record for domain of plug-discuss-bounces@lists.plug.phoenix.az.us) Received: from lists.plug.phoenix.az.us (lists [127.0.0.1]) by pluglist.macrosift.com (Postfix) with ESMTP id 9ABA51475E9; Wed, 7 Feb 2007 09:55:55 -0700 (MST) X-Original-To: plug-discuss@lists.plug.phoenix.az.us Delivered-To: plug-discuss@lists.plug.phoenix.az.us Received: from mout.perfora.net (mout.perfora.net [217.160.230.41]) by pluglist.macrosift.com (Postfix) with ESMTP id 41CA31475C7 for ; Wed, 7 Feb 2007 09:55:53 -0700 (MST) Received: from [68.110.173.194] (helo=[10.0.0.102]) by mrelay.perfora.net (node=mrelayus0) with ESMTP (Nemesis), id 0MKoyl-1HErPR2B77-0007bT; Wed, 07 Feb 2007 13:20:47 -0500 Subject: IPCOP From: ssjgolleta To: Main PLUG discussion list In-Reply-To: <64260277-E3BF-46C6-9E98-A94CDC5D100A@garfias.org> References: <64260277-E3BF-46C6-9E98-A94CDC5D100A@garfias.org> Date: Wed, 07 Feb 2007 11:22:01 -0700 Message-Id: <1170872521.5258.14.camel@APANB102> Mime-Version: 1.0 X-Mailer: Evolution 2.8.1 X-Provags-ID: perfora.net abuse@perfora.net login:cf1dc9ed7ee1e09bc6211c4f099c02a4 X-Provags-ID2: V01U2FsdGVkX18ssCSldlOYuqpQL5rJuScZRgjcd6yuT6/Ox48Qe/BqueDnJ1FHNK+ADeG6aY/S9PWCiHB/fGkd/xePSi6Xp6WZY0YBqD2eryp2eKG/CCDnExtEclmOBBHhISqLKVyM5jc= X-BeenThere: plug-discuss@lists.plug.phoenix.az.us X-Mailman-Version: 2.1.9 Precedence: list Reply-To: ssjgolleta@anima-web.us, Main PLUG discussion list List-Id: Main PLUG discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: plug-discuss-bounces@lists.plug.phoenix.az.us Errors-To: plug-discuss-bounces@lists.plug.phoenix.az.us /// ======= end of "show original" ======== /// This may not be exactly what you meant. (perhaps I would have have to ask it to "show original", before clicking on "Not Spam" to move it to my INBOX?) (if so, is it too late now?) (just wondering...) Could this stuff be the key important lines? : X-Provags-ID: perfora.net abuse@perfora.net login:cf1dc9ed7ee1e09bc6211c4f099c02a4 X-Provags-ID2: V01U2FsdGVkX18ssCSldlOYuqpQL5rJuScZRgjcd6yuT6/Ox48Qe/BqueDnJ1FHNK+ADeG6aY/S9PWCiHB/fGkd/xePSi6Xp6WZY0YBqD2eryp2eKG/CCDnExtEclmOBBHhISqLKVyM5jc= I have seen some "scoring" info, in the "full headers", for a message sent to my "acm.org" account, which is a "forwarding" address. The acm.org folks use postini.com to do their spam detection. I currently have it set up to "forward" only if (it thinks) a given message should go to my INBOX. If it thinks it is junk, then it puts it in a "quarantine" place, where I can still get to it (I do occasionally find a real e-mail there, like one about 2 weeks ago from my first cousin in CHIcago who was notifying about 200 of her closest friends / relatives, about some change of address...) The messages that get processed by postini.com have some detailed scoring information in their [full] headers, but I usually do not delve in to it too deeply; I just click on "deliver" (which is like saying, [this message is] "Not Spam" - so please "deliver" it now, that is, forward it); and then there is a little checkbox to white-list the sender, which I typically do, if I am asking them to "deliver" a certain message, ie, get it out of quarantine. Anyway, if the stuff I included above is what you meant, then please proceed to explain what it is saying and/or, use your powers for good "in some way". Thanks, -- Mike Schwartz Glendale AZ schwartz@acm.org Mike.L.Schwartz@gmail.com