Just recently backscatter starts to hit me very bad, and I found out
that bounces generated by qmail are not detected by the vbounce plugin.
Here is such a backscatter mail:

http://pastebin.com/m346c7979

Perhaps a phrase like "wasn't able to deliver your message" could be
added to the detection. Or very qmail-specific:
/qmail-send program .{80,140}This is a permanent error/

Tschau
Alex

>> Just recently backscatter starts to hit me very bad, and I found out
>> that bounces generated by qmail are not detected by the vbounce
>> plugin. Here is such a backscatter mail:
>>
>> http://pastebin.com/m346c7979
>>
>> Perhaps a phrase like "wasn't able to deliver your message" could be
>> added to the detection. Or very qmail-specific:
>> /qmail-send program .{80,140}This is a permanent error/
>
> it hits (BOUNCE_MESSAGE, ANY_BOUNCE_MESSAGE) here (3.2.4).
>
>
> did you set the whitelist_bounce_relays directive as documented in
> http://wiki.apache.org/spamassassin/VBounceRuleset

Yes I did, and all the other backscatter is detected by vbounce fine:
whitelist_bounce_relays lxrouter.wombaz.localnet *.prima.de

But now I saw the Message-Id contained my local mail server name from
whitelist_bounce_relays:

> Message-Id: <20080605045059.2705546807@lxrouter.wombaz.localnet>

The "lxrouter.wombaz.localnet" can only be generated by my system. It is
the intranet name of my mail server. This leads me to the conclusion
that qmail doesn't insert a Message-Id and the above was added by my MTA
(postfix) - and this prohibits the message from being detected as
backscatter.

Tschau
Alex

On Thursday 05 June 2008 23:34:42 mouss wrote:
> the Message-id must be supplied by the MUA.

RFC 2822 says: "every message SHOULD have a "Message-ID:" field."
i can't find the addition "except the origin is a pre stoneage qmail server"
here.
Well.... it says "SHOULD". So actually your system is supposed to handle a
non existing message id gracefully and qmail gets away once again.

--
best regards/Mit freundlichen Grüßen
Arvid Ephraim Picciani

On Thu, June 5, 2008 23:34, mouss wrote:

> stop incriminating qmail. the Message-id must be supplied by the MUA. if
> postfix adds a missing message-id, then it's a postfix problem, not a
> qmail problem.

if qmail, if postfix, maybe he have 2 mta ? :-)

postfix add mta hostname to message-id if its not valid else it leaves it as is


Benny Pedersen
Need more webspace ? http://www.servage.net/?coupon=cust37098

On Friday 06 June 2008 00:11:37 mouss wrote:

> postfix adds missing (mandatory) headers because it works as a
> submission MTA, because this is how sendmail has always worked. This
> behaviour is no more desirable for an MX (it is good for an MSA).

Right now i get your point. I thought you where saying that an MSA shouldnt
add those either. Obviously if you are the last MX in the chain, adding a
message id is totally useless. i agree on that.

--
best regards/Mit freundlichen Grüßen
Arvid Ephraim Picciani

On Thu, 5 Jun 2008, Arvid Ephraim Picciani wrote:

> On Thursday 05 June 2008 23:34:42 mouss wrote:
> > the Message-id must be supplied by the MUA.
>
> RFC 2822 says: "every message SHOULD have a "Message-ID:" field."
> i can't find the addition "except the origin is a pre stoneage qmail server"
> here.
> Well.... it says "SHOULD". So actually your system is supposed to handle a
> non existing message id gracefully and qmail gets away once again.

However RFC-2821, section 6.3 (Compensating for Irregularities) says
that the originating SMTP server may add a message-id field when none
appears. So if qmail is the first SMTP server to fondle the message
it could/(should?) add a message-id.


--
Dave Funk University of Iowa
College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include
Better is not better, 'standard' is better. B{

At 15:25 05-06-2008, David B Funk wrote:
>However RFC-2821, section 6.3 (Compensating for Irregularities) says
>that the originating SMTP server may add a message-id field when none
>appears. So if qmail is the first SMTP server to fondle the message
>it could/(should?) add a message-id.

It's up to the MSA to do that. AFAIK, the author of that software
does not agree that the message-id should be added.

Regards,
-sm

>> Yes I did, and all the other backscatter is detected by vbounce fine:
>> whitelist_bounce_relays lxrouter.wombaz.localnet *.prima.de
>>
>> But now I saw the Message-Id contained my local mail server name from
>> whitelist_bounce_relays:
>>
>>> Message-Id: <20080605045059.2705546807@lxrouter.wombaz.localnet>
>>
>> The "lxrouter.wombaz.localnet" can only be generated by my system. It is
>> the intranet name of my mail server. This leads me to the conclusion
>> that qmail doesn't insert a Message-Id

> stop incriminating qmail. the Message-id must be supplied by the MUA. if
> postfix adds a missing message-id, then it's a postfix problem, not a
> qmail problem.

I have no intention of starting a qmail/postfix/whatever flame war. I
was not aware that qmail seems to be a delicate subject for some people.
I simply had a problem with not detecting backscatter.

For the time being, I solved the problem by removing
"lxrouter.wombaz.localnet" from whitelist_bounce_relays.
@prima.de is already always present in my Received: lines,
since I send all of my mail through their smarthost.

Tschau
Alex

On Fri, June 6, 2008 14:33, Alex Woick wrote:
>>> whitelist_bounce_relays lxrouter.wombaz.localnet *.prima.de

should be ok if its public dns

>>>> Message-Id: <20080605045059.2705546807@lxrouter.wombaz.localnet>

postfix add $myhostname here

> For the time being, I solved the problem by removing
> "lxrouter.wombaz.localnet" from whitelist_bounce_relays.

imho this is wroung

> @prima.de is already always present in my Received: lines,
> since I send all of my mail through their smarthost.

postconf -d | grep rewrite

here is what i do:
local_header_rewrite_clients = permit_inet_interfaces
remote_header_rewrite_domain = localhost.junc.org

when email from outside my inet interfaces have not fqdn i add & rewrite with
localhost.junc.org with resolves to 127.0.0.1

if its inside inet interface i add $mydomain

now that is in place i can score on this fact in spamassassin


Benny Pedersen
Need more webspace ? http://www.servage.net/?coupon=cust37098

Alex Woick writes:
> Just recently backscatter starts to hit me very bad, and I found out
> that bounces generated by qmail are not detected by the vbounce plugin.
> Here is such a backscatter mail:
>
> http://pastebin.com/m346c7979

: jm 5...; ./spamassassin -D -Lt < /home/jm/DL/m346c7979.txt
....
Content analysis details: (2.7 points, 5.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
2.5 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date
0.0 T_FB_WORD2_END_DOLLAR BODY: Looks like a word ending with a $ (2)
0.0 T_FB_WORD1_END_DOLLAR BODY: Looks like a word ending with a $
0.0 T_JM_SOUGHT_1 T_JM_SOUGHT_1
0.1 BOUNCE_MESSAGE MTA bounce message
0.1 ANY_BOUNCE_MESSAGE Message is some kind of bounce message


looks fine to me.

--j.