Re: outlook 2007 "Test" email scores 30+

View: New views
12 Messages — Rating Filter:   Alert me  

Re: outlook 2007 "Test" email scores 30+

by Kevin Gagel :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Some parts of this message have been removed. Learn more about Nabble's security policy.

What are you doing to SpamAssassin?

Post your configuration then perhaps someone can help you.

">Kevin W. Gagel
Network Administrator
Local 5448
My blog:
http://mail.cnc.bc.ca/blogs/gagel
My shared files:
http://mail.cnc.bc.ca/users/gagel


--- Original message ---
Subject: outlook 2007 "Test" email scores 30+
From: djjmj <dana.hanson@...>
To: <users@...>
Date: Friday, 10/30/2009 2:14 PM


Outlook 2007 for most of the clients under our domain are now having outgoing
emails blocked by Spam Assassin, which our ISP uses. This started in late
September (Outlook/MS update??). Simple Text emails with "hello" or "test"
get scored over 30. If I switch the users over to "windows mail" vs.
"Outlook" We have no problems but this is unacceptable, outlook is our
standard. So the question is what is Outlook 2007 doing to the outbound mail
to cause it to be scored so high with Spam Assassin. We are ready to move
our mail accounts to a different ISP!@!@ Any help is appreciated.
--
View this message in context: http://old.nabble.com/outlook-2007-%22Test%22-email-scores-30%2B-tp26136943p26136943.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.


Untitled Document

The College of New Caledonia
Visit us at http://www.cnc.bc.ca
Virus scanning is done on all incoming and outgoing email
Anti-spam information for CNC can be found at http://gateway.cnc.bc.ca



Re: outlook 2007 "Test" email scores 30+

by John Hardin :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

On Fri, 30 Oct 2009, Kevin Gagel wrote:

> What are you doing to SpamAssassin?
> Post your configuration then perhaps someone can help you.

Dana may not have that information - saying "which our ISP uses" suggests
SA is not under their control.

Dana:

Does your ISP bounce the messages back to you?

If so, are there any clues in the bounce as to why the messages are
scoring so high? Or does it just say "rejected by SpamAssassin" with no
details?

You really should be discussing this with your ISP's support desk or
postmaster. There's little we can do without data that you're likely
unable to provide. If your ISP has problems correcting the problem, then
they can ask here for help and provide the technical details needed to
troubleshoot the problem.

Something you could do is go to one of the various DNSBL websites and
check whether your internet gateway's public IP address is listed. Your
ISP may be doing something as simple as treating you as J. Random User
From The Internet rather than as one of their customers.

>>  --- Original message ---
>>  Subject: outlook 2007 "Test" email scores 30+
>>
>>  Outlook 2007 for most of the clients under our domain are now having
>>  outgoing emails blocked by Spam Assassin, which our ISP uses. This
>>  started in late September (Outlook/MS update??). Simple Text emails
>>  with "hello" or "test" get scored over 30. If I switch the users over
>>  to "windows mail" vs. "Outlook" We have no problems but this is
>>  unacceptable, outlook is our standard. So the question is what is
>>  Outlook 2007 doing to the outbound mail to cause it to be scored so
>>  high with Spam Assassin. We are ready to move our mail accounts to a
>>  different ISP!@!@ Any help is appreciated.

--
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@...    FALaholic #11174     pgpk -a jhardin@...
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   ...the Fates notice those who buy chainsaws...
                                               -- www.darwinawards.com
-----------------------------------------------------------------------
  Tomorrow: Halloween

Re: outlook 2007 "Test" email scores 30+

by djjmj :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

John Hardin wrote:
On Fri, 30 Oct 2009, Kevin Gagel wrote:

> What are you doing to SpamAssassin?
> Post your configuration then perhaps someone can help you.

>>Dana may not have that information - saying "which our ISP uses" suggests
>>SA is not under their control.

Correct SA is not under our control, just trying to find an answer to our problem.

>>Dana:

>>Does your ISP bounce the messages back to you?
No we don't get the bounced message returned, no notification until receiving user expecting something calls complaining.

>>If so, are there any clues in the bounce as to why the messages are
scoring so high? Or does it just say "rejected by SpamAssassin" with no
details?

>>You really should be discussing this with your ISP's support desk or
postmaster. There's little we can do without data that you're likely
unable to provide. If your ISP has problems correcting the problem, then
they can ask here for help and provide the technical details needed to
troubleshoot the problem.

We have been discussing with them since Sept 17th with no fixes yet. Once they found out
Windows Mail Client didn't have an issue they have been unwilling to help.
"Not a server side problem, your clients are the problem"

<Correct SA is not under our control, just trying to find an answer to our problem.

>>Something you could do is go to one of the various DNSBL websites and
check whether your internet gateway's public IP address is listed. Your
ISP may be doing something as simple as treating you as J. Random User
From The Internet rather than as one of their customers.
I requested this information from the ISP last week. There response was "our or your" domain are not black listed. Maybe I'm misunderstanding your ?

>>  --- Original message ---
>>  Subject: outlook 2007 "Test" email scores 30+
>>
>>  Outlook 2007 for most of the clients under our domain are now having
>>  outgoing emails blocked by Spam Assassin, which our ISP uses. This
>>  started in late September (Outlook/MS update??). Simple Text emails
>>  with "hello" or "test" get scored over 30. If I switch the users over
>>  to "windows mail" vs. "Outlook" We have no problems but this is
>>  unacceptable, outlook is our standard. So the question is what is
>>  Outlook 2007 doing to the outbound mail to cause it to be scored so
>>  high with Spam Assassin. We are ready to move our mail accounts to a
>>  different ISP!@!@ Any help is appreciated.

--
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@impsec.org    FALaholic #11174     pgpk -a jhardin@impsec.org
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   ...the Fates notice those who buy chainsaws...
                                               -- www.darwinawards.com
-----------------------------------------------------------------------
  Tomorrow: Halloween

Re: outlook 2007 "Test" email scores 30+

by Kris Deugau :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

djjmj wrote:
> We have been discussing with them since Sept 17th with no fixes yet. Once
> they found out
> Windows Mail Client didn't have an issue they have been unwilling to help.
> "Not a server side problem, your clients are the problem"

Then tell them you're walking as soon as you find another provider.  I'd
be quite happy as a mail/spamfilter admin if Outlook ceased to exist,
but it's easily second or third place in mail client popularity.
(Outlook Express/Windows Mail is in first;  Thunderbird is the other
player in the top three, IMO.)  MS Outlook is a common enough mail
client...  and preferred by *business* customers in a high enough
percentage... that not supporting it is downright stupid on their part.

Try enabling SMTP authentication, and possibly switching the outbound
port to 587 from the default 25;  most ISPs these days offer some form
of authenticated outbound relay that provides some buffer against
overscoring in SA.  TBH SA scores of 30+ sound like they've just bumped
the score on a couple of rules that target forged Outlook mail, without
considering the impact on legitimate relay traffic.

> John Hardin wrote:
>> Something you could do is go to one of the various DNSBL websites and
>> check whether your internet gateway's public IP address is listed. Your
>> ISP may be doing something as simple as treating you as J. Random User
>> From The Internet rather than as one of their customers.

> I requested this information from the ISP last week. There response was
> "our or your" domain are not black listed. Maybe I'm misunderstanding your
> ?

Yes, you've misunderstood.  John's question was about the IP address you
get on your connection;  visiting ipchicken.com (among other
possibilities) should tell you what IP your mail is apparently coming
"from".

Your ISP may have mangled their SA config (or just not bothered
configuring it properly in the first place) such that parts of their own
network used for customer connections aren't being properly bypassed or
handled by SA's network tests (among other things).

Is there any other pattern in the messages that are blocked?  (eg only
really short messages, messages with the word "foobar" in the first
paragraph, messages with more than five cute-kitten-pictures attached, etc)

(Just for the record, I've seen more and more filtering systems in
general pick up on short test messages for no reason I can see - Postini
is the big culprit in the mail flow I deal with so far, but I've had
occasional reports where other filter systems are involved.  Bleaugh.)

-kgd

Re: outlook 2007 "Test" email scores 30+

by John Hardin :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

On Fri, 30 Oct 2009, djjmj wrote:

> John Hardin wrote:
>>
> Dana may not have that information - saying "which our ISP uses" suggests
>> SA is not under their control.
>
> Correct SA is not under our control, just trying to find an answer to our
> problem.

>> Dana:
>>
>> Does your ISP bounce the messages back to you?
>
> No we don't get the bounced message returned, no notification until
> receiving user expecting something calls complaining.

Okay. At least they aren't causing backscatter.

>> You really should be discussing this with your ISP's support desk or
>> postmaster. There's little we can do without data that you're likely
>> unable to provide. If your ISP has problems correcting the problem,
>> then they can ask here for help and provide the technical details
>> needed to troubleshoot the problem.
>
> We have been discussing with them since Sept 17th with no fixes yet.
> Once they found out Windows Mail Client didn't have an issue they have
> been unwilling to help. "Not a server side problem, your clients are the
> problem"

Bummer. Will they even go look in the logs and see _why_ the messages are
being discarded?

>> Something you could do is go to one of the various DNSBL websites and
>> check whether your internet gateway's public IP address is listed. Your
>> ISP may be doing something as simple as treating you as J. Random User
>> From The Internet rather than as one of their customers.
>
> I requested this information from the ISP last week. There response was
> "our or your" domain are not black listed. Maybe I'm misunderstanding
> your ?

Expanded format:

Your connection to the Internet has an IP address.

When your ISP receives email from you, it comes from that IP address.

They _should_ have their mail system configured to say "that IP address is
our client, accept mail from it always".

They might not be doing that properly, in which case your IP address might
then be compared to DNS blacklists, and if it appears on one, be rejected.

But without knowing _why_ the ISP is rejecting your mail, that's just a
WAG.

Here's another question: are you using authenticated SMTP? There are
certain types of problems that will avoid. You might want to try using
authenticated SMTP. This might help getting that set up:

   http://www.barnard.columbia.edu/at/email/outlook-smtp.htm

>>>>  --- Original message ---
>>>>
>>>>  Outlook 2007 for most of the clients under our domain are now having
>>>>  outgoing emails blocked by Spam Assassin, which our ISP uses. This
>>>>  started in late September (Outlook/MS update??). Simple Text emails
>>>>  with "hello" or "test" get scored over 30. If I switch the users
>>>>  over to "windows mail" vs. "Outlook" We have no problems but this is
>>>>  unacceptable, outlook is our standard. So the question is what is
>>>>  Outlook 2007 doing to the outbound mail to cause it to be scored so
>>>>  high with Spam Assassin. We are ready to move our mail accounts to a
>>>>  different ISP!@!@ Any help is appreciated.

--
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@...    FALaholic #11174     pgpk -a jhardin@...
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   ...the Fates notice those who buy chainsaws...
                                               -- www.darwinawards.com
-----------------------------------------------------------------------
  Tomorrow: Halloween

Re: outlook 2007 "Test" email scores 30+

by djjmj :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

Thanks for the info Kris and John. I have something to work with the ISP now and somethings I can try on the client. BTW I agree with you on the Outlook existing comment. I have asked our ISP your questions throught our support post with them. We'll see what their response is.

Kris Deugau wrote:
djjmj wrote:
> We have been discussing with them since Sept 17th with no fixes yet. Once
> they found out
> Windows Mail Client didn't have an issue they have been unwilling to help.
> "Not a server side problem, your clients are the problem"

Then tell them you're walking as soon as you find another provider.  I'd
be quite happy as a mail/spamfilter admin if Outlook ceased to exist,
but it's easily second or third place in mail client popularity.
(Outlook Express/Windows Mail is in first;  Thunderbird is the other
player in the top three, IMO.)  MS Outlook is a common enough mail
client...  and preferred by *business* customers in a high enough
percentage... that not supporting it is downright stupid on their part.

Try enabling SMTP authentication, and possibly switching the outbound
port to 587 from the default 25;  most ISPs these days offer some form
of authenticated outbound relay that provides some buffer against
overscoring in SA.  TBH SA scores of 30+ sound like they've just bumped
the score on a couple of rules that target forged Outlook mail, without
considering the impact on legitimate relay traffic.

> John Hardin wrote:
>> Something you could do is go to one of the various DNSBL websites and
>> check whether your internet gateway's public IP address is listed. Your
>> ISP may be doing something as simple as treating you as J. Random User
>> From The Internet rather than as one of their customers.

> I requested this information from the ISP last week. There response was
> "our or your" domain are not black listed. Maybe I'm misunderstanding your
> ?

Yes, you've misunderstood.  John's question was about the IP address you
get on your connection;  visiting ipchicken.com (among other
possibilities) should tell you what IP your mail is apparently coming
"from".

Your ISP may have mangled their SA config (or just not bothered
configuring it properly in the first place) such that parts of their own
network used for customer connections aren't being properly bypassed or
handled by SA's network tests (among other things).

Is there any other pattern in the messages that are blocked?  (eg only
really short messages, messages with the word "foobar" in the first
paragraph, messages with more than five cute-kitten-pictures attached, etc)

(Just for the record, I've seen more and more filtering systems in
general pick up on short test messages for no reason I can see - Postini
is the big culprit in the mail flow I deal with so far, but I've had
occasional reports where other filter systems are involved.  Bleaugh.)

-kgd

Re: outlook 2007 "Test" email scores 30+

by djjmj :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

one small clarification, which didnt come to me until after I went to IPchicken. Our ISP is NOT our EmailSP We are using authenticaion on port 25. Tried 587, not configured on ESP side.

John Hardin wrote:
On Fri, 30 Oct 2009, djjmj wrote:

> John Hardin wrote:
>>
> Dana may not have that information - saying "which our ISP uses" suggests
>> SA is not under their control.
>
> Correct SA is not under our control, just trying to find an answer to our
> problem.

>> Dana:
>>
>> Does your ISP bounce the messages back to you?
>
> No we don't get the bounced message returned, no notification until
> receiving user expecting something calls complaining.

Okay. At least they aren't causing backscatter.

>> You really should be discussing this with your ISP's support desk or
>> postmaster. There's little we can do without data that you're likely
>> unable to provide. If your ISP has problems correcting the problem,
>> then they can ask here for help and provide the technical details
>> needed to troubleshoot the problem.
>
> We have been discussing with them since Sept 17th with no fixes yet.
> Once they found out Windows Mail Client didn't have an issue they have
> been unwilling to help. "Not a server side problem, your clients are the
> problem"

Bummer. Will they even go look in the logs and see _why_ the messages are
being discarded?

>> Something you could do is go to one of the various DNSBL websites and
>> check whether your internet gateway's public IP address is listed. Your
>> ISP may be doing something as simple as treating you as J. Random User
>> From The Internet rather than as one of their customers.
>
> I requested this information from the ISP last week. There response was
> "our or your" domain are not black listed. Maybe I'm misunderstanding
> your ?

Expanded format:

Your connection to the Internet has an IP address.

When your ISP receives email from you, it comes from that IP address.

They _should_ have their mail system configured to say "that IP address is
our client, accept mail from it always".

They might not be doing that properly, in which case your IP address might
then be compared to DNS blacklists, and if it appears on one, be rejected.

But without knowing _why_ the ISP is rejecting your mail, that's just a
WAG.

Here's another question: are you using authenticated SMTP? There are
certain types of problems that will avoid. You might want to try using
authenticated SMTP. This might help getting that set up:

   http://www.barnard.columbia.edu/at/email/outlook-smtp.htm

>>>>  --- Original message ---
>>>>
>>>>  Outlook 2007 for most of the clients under our domain are now having
>>>>  outgoing emails blocked by Spam Assassin, which our ISP uses. This
>>>>  started in late September (Outlook/MS update??). Simple Text emails
>>>>  with "hello" or "test" get scored over 30. If I switch the users
>>>>  over to "windows mail" vs. "Outlook" We have no problems but this is
>>>>  unacceptable, outlook is our standard. So the question is what is
>>>>  Outlook 2007 doing to the outbound mail to cause it to be scored so
>>>>  high with Spam Assassin. We are ready to move our mail accounts to a
>>>>  different ISP!@!@ Any help is appreciated.

--
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@impsec.org    FALaholic #11174     pgpk -a jhardin@impsec.org
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   ...the Fates notice those who buy chainsaws...
                                               -- www.darwinawards.com
-----------------------------------------------------------------------
  Tomorrow: Halloween

Re: outlook 2007 "Test" email scores 30+

by John Hardin :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

On Fri, 30 Oct 2009, djjmj wrote:

> one small clarification, which didnt come to me until after I went to
> IPchicken. Our ISP is NOT our EmailSP

That is a pretty critical part of the equation. Having problems with an
ESP changes many of the assumptions that we make if you say you're having
problems with your ISP...

After visiting IPChecken.com and getting your IP address, did you then
do a DNSBL lookup for it? If so, did you get any hits?

Here is a site that gives you your IP address and lets you check it
against DNSBLs:

    http://cqcounter.com/rbl_check/

> We are using authenticaion on port 25. Tried 587, not configured on ESP
> side.

They really should configure support for that. If they are reluctant to,
it should be another nail in their coffin as far as you are concerned.

--
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@...    FALaholic #11174     pgpk -a jhardin@...
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   ...the Fates notice those who buy chainsaws...
                                               -- www.darwinawards.com
-----------------------------------------------------------------------
  Today: Halloween

Re: outlook 2007 "Test" email scores 30+

by Gene Heskett :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

On Saturday 31 October 2009, John Hardin wrote:

>On Fri, 30 Oct 2009, djjmj wrote:
>> one small clarification, which didnt come to me until after I went to
>> IPchicken. Our ISP is NOT our EmailSP
>
>That is a pretty critical part of the equation. Having problems with an
>ESP changes many of the assumptions that we make if you say you're having
>problems with your ISP...
>
>After visiting IPChecken.com and getting your IP address, did you then
>do a DNSBL lookup for it? If so, did you get any hits?
>
>Here is a site that gives you your IP address and lets you check it
>against DNSBLs:
>
>    http://cqcounter.com/rbl_check/

Interesting.  I run a very small web page at http://gene.homelinx.net:85/gene 
and I suppose because I am in a dynamically assigned IP address range
(verizon adsl), I find I am on 4 of those lists.  Probably not a heckofalot I
can do about that, darnit.

Thanks for the link, bookmarked.


--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
The NRA is offering FREE Associate memberships to anyone who wants them.
<https://www.nrahq.org/nrabonus/accept-membership.asp>

I don't have an eating problem.  I eat.  I get fat.  I buy new clothes.
No problem.

Re: outlook 2007 "Test" email scores 30+

by Bart Schaefer :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

On Sat, Oct 31, 2009 at 9:31 AM, John Hardin <jhardin@...> wrote:
> Here is a site that gives you your IP address and lets you check it against
> DNSBLs:
>
>   http://cqcounter.com/rbl_check/

Just as a word of warning, that site is still checking
blacklist.spambag.org, which has been offline since 2007 and now lists
the entire Internet.

Re: outlook 2007 "Test" email scores 30+

by Gene Heskett :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

On Saturday 31 October 2009, Bart Schaefer wrote:

>On Sat, Oct 31, 2009 at 9:31 AM, John Hardin <jhardin@...> wrote:
>> Here is a site that gives you your IP address and lets you check it
>> against DNSBLs:
>>
>>   http://cqcounter.com/rbl_check/
>
>Just as a word of warning, that site is still checking
>blacklist.spambag.org, which has been offline since 2007 and now lists
>the entire Internet.
>
That reduces my addresses hit count to 3 obviously.  Thanks for the heads up,
Bart.

--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
The NRA is offering FREE Associate memberships to anyone who wants them.
<https://www.nrahq.org/nrabonus/accept-membership.asp>

What I tell you three times is true.
                -- Lewis Carroll

Re: outlook 2007 "Test" email scores 30+

by John Hardin :: Rate this Message:

Reply to Author | View Threaded | Show Only this Message

On Sat, 31 Oct 2009, Bart Schaefer wrote:

> On Sat, Oct 31, 2009 at 9:31 AM, John Hardin <jhardin@...> wrote:
>> Here is a site that gives you your IP address and lets you check it against
>> DNSBLs:
>>
>>  http://cqcounter.com/rbl_check/
>
> Just as a word of warning, that site is still checking
> blacklist.spambag.org, which has been offline since 2007 and now lists
> the entire Internet.

There are, of course, several sites that do multiple-DNSBL checks; it's
possible that this one doesn't check some - for example, though I saw the
component lists I didn't see it checking zen.spamhaus.org. It just came up
high on a quick google, and happened to have an automatic link for "check
your current IP address".

--
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@...    FALaholic #11174     pgpk -a jhardin@...
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   ...the Fates notice those who buy chainsaws...
                                               -- www.darwinawards.com
-----------------------------------------------------------------------
  Today: Halloween