Spamassasin rule sometimes active when it shouldn't?

Bugs in eFa 4
Post Reply
e-d-i-t
Posts: 92
Joined: 27 Apr 2016 19:28
Contact:

Spamassasin rule sometimes active when it shouldn't?

Post by e-d-i-t » 03 Feb 2021 08:55

I want to allow only certain Top Level Domain names, skipping actually everything for us which is spam.

My extra spam rule:

# add points if the From address is not a valid host in a listed TLD
header LOCAL_FROM_TLD From !~ /@.{1,}\.(com|nl|net|be|de|eu)/i
describe LOCAL_FROM_TLD Sender is not a valid host in approved Top Level Domain list
score LOCAL_FROM_TLD 8

Now, the strange part...
It is triggered sometimes when the address is still ending on .com

E.g. this From in the header triggers +8 score:

From: AliExpress <promotion@aliexpress.com>

But also

From: "into-led.com" <info@into-led.com>

And there is always a different From in header than the "real" From which is: bounces+10285382-b5fa-someone=ourdomain.nl@em9360.into-led.com

Why is it so weird it sometimes adds scores and sometimes not?
I cannot find a pattern in this behavior.

User avatar
shawniverson
Posts: 3398
Joined: 13 Jan 2014 23:30
Location: Indianapolis, Indiana USA
Contact:

Re: Spamassasin rule sometimes active when it shouldn't?

Post by shawniverson » 03 Feb 2021 12:00

Which file contains this rule?

e-d-i-t
Posts: 92
Joined: 27 Apr 2016 19:28
Contact:

Re: Spamassasin rule sometimes active when it shouldn't?

Post by e-d-i-t » 03 Feb 2021 13:41

I added my own file "z_TLD.cf" in /etc/mail/spamassassin
Did a Lint test and seems fine.

smyers119
Posts: 108
Joined: 29 Nov 2019 11:36

Re: Spamassasin rule sometimes active when it shouldn't?

Post by smyers119 » 05 Feb 2021 01:35

Your regular expression is fine, that is weird that it's not working correctly

What happens if we change it up a little?

Code: Select all

# add points if the From address is not a valid host in a listed TLD
header __LOCAL_FROM_TLD_1 From =~ /@.{1,}\.com/iU
header __LOCAL_FROM_TLD_2 From =~ /@.{1,}\.nl/iU
header __LOCAL_FROM_TLD_3 From =~ /@.{1,}\.net/iU
header __LOCAL_FROM_TLD_4 From =~ /@.{1,}\.be/iU
header __LOCAL_FROM_TLD_5 From =~ /@.{1,}\.de/iU
header __LOCAL_FROM_TLD_6 From =~ /@.{1,}\.eu/iU
meta LOCAL_FROM_TLD (( __LOCAL_FROM_TLD_1 + __LOCAL_FROM_TLD_2 + __LOCAL_FROM_TLD_3 + __LOCAL_FROM_TLD_4 + __LOCAL_FROM_TLD_5 + __LOCAL_FROM_TLD_6) < 1)
describe LOCAL_FROM_TLD Sender is not a valid host in approved Top Level Domain list
score LOCAL_FROM_TLD 8

e-d-i-t
Posts: 92
Joined: 27 Apr 2016 19:28
Contact:

Re: Spamassasin rule sometimes active when it shouldn't?

Post by e-d-i-t » 05 Feb 2021 09:18

Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_1 '/@.{1,}\.com/iU': invalid end delimiter/mods 0.00229
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_2 '/@.{1,}\.nl/iU': invalid end delimiter/mods 1.0E-5
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_3 '/@.{1,}\.net/iU': invalid end delimiter/mods 9.0E-5
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_4 '/@.{1,}\.be/iU': invalid end delimiter/mods 1.0E-5
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_5 '/@.{1,}\.de/iU': invalid end delimiter/mods 0.00012
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_6 '/@.{1,}\.eu/iU': invalid end delimiter/mods

So I changed it to /i again, no errors after that.
We'll wait and see coming week what will happen ;)

Thanks!

smyers119
Posts: 108
Joined: 29 Nov 2019 11:36

Re: Spamassasin rule sometimes active when it shouldn't?

Post by smyers119 » 05 Feb 2021 13:55

e-d-i-t wrote:
05 Feb 2021 09:18
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_1 '/@.{1,}\.com/iU': invalid end delimiter/mods 0.00229
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_2 '/@.{1,}\.nl/iU': invalid end delimiter/mods 1.0E-5
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_3 '/@.{1,}\.net/iU': invalid end delimiter/mods 9.0E-5
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_4 '/@.{1,}\.be/iU': invalid end delimiter/mods 1.0E-5
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_5 '/@.{1,}\.de/iU': invalid end delimiter/mods 0.00012
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_6 '/@.{1,}\.eu/iU': invalid end delimiter/mods

So I changed it to /i again, no errors after that.
We'll wait and see coming week what will happen ;)

Thanks!
I guess it does not support the Ungreedy modifier, shouldn't change the results.

Post Reply