Page 1 of 1

Spamassasin rule sometimes active when it shouldn't?

Posted: 03 Feb 2021 08:55
by e-d-i-t
I want to allow only certain Top Level Domain names, skipping actually everything for us which is spam.

My extra spam rule:

# add points if the From address is not a valid host in a listed TLD
header LOCAL_FROM_TLD From !~ /@.{1,}\.(com|nl|net|be|de|eu)/i
describe LOCAL_FROM_TLD Sender is not a valid host in approved Top Level Domain list
score LOCAL_FROM_TLD 8

Now, the strange part...
It is triggered sometimes when the address is still ending on .com

E.g. this From in the header triggers +8 score:

From: AliExpress <promotion@aliexpress.com>

But also

From: "into-led.com" <info@into-led.com>

And there is always a different From in header than the "real" From which is: bounces+10285382-b5fa-someone=ourdomain.nl@em9360.into-led.com

Why is it so weird it sometimes adds scores and sometimes not?
I cannot find a pattern in this behavior.

Re: Spamassasin rule sometimes active when it shouldn't?

Posted: 03 Feb 2021 12:00
by shawniverson
Which file contains this rule?

Re: Spamassasin rule sometimes active when it shouldn't?

Posted: 03 Feb 2021 13:41
by e-d-i-t
I added my own file "z_TLD.cf" in /etc/mail/spamassassin
Did a Lint test and seems fine.

Re: Spamassasin rule sometimes active when it shouldn't?

Posted: 05 Feb 2021 01:35
by smyers119
Your regular expression is fine, that is weird that it's not working correctly

What happens if we change it up a little?

Code: Select all

# add points if the From address is not a valid host in a listed TLD
header __LOCAL_FROM_TLD_1 From =~ /@.{1,}\.com/iU
header __LOCAL_FROM_TLD_2 From =~ /@.{1,}\.nl/iU
header __LOCAL_FROM_TLD_3 From =~ /@.{1,}\.net/iU
header __LOCAL_FROM_TLD_4 From =~ /@.{1,}\.be/iU
header __LOCAL_FROM_TLD_5 From =~ /@.{1,}\.de/iU
header __LOCAL_FROM_TLD_6 From =~ /@.{1,}\.eu/iU
meta LOCAL_FROM_TLD (( __LOCAL_FROM_TLD_1 + __LOCAL_FROM_TLD_2 + __LOCAL_FROM_TLD_3 + __LOCAL_FROM_TLD_4 + __LOCAL_FROM_TLD_5 + __LOCAL_FROM_TLD_6) < 1)
describe LOCAL_FROM_TLD Sender is not a valid host in approved Top Level Domain list
score LOCAL_FROM_TLD 8

Re: Spamassasin rule sometimes active when it shouldn't?

Posted: 05 Feb 2021 09:18
by e-d-i-t
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_1 '/@.{1,}\.com/iU': invalid end delimiter/mods 0.00229
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_2 '/@.{1,}\.nl/iU': invalid end delimiter/mods 1.0E-5
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_3 '/@.{1,}\.net/iU': invalid end delimiter/mods 9.0E-5
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_4 '/@.{1,}\.be/iU': invalid end delimiter/mods 1.0E-5
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_5 '/@.{1,}\.de/iU': invalid end delimiter/mods 0.00012
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_6 '/@.{1,}\.eu/iU': invalid end delimiter/mods

So I changed it to /i again, no errors after that.
We'll wait and see coming week what will happen ;)

Thanks!

Re: Spamassasin rule sometimes active when it shouldn't?

Posted: 05 Feb 2021 13:55
by smyers119
e-d-i-t wrote: 05 Feb 2021 09:18 Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_1 '/@.{1,}\.com/iU': invalid end delimiter/mods 0.00229
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_2 '/@.{1,}\.nl/iU': invalid end delimiter/mods 1.0E-5
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_3 '/@.{1,}\.net/iU': invalid end delimiter/mods 9.0E-5
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_4 '/@.{1,}\.be/iU': invalid end delimiter/mods 1.0E-5
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_5 '/@.{1,}\.de/iU': invalid end delimiter/mods 0.00012
Feb 5 10:12:10.286 [81210] warn: config: invalid regexp for __LOCAL_FROM_TLD_6 '/@.{1,}\.eu/iU': invalid end delimiter/mods

So I changed it to /i again, no errors after that.
We'll wait and see coming week what will happen ;)

Thanks!
I guess it does not support the Ungreedy modifier, shouldn't change the results.