>I'm still seeing scenarios where analyze shows a DKIM NP match, but the
message is still going to spam based on score from HMM.
The best solution is to correct the corpus, to get better HMM results. You
may also decrease the scoring points for HMM and/or Bayesian. If the
corpus is corrected and the corpusnorm is ~ 1.0 , 'baysConf' will increase
detection correctness.
If assp receives a mail it acts as a statemachine. If and how a check is
done, depends on the previouse reached states.
Using the analyzer, assp acts procedural. Every check is done without any
state dependency. This is done, to be able to show every feature match.
The analyzer uses the current configuration, hashes, lists and databases.
So it may be normal to get different results compared to the real mail
processing loggings, if a mail is analyzed.
>DKIM NP match:
The analyzer checks DKIM without any dependency and shows all results.
But, if a mail is received, the DKIM check depends on several previouse
states
DKIM NP is a resulting state of the DKIM check. So - if any of the
previouse (DKIM depdency) states prevents the DKIM check, there will be no
DKIM (DKIM NP) result. The mail will be processed the same way, as it was
not DKIM signed.
Every state, that depends on DKIM NP will not be reached.
You should also remember, that assp use two DKIM checks. The full DKIM
check, which requires the full mail to be received - the results of this
check affects only the Plugin Level 2 (full mail) checks.
And the DKIM-Pre-Check - which is done after the MIME header is received
and if 'DKIMCacheInterval' is enabled. The results (states) of this check
affects most of the header checks and all body and full mail checks.
If you expect but miss a match for 'DKIMWLAddresses' or 'DKIMNPAddresses'
, you may increase the logging level (ValidateSenderLog, SessionLog,
ipmatchLogging, slmatchLogging).
Thomas
Von: "K Post" <nntp.p...@gmail.com>
An: "ASSP development mailing list" <assp-test@lists.sourceforge.net>
Datum: 15.04.2018 23:21
Betreff: Re: [Assp-test] Analyze shows DKIMNPAddress match as
expected, but some messages still processed as spam?
I'm still seeing scenarios where analyze shows a DKIM NP match, but the
message is still going to spam based on score from HMM.
On Mon, Apr 9, 2018 at 12:19 PM, K Post <nntp.p...@gmail.com> wrote:
cheers.
On Mon, Apr 9, 2018 at 3:36 AM, Thomas Eckardt <thomas.ecka...@thockar.com
> wrote:
If assp has modified the original mail header (changed foreign X-ASSP- or
removed cc,bcc or ...) the DKIM check is skipped and also DKIMNPAddress
and DKIMWLAddress.
The next version will try to check, if removed or changed headers are
protected by a DKIM signature and do the check, if this is not the case.
Thomas
DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally
privileged and protected in law and are intended solely for the use of the
individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no
known virus in this email!
*******************************************************
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
DISCLAIMER:
*******************************************************
This email and any files transmitted with it may be confidential, legally
privileged and protected in law and are intended solely for the use of the
individual to whom it is addressed.
This email was multiple times scanned for viruses. There should be no
known virus in this email!
*******************************************************
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
