On Jan 7, 2006, at 8:22 PM, Marta Edie wrote:
> And here comes my question on junk mail again : In the mail
> preferences under junk mail where it lets you check a box to trust
> the filters set by your ISP , does this mean that if you click in
> that box, that it overrides your own junk filtering settings or do
> they go hand in hand , and what does Insight filter out, ( my
> provider) or how good is it in filtering ? If anybody has an
> inkling, please let me know. ( I am using Apple's mail, but it
> still comes through Insight, except my .mac webmail, I suppose when
> I am not at home.
Some ISPs have a service where they scan your mail as they see it for
viruses. If the scanner thinks a message is infected, it will add a
field to the header of the message saying that it might be spam.
Since you rarely look at the headers of a message, this is a fairly
invisible place to put it. Apple's mail program knows to look for
these types of header entries, and it can automatically route
messages marked as spam into your junk mailbox.
For example, I run a free open source spam program called
SpamAssassin on erdos. Almost all my spam gets caught before it's
downloaded. It marks the headers on spam as follows.
X-Spam-Prev-Subject: Amazing, Martin
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on
erdos.math.louisville.edu
X-Spam-Level: *************************************
X-Spam-Status: Yes, score=37.8 required=4.0 tests=BAYES_99,
DNS_FROM_RFC_BOGUSMX,DNS_FROM_RFC_POST,DRUGS_ERECTILE,
HELO_DYNAMIC_IPADDR,HTML_MESSAGE,PYZOR_CHECK,RCVD_IN_BL_SPAMCOP_NET,
RCVD_IN_DSBL,RCVD_IN_NJABL_DUL,RCVD_IN_SORBS_DUL,RCVD_IN_XBL,
URIBL_AB_SURBL,URIBL_JP_SURBL,URIBL_OB_SURBL,URIBL_SC_SURBL,
URIBL_WS_SURBL autolearn=spam version=3.0.4
X-Spam-Report:
* 4.4 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname
(IP addr 1)
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 3.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.0000]
* 3.5 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
* 3.1 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
* [24.8.156.123 listed in sbl-xbl.spamhaus.org]
* 2.6 DNS_FROM_RFC_BOGUSMX RBL: Envelope sender in bogusmx.rfc-
ignorant.org
* 2.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP
address
* [24.8.156.123 listed in dnsbl.sorbs.net]
* 3.8 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org
* [<http://dsbl.org/listing?24.8.156.123>]
* 1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
bl.spamcop.net
* [Blocked - see <http://www.spamcop.net/bl.shtml?24.8.156.123>]
* 1.6 DNS_FROM_RFC_POST RBL: Envelope sender in postmaster.rfc-
ignorant.org
* 0.1 RCVD_IN_NJABL_DUL RBL: NJABL: dialup sender did non-local SMTP
* [24.8.156.123 listed in combined.njabl.org]
* 0.4 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
* [URIs: rootdudealltime.info]
* 2.5 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
* [URIs: rootdudealltime.info]
* 1.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
* [URIs: rootdudealltime.info]
* 3.2 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
* [URIs: rootdudealltime.info]
* 4.3 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
* [URIs: rootdudealltime.info]
* 0.2 DRUGS_ERECTILE Refers to an erectile drug
The headers give the verdict and why it's likely spam. If the header
X-Spam-Flag: YES appears, the mail is magically shunted off to the
junk box. SpamAssassin is very effective. It catches 99% or more of
my spam, and I get a lot of spam.
I believe Insight sells a service similar to this for $30/year.
| The next meeting of the Louisville Computer Society will
| be January 24 at Pitt Academy, 6010 Preston Highway.
| The LCS Web page is <http://www.kymac.org>.
| List posting address: <mailto:macgroup at erdos.math.louisville.edu>
| List Web page: <http://erdos.math.louisville.edu/macgroup>
