People need to read the razor info to understand how it works. It surprises me that so many people are putting software on their systems without know what it truly is doing. Razor is using Ephemeral signature hashe (Nilsimsa I think is still disabled). These are fuzzy checksums so that if I have a message that has something like 95% of the exact same content as another message with maybe the only difference being maybe different email addresses listed in the message body, then both can have the same signature. Otherwise what's the point. Spammers send the same message to everyone but can add random characters or email addresses, etc to the message body to try and fool antispam software that is based on an exact hash signature of the message.
So you problem is that this message may have person content but it a canned message that this company sends to all there customers and one of those customers has reported it to razor. So when anyone else gets it and they use razor2, it's reported as Spam regardless if their name, email, domain is in the message. The problem that started this whole thread is most likely some attachment that the message received that is razored. If I use HTML formatting and have a a background embedded in the message and that message is reported to razor, then if I send another message using the same background, razor will return a positive because it finds the same hash for one of the attachments. I think if you change your use_engines option in razor-agent.conf and remove 2 then it won't check the signatures of mime attachments. Granted I think doing this might cause spam to get thru because it's possible to send a message that contains an empty message body but an html attachment which a email client would open on receipt. Now this is only a guess as to the previous problem since we haven't seen anything about the message from that particular person. Looking at the header for all the mime attachments and looking for the same one would help with that determination. -----Original Message----- From: J�rgen Thomsen [mailto:[EMAIL PROTECTED]] Sent: Thursday, December 19, 2002 9:14 AM To: Razor Users Mailing List Subject: Re: [Razor-users] Private mail being classified as spam How does this qualify as spam ? Dec 19 14:05:11.440077 check[27789]: [ 2] Razor-Agents v2.20 starting razor-check Dec 19 14:05:12.314313 check[27789]: [ 3] mail 1 is known spam. It has personalized contents and has not been sent to anybody else. - J�rgen Return-Path: <[EMAIL PROTECTED]> Delivered-To: [EMAIL PROTECTED] Received: from oops.dollardomainname.com (unknown [64.69.90.250]) by mail.jth.net (Postfix) with ESMTP id 9D23B186A4 for <[EMAIL PROTECTED]>; Thu, 19 Dec 2002 14:05:09 +0100 (CET) Received: (from root@localhost) by oops.dollardomainname.com (8.11.3/8.11.3) id gBJD58M72929; Thu, 19 Dec 2002 05:05:08 -0800 (PST) Date: Thu, 19 Dec 2002 05:05:08 -0800 (PST) Message-Id: <[EMAIL PROTECTED]> From: DDN Support <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: Your domain is about to expire - nordisk-maskinsalg.com Dear XXXXX YYYYYY, Please be advised that your domain name: CCCCCCCCCC.com will be expiring in 15 days on 2003-01-03. Since you first registered your domain with us, we have kept our commitment to provide you with the same low price of only $15 per year. In addition, we now offer 2, 5 and 10 year renewals so that you can take advantage of our great price and lock in your domain for long term. To renew your domain, please go to: https://www.DollarDomainName.com/RenewNow/?d=CCCCCCCC.com&s=10S4BChlvUC2. or login to the Domain Admin Panel and click on "Renew Domains". We can also accept renewals by fax to (604)606-7886 (please indicate your domain, renewal term, credit card information and signature). Note that it may take up to 72 hours to process renewals, therefore, please act now. Sincerely, DollarDomainName.com The Best Value in Domain Registration Web: http://www.DollarDomainName.com Email: [EMAIL PROTECTED] ------------------------------------------------------- This SF.NET email is sponsored by: Geek Gift Procrastinating? Get the perfect geek gift now! Before the Holidays pass you by. T H I N K G E E K . C O M http://www.thinkgeek.com/sf/ _______________________________________________ Razor-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/razor-users ------------------------------------------------------- This SF.NET email is sponsored by: Geek Gift Procrastinating? Get the perfect geek gift now! Before the Holidays pass you by. T H I N K G E E K . C O M http://www.thinkgeek.com/sf/ _______________________________________________ Razor-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/razor-users
