Re: [mailop] United Internet X-UI-*Filterresults headers?

[Arne Allisat via mailop]

Am 17.09.2020 um 23:46 schrieb Ángel via mailop 
mailto:mailop@mailop.org>>:

On 2020-09-17 at 11:27 +0200, Thomas Walter wrote:
According to the UI headers, GMX thinks these are Schroedingers Spam
-
they are not, but they are?

[...]
X-Spam-Flag: NO
X-UI-Filterresults:
notjunk:1;V03:K0:Vf6iW93DjHQ=:AGDIE9XztBOZ9NwiPnKi2ALoF0
[...]
X-Spam-Flag: YES
X-UI-Out-Filterresults:
junk:10;V03:K0:v3J1PWV5W7c=:sJZq98Urm/hQlOiYxtZTdsBj
[...]

Does anyone know the difference between the X-UI-Filterresults and
the X-UI-Out-Filterresults?

Well, it seems it is only spam when sent by GMX :-)


Thankfully Thomas provide me the full headers, so I was able to analyze this.
Unfortunately a FP in both direction, In and out. But other systems only 
available inbound „rescued“ the inbound decision a filter made.


I also was asked If I can provide more info about this.

As you might already imagine, I won’t give much details about our detection 
systems.
But like in this example case it can come to a different decision In and 
Outbound, since there are different detection systems involved.

Should you rely on the X-UI-Out-Filterresults in your filtering?

Well. Aside from some rare false positives that may happen, yes you can IMHO.
A mail with an outbound junk decision is routed through our „x-forward“ 
outbound mailers and we public mark them as „mail servers with poor reputation 
score“ (See: https://postmaster.gmx.com/en/email-server).

Best regards
Arne







___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] United Internet X-UI-*Filterresults headers?

[Ángel via mailop]

On 2020-09-17 at 11:27 +0200, Thomas Walter wrote:
> According to the UI headers, GMX thinks these are Schroedingers Spam
> -
> they are not, but they are?
> 
> [...]
> X-Spam-Flag: NO
> X-UI-Filterresults:
> notjunk:1;V03:K0:Vf6iW93DjHQ=:AGDIE9XztBOZ9NwiPnKi2ALoF0
> [...]
> X-Spam-Flag: YES
> X-UI-Out-Filterresults:
> junk:10;V03:K0:v3J1PWV5W7c=:sJZq98Urm/hQlOiYxtZTdsBj
> [...]
> 
> Does anyone know the difference between the X-UI-Filterresults and
> the X-UI-Out-Filterresults?

Well, it seems it is only spam when sent by GMX :-)


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] United Internet X-UI-*Filterresults headers?

[Arne Allisat via mailop]

Hi,

X-UI-Filterresults

Mail coming in

X-UI-Out-Filterresults

Mail going out. Forwards for example.

Best regards
Arne





Arne Allisat
Head of Mail Application Security
Product Management Applications
1&1 Mail & Media GmbH | Brauerstraße 48 | 76135 Karlsruhe | Germany
E-Mail: arne.alli...@1und1.de | Web: 
www.1und1.de


Am 17.09.2020 um 11:27 schrieb Thomas Walter via mailop 
mailto:mailop@mailop.org>>:

Hello wonderful people,

one of our clients is forwarding E-Mails from 
geocaching.com that are
sent to GMX to his personal mailbox with us.

Some of them are being rejected as SPAM, main reason being that our
rspamd feels if United Internet thinks it SPAM, we should do so too.

According to the UI headers, GMX thinks these are Schroedingers Spam -
they are not, but they are?

[...]
X-Spam-Flag: NO
X-UI-Filterresults: notjunk:1;V03:K0:Vf6iW93DjHQ=:AGDIE9XztBOZ9NwiPnKi2ALoF0
[...]
X-Spam-Flag: YES
X-UI-Out-Filterresults: junk:10;V03:K0:v3J1PWV5W7c=:sJZq98Urm/hQlOiYxtZTdsBj
[...]

Does anyone know the difference between the X-UI-Filterresults and the
X-UI-Out-Filterresults?

Regards from Germany,
Thomas Walter

--
Thomas Walter
Datenverarbeitungszentrale

FH Münster
- University of Applied Sciences -
Corrensstr. 25, Raum B 112
48149 Münster

Tel: +49 251 83 64 908
Fax: +49 251 83 64 910
www.fh-muenster.de/dvz/

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

[mailop] United Internet X-UI-*Filterresults headers?

[Thomas Walter via mailop]

Hello wonderful people,

one of our clients is forwarding E-Mails from geocaching.com that are
sent to GMX to his personal mailbox with us.

Some of them are being rejected as SPAM, main reason being that our
rspamd feels if United Internet thinks it SPAM, we should do so too.

According to the UI headers, GMX thinks these are Schroedingers Spam -
they are not, but they are?

[...]
X-Spam-Flag: NO
X-UI-Filterresults: notjunk:1;V03:K0:Vf6iW93DjHQ=:AGDIE9XztBOZ9NwiPnKi2ALoF0
[...]
X-Spam-Flag: YES
X-UI-Out-Filterresults: junk:10;V03:K0:v3J1PWV5W7c=:sJZq98Urm/hQlOiYxtZTdsBj
[...]

Does anyone know the difference between the X-UI-Filterresults and the
X-UI-Out-Filterresults?

Regards from Germany,
Thomas Walter

-- 
Thomas Walter
Datenverarbeitungszentrale

FH Münster
- University of Applied Sciences -
Corrensstr. 25, Raum B 112
48149 Münster

Tel: +49 251 83 64 908
Fax: +49 251 83 64 910
www.fh-muenster.de/dvz/

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop