MISSING_SUBJECT rule on email with subject
Hi, We're currently seeing the rule MISSING_SUBJECT sporadically hitting on emails that have a subject. This issue seems to have started during last week, which is when clients started complaining about false positive detections. Please see example headers at the following link: https://pastebin.com/raw/GtnV67Hj Has anyone seen the same or similar issue recently? If not, can anyone offer some advice or guidance? Thanks! Stephan
Re: MISSING_SUBJECT rule on email with subject
Hi, My apologies, seems something went wrong with the formatting when it was pasted to the pastebin. Here's a new example with spacing intact: https://pastebin.com/raw/tQtSMQPs In this example some of the other headers were also not 'seen'. Thanks! Stephan On 2019/06/04 10:55, Matus UHLAR - fantomas wrote: On 3 Jun 2019, at 2:20, Stephan Fourie wrote: > We're currently seeing the rule MISSING_SUBJECT sporadically > hitting on emails that have a subject. This issue seems to have > started during last week, which is when clients started complaining > about false positive detections. Please see example headers at the > following link: > > https://pastebin.com/raw/GtnV67Hj On Mon, 03 Jun 2019 11:43:44 -0400 Bill Cole wrote: The headers are all missing the traditional space between the colon and the header content. On 03.06.19 19:11, RW wrote: And this include google headers, so presumably the spaces have been stripped locally. now one question is, if the spaces have been stripped prior to spam checking, another is, if SA does/should expect whitespaces after header fields. if the first answer is true, then SA can't do much about misformatted e-mail. But since FROM_AND_TO_IS_SAME_DOMAIN was hit, I don't think the spaces were stripped, so - we need to see the original message as it was scanned. Anything else, reformated by anyone (e.g. outlook or exchange use to reformat mail), can't help us much finding the issue.
Re: MISSING_SUBJECT rule on email with subject
Hi Charles, My apologies, I forgot to provide feedback to the mailing list. Bad regex was the cause of this problem for us, too. As soon as the custom rule was fixed, the problem went away. Kind Regards, Stephan On 2019/06/24 15:58, Charles Amstutz wrote: But as has already been pointed out it has the combination of MISSING_FROM and HK_RANDOM_FROM, and the latter is based on a From:addr test. I saw this too, however, I thought I noticed a potentially bad regex (from another custom rule) breaking mine. I think this is the case as when I removed the rule, it stopped the missing_subject stopped hitting. However, I'm still testing.
Re: MISSING_SUBJECT rule on email with subject
Hi Charles, Yes, it was an incorrectly escaped forward slash in a subject rule. On 2019/06/24 16:12, Charles Amstutz wrote: Hi Charles, My apologies, I forgot to provide feedback to the mailing list. Bad regex was the cause of this problem for us, too. As soon as the custom rule was fixed, the problem went away. If I can ask, was it an incorrectly escaped special character? I think it is the @ symbol breaking mine.
sa-update failing
Hi everyone, Our SpamAssassin rules have not gotten any recent updates (looks like past 2 days). When investigating, sa-update tries to connect to: 2.4.3.updates.spamassassin.org When doing a DNS lookup on this hostname it appears to be a CNAME which points to: 3.3.3.updates.spamassassin.org. When doing a lookup for 3.3.3.updates.spamassassin.org it doesn't resolve, which I'm leaning towards being the issue. Please see below lookup results: - ;; QUESTION SECTION: ;3.3.3.updates.spamassassin.org. IN A ;; AUTHORITY SECTION: spamassassin.org. 1799 IN SOA ns2.pccc.com. pmc.spamassassin.apache.org. 2020062505 7200 3600 604800 3600 ;; Query time: 265 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Fri Jun 26 10:10:28 SAST 2020 ;; MSG SIZE rcvd: 131 - Anyone else seeing the same issue? Thanks! Stephan
