spam assasin - configuring the subject line

[pkearney]

Hi Mark,

OK that sounds like the way ahead. How hard is it for you to change from a shared VPS to a dedicated VPS? I don't want you to have to go to a lot of trouble twice. Just had a quick look at the VPS packages, and the L-VPS-01 look like what I should be going for. If it is a lot of trouble maybe I should go staright to that package?

Also noted an additional charge for whm/cpanel - is this for the initial one, or for when you want to add additional accounts that use it? Is this payable by default?

Thanks

Paul

[eUKhost.com]

Hello Paul,

VPS is like a dedicated server. You need separate cpanel license for vps and cpanel.net charges for vps licenses which we need to pay them. Moving your existing reseller account to vps would be 10 mins job for our guys as the server to server migration script of cpanel ensures 100% data transfer and all accounts are restored as it is. We will make basic web server security settings for you and wont touch any of the mail security settings. All yoour accounts will be restored as they are and you wont loose any data nor you will have any downtime.

Simply signup for the L-VPS-01 plan and mention in the message box that you wish to transfer your existing reseller account on the vps. Our VPS team will communicate with you and get everything sorted for you. You wont need to do anything besides changing IP address of your private nameservers next day. If you don't have private nameservers then you can create new nameservers or we will provide you with our nameservers. There wont be any downtime inn any case as we will use DNS forwarding concept.

[pkearney]

Hi,

OK, I've just placed the order for L-VPS-01 and mentioned I would like to transfer over everything under my current linux account.

Thanks again

Paul

[pkearney]

Hi Mark,

Haven't heard anything about the new VPS account yet - not chasing, but wanted to confrm it had got through OK (I've paid via paypal).

Regards

Paul

[eUKhost.com]

You paid through paypal's eCheque payment and the message I saw in the details of payment is "Uncleared(Expected Clearing Date: 14 Mar. 2007)"

I have asked our vps team members to proceed with setup of your vps but the reason they didn't do it was due to uncleared funds.

[pkearney]

Hi,

Is the eCheque a new thing? In the past whenever I've paid with Paypal it gets there straight away. Maybe this is there way of holding onto the money for extra days - just like a normal bank and living off the interest!!!

Thanks for asking them to set it up. I got the message this morning. However I don't know for sure if they have copied over everything from my old linux account (gragnola). When I try and log in to the CP with the root details supplied it fails, and if I try any of the previous accounts I set up they also don't work.

However I can log into the whm OK (and there is a lot more there for me to get the hang of! A few more late nights

Finally I changed the name servers for my main domain (ns1/ns2.gragnola.com) to the 2 new IP addresses of the VPS - I guess that was the right thing to do....

Thanks

Paul

[eUKhost.com]

Hello Paul,

Please communicate with our vps team and get the accounts transferred as per your requirements. There would be much to do with the DNS stuff but our VPS team is very fast and you will get reply within few minutes once you open a ticket.

I'll suggest you to communicate with them and get things done as I wont be able to do anything personally before end of business hours.

[pkearney]

Hi,

Thanks - will do.

Paul

[pkearney]

Hi Mark,

I've got my VPS setup and my account all transferred over OK now.

However under its current configuration it is still bouncing some messages. I've set it up so that it is not using the spambox, and that there is a user_prefs file setup that should retag messages with a score of 6.5 or more. I know it is using these settings as the headers of the message include the Spam Assassin details (and a score less than 6.5). So fae I haven't received any messages with a score over 6.5, therefore a retagged subject line. But there are a couple messages that haven't come through which I know about (I can forwad these messages if it helps with checking some logs somewhere to see how they were dealt with).

So can you point me in the right direction for configuring the VPS so no mail is refused?

Regards

Paul

[eUKhost.com]

Hello Paul,

First we need to know which emails got bounced as we can check logs on the vps to figure out what went wrong for those emails. Best option is to open a new ticket for our vps team and have them do settings as per your requirement. Also ask them to configure security settings for your vps as we keep high security on our shared and reseller hosting servers but each vps needs security settings to be implemented individually so its better to communicate with them and get some basic security settings done to avoid any kind of hacking / cracking attempt in future.

[pkearney]

Hi Mark,

I'm feeling like I am going around in circles......

Could you please have a look at the following ticket and tell me if you think I am making my point clear enough...

#AFG-51439-869

I know spam assasin will filter mail as per my settings. I currently have the following two lines in the user_prefs (all the other lines are commented out),

required_score 6.5
rewrite_header subject #### Spam (_HITS_) ####

However the subject line is not getting amended (although it looks like it is accepting the required_score settings as some messages are getting changed in the message body using this score).

But my real problem is the same as previously - when I just had the linux account, that some mail messages are not getting delivered at all. Now I feel I've explained this in this ticket (and the previous tickets I've had on the subject), but I am now at my wits end.

Could you please have a look at the ticket for me and let me know what else may be needed to finally get to the bottom of this.

Is there a way I could disable Spam Assassin on a particular domain to see if it is even SA that is casuing this problem?

Thanks

Paul

[Chrisp]

This is crazy that you're still having problems! I've managed to configure Spam Assasin on my shared hosting package on the vc10 server, and it's working fine (rewriting headers etc).

[pkearney]

Hi Chris,

Is it updating headers or the actual subject line? My real concern is that mail is being bounced. I've forwarded my main pop account to a pop account with my old host (Fasthosts) and to eUKhosts, unfortunately I am getting mail to the FH pop account I never see with eUKhosts. Now most of this is spam, but there are genuine messages there as well. Hopefully they'll get to the bottom of it soon...

Paul

[pkearney]

Hi Mark,

OK now I give up. I have just received another message from support that has not answered my problem. Now I want to hear from you to see if you feel the responses I have been receiving are acceptable. If they are then it is obvious that a VPS (and eUKhosts!) will not answer my problems (which is not what I was advised by you earlier in this thread).

This problem had been going on for over a month now in one thread or another. I am really happy with everything else eUKhosts has to offer but I have reached my limit with this problem.

So where do I go from here. Should I be cancelling my account and looking for a refund??? Until now I have been very impressed with the responses of support and with the flexibility of eUKhosts but I feel I am banging my head against abrick wall.

Please do respond to this as frustration doesn't do justice to how I feel now.

Regards

Paul

[Chrisp]

Originally Posted by pkearney

Is it updating headers or the actual subject line?

Yes, its updating the subject line. It identifies it as spam, and gives the spam score (above 5). eg

** SPAM Score: 15.8 ** {original message subject here}

I had an email today with a spam report attachment that I've not seen before...

************************************************** ***************
********************** SPAM REPORT MESSAGE **********************
************************************************** ***************

Datagate AntiSPAM detection software has identified this incoming
email as possible spam. The original message report has been
attached to this so you can view it (if it isn't spam) or block
similar future email. If you have any questions, please contact
Datagate PostMaster <antispam@postmaster.datagate.net.uk>.

Content preview: {edited out} [...]

Content analysis details: (7.2 points, 4.5 required)

pts rule name description
---- ---------------------- --------------------------------------------------
0.9 MSGID_FROM_MTA_ID Message-Id for external message added locally
2.4 TVD_STOCK1 BODY: Message looks like it's pushing a stock...
0.1 HTML_TAG_EXIST_TBODY BODY: HTML has "tbody" tag
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address
[80.4.83.194 listed in dnsbl.sorbs.net]
1.7 RCVD_IN_NJABL_DUL RBL: NJABL: dialup sender did non-local SMTP
[80.4.83.194 listed in combined.njabl.org]


Datagate AntiSPAM Service <antispam@postmaster.datagate.net.uk>
---------------------------------------------------------------

Does anyone know if Datagate software is running on the eukhost servers, or was this attachment added by some other mail server? Is this the software that may be bouncing some of pkearney's emails?

[pkearney]

Hi Chris,

Haven't seen the datagate messge you get, this is what I'm, getting,

=================================================
Spam detection software, running on the system "tiger.gragnola.com", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see the administrator of that system for details.

Content preview: Downloadable Software (DS) is a fast-growing company with
blah blah [...]

Content analysis details: (14.7 points, 6.5 required)

pts rule name description
---- ---------------------- --------------------------------------------------
0.0 HTML_MESSAGE BODY: HTML included in message
0.5 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <http://www.spamcop.net/bl.shtml?83.15.102.162>]
1.1 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: buratinopedorino.eu]
3.3 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
[URIs: buratinopedorino.eu]
3.4 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URIs: buratinopedorino.eu]
1.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
[URIs: buratinopedorino.eu]
3.6 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
[URIs: buratinopedorino.eu]

The original message was not completely plain text, and may be unsafe to open with some email clients; in particular, it may contain a virus, or confirm that your address can receive spam. If you wish to view it, it may be safer to save it to a file and open it with an editor.

================================================== ==

Out if interest Chris, does your main mail account come straight into eUKhosts or are your forwarding from outside somewhere. Curious to see if anyone else experiences the bouncing of mail. I'm not convinced it is Spam Assassin - I feel there is some other filter somewhere (exim??) that works from another set of rules.

Thanks for taking the time to respons

I really hope we can get to the bottom of this as it is a pain having to trawl the internet looking for another host.

Paul

[Chrisp]

For me, mail that is detected as spam by spam assassin comes through with modified subject line like:

** SPAM Score: 15.8 ** {original message subject here}

The message part of the email looks like the following, and the original email is as an attachment (I set up Spam Assassin to do this)

Spam detection software, running on the system "vc10.eukhost.com", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see the administrator of that system for details.

Content preview: Cute blonde in nylon posing blah blah [...]

Content analysis details: (32.0 points, 5.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
1.7 SARE_ADLTSUB2 Contains possible adult words
2.2 SUBJECT_***UAL Subject indicates ***ually-explicit content
3.4 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr
1)
3.2 RCVD_HELO_IP_MISMATCH Received: HELO and IP do not match, but should
1.3 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
0.9 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers
1.0 SARE_ADULT2 BODY: Contains adult material
0.8 INFO_TLD URI: Contains an URL in the INFO top-level domain
0.5 RAZOR2_CHECK Listed in Razor2 (http:// razor.sf.net)
0.5 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org
0.9 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org
3.1 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[82.81.110.53 listed in sbl-xbl.spamhaus.org]
2.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address
[82.81.110.53 listed in dnsbl.sorbs.net]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <www. spamcop.net/bl.shtml?82.81.110.53>]
1.4 DNS_FROM_RFC_POST RBL: Envelope sender in postmaster.rfc-ignorant.org
1.7 RCVD_IN_NJABL_DUL RBL: NJABL: dialup sender did non-local SMTP
[82.81.110.53 listed in combined.njabl.org]
4.5 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: voiceknewatthere.info]
1.7 FM_PORN_A_4 FM_PORN_A_4

Yes, my main mail account comes directly into my eukhost hosted pop3 account.

I'm not sure how to investigate if mail is being bounced - let me know how you're doing it, and i'll give it a go - as I, like you do want to receive every email i get sent (spam or otherwise!)

[pkearney]

Hi Chris,

Do you want to drop me a line direct - paul@scruffycat.com.

Paul

[pkearney]

Hi,

Mark (or anyone else from eUKhosts!), can you please respond to this message. I have now monitored this for a day (with the help of another eUKhosts customer) and I have proved that mail is getting bounced from my VPS server that is delivered to another eUKhosts server. Can you please contact me so that I can send you an excel spreadsheet with all the details.

Regards

Paul

[eUKhost.com]

Hello Paul,

Please open a ticket for our vps support team from http://support.eukhost.com and attach the excel sheet with the ticket. They will sort this problem.

Other support staff has no access to vps nodes so they wont be able to do much. VPS issues are sorted by VPS team only.