Backscatter not working

lieckfeldt · 12 Jun 2006, 11:17 PM

Hello

since 2pm today we're inundated with backscatter emails which do not get caught by the Spam option. I have set it to sort all backscatter into the junk mail folder, but they simply remain in the Inbox. Any ideas on where I'm going wrong?

Norbert

Mal · 12 Jun 2006, 11:49 PM

If you look at the full header of an example incoming backscatter message, does it contain the "X-Backscatter: Yes" tag?

lieckfeldt · 12 Jun 2006, 11:52 PM

Quote:

Originally posted by Mal
If you look at the full header of an example incoming backscatter message, does it contain the "X-Backscatter: Yes" tag?

No, the headers read

Return-Path: <SMS@xxyyzz.com>
Received: from mx4.internal (mx4.internal [10.202.2.203])
by server3.messagingengine.com (Cyrus v2.3.6) with LMTPA;
Mon, 12 Jun 2006 10:01:27 -0400
X-Sieve: CMU Sieve 2.3
X-Spam-score: 1.6
X-Spam-hits: BAYES_50, FORGED_RCVD_HELO, MSGID_FROM_MTA_ID, NO_REAL_NAME,
SUBJECT_EXCESS_BASE64
X-Resolved-to: bsa@fastmail.fm
X-Delivered-to: AlanovdHester@aabbcc.org
X-Mail-from: SMS@xxyyzz.com
Received: from smtp-antispam.venoco_gua.com (mail.venoco.com [200.11.202.58])
by mx4.messagingengine.com (Postfix) with SMTP id 35A7D90390
for <AlanovdHester@aabbcc.org>; Mon, 12 Jun 2006 10:01:26 -0400 (EDT)
From: SMS@xxyyzz.com
To: AlanovdHester@aabbcc.org
Date: Mon, 12 Jun 2006 10:05:16 -0400
Subject: =?utf-8?B?UG9saWN5IFZpb2xhdGlvbm==?=
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Message-Id: <20060612140126.35A7D90390@mx4.messagingengine.com> Text view
Print view

Hide full header
The following message sent by this account has violated system policy:

From: AlanovdHester@saabbcc.org
To: claguado@xxyyzz.com
Date: Mon, 12 Jun 2006 10:04:16 -0400
Subject: indiscretion arachnid cartographer?

The following violations were detected:

Mal · 13 Jun 2006, 12:03 AM

Using your Settings, Spam/Virus Protection, Backscatter action drop-down, set the Action to Nothing then click Save.

Now go in again and set it back to the current option, clicking Save once more.

Toggling the switch makes sure your requirement to have the X-Backscatter tag included in the header is acknowledged by the server.

If you receive further problem mails which still don't have the tag, then that part of the recently-introduced scanning code has gone off-line for reasons unknown.

Alternatively, the messages which are bouncing to you were sent via an FM server or via a server whose hostname appears on your Whitelist. That would also stop the tag being added.

elvey · 13 Jun 2006, 01:00 AM

Perhaps the backscatter feature only works on properly formatted bounce messages. This one doesn't have a null from address. We'll have to see what the staff says, I think. IIRC, they haven't provided any technical details on how the backscatter feature works.

Of course, fastmail is completely down, so it may be a while...

lieckfeldt · 13 Jun 2006, 01:03 AM

Quote:

Originally posted by elvey
Perhaps the backscatter feature only works on properly formatted bounce messages. This one doesn't have a null from address. We'll have to see what the staff says, I think. IIRC, they haven't provided any technical details on how the backscatter feature works.(

Well, I followed the advice and two emails were correctly identified, including the header. Another five weren't and did not contain the header in question.

Norbert

Mal · 13 Jun 2006, 06:48 PM

Rob gives some clues how the (current) code works in this post.

I've got a representative clutch of real backscatter rejection messages, and yes, they all have X-Mail-from: as a null header.

robmueller · 20 Jun 2006, 11:32 AM

Currently we look at the MAIL FROM envelope and match it against this regexp.

$MailFrom !~ /^$|^postmaster\@|^MAILER-DAEMON\@|^root\@|^postoffice\@|^null\@|^autoresponse-bounce\@/i;

I'm always expanding the regexp + the code that looks for the "original headers" in the email. You can forward copies of uncaught emails to robm+backscatter@fastmail.fm (use the Attach Orig option in the web interface). I'll look at them.

Rob

robmueller · 20 Jun 2006, 11:34 AM

Quote:

Originally posted by elvey
Perhaps the backscatter feature only works on properly formatted bounce messages. This one doesn't have a null from address. We'll have to see what the staff says, I think. IIRC, they haven't provided any technical details on how the backscatter feature works.

http://www.fastmail.fm/docs/faqparts...unkBackscatter

Ok, it doesn't go into all the nitty gritty details, but it explains the basic principle of what it does.

Rob

12 Jun 2006, 11:17 PM	#1
lieckfeldt Member Join Date: Feb 2006 Posts: 66	Backscatter not working Hello since 2pm today we're inundated with backscatter emails which do not get caught by the Spam option. I have set it to sort all backscatter into the junk mail folder, but they simply remain in the Inbox. Any ideas on where I'm going wrong? Norbert

13 Jun 2006, 12:03 AM	#4
Mal Senior Member Join Date: May 2002 Location: Wanstead, England Posts: 170	Using your Settings, Spam/Virus Protection, Backscatter action drop-down, set the Action to Nothing then click Save. Now go in again and set it back to the current option, clicking Save once more. Toggling the switch makes sure your requirement to have the X-Backscatter tag included in the header is acknowledged by the server. If you receive further problem mails which still don't have the tag, then that part of the recently-introduced scanning code has gone off-line for reasons unknown. Alternatively, the messages which are bouncing to you were sent via an FM server or via a server whose hostname appears on your Whitelist. That would also stop the tag being added. Last edited by Mal : 13 Jun 2006 at 12:13 AM.

12 Jun 2006, 11:49 PM	#2
Mal Senior Member Join Date: May 2002 Location: Wanstead, England Posts: 170	If you look at the full header of an example incoming backscatter message, does it contain the "X-Backscatter: Yes" tag?

13 Jun 2006, 01:00 AM	#5
elvey The "e" in e-mail Join Date: Jan 2002 Location: San Francisco Posts: 2,458	Perhaps the backscatter feature only works on properly formatted bounce messages. This one doesn't have a null from address. We'll have to see what the staff says, I think. IIRC, they haven't provided any technical details on how the backscatter feature works. Of course, fastmail is completely down, so it may be a while...

13 Jun 2006, 06:48 PM	#7
Mal Senior Member Join Date: May 2002 Location: Wanstead, England Posts: 170	Rob gives some clues how the (current) code works in this post. I've got a representative clutch of real backscatter rejection messages, and yes, they all have X-Mail-from: as a null header.

20 Jun 2006, 11:32 AM	#8
robmueller Intergalactic Postmaster Join Date: Oct 2001 Location: Melbourne, Australia Posts: 6,102 Representative of: Fastmail.FM	Currently we look at the MAIL FROM envelope and match it against this regexp. $MailFrom !~ /^$\|^postmaster\@\|^MAILER-DAEMON\@\|^root\@\|^postoffice\@\|^null\@\|^autoresponse-bounce\@/i; I'm always expanding the regexp + the code that looks for the "original headers" in the email. You can forward copies of uncaught emails to robm+backscatter@fastmail.fm (use the Attach Orig option in the web interface). I'll look at them. Rob