Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:97538
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.218.47 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <de1057d3-a342-7cf0-6350-e24748bf37cb@gmx.de>
References: <11.E3.04761.2199D585@pb1.pair.com> <D9.F3.04761.F0A9D585@pb1.pair.com>
 <ab6205f1-2b8d-0e4e-9430-37ad390878fa@gmx.de> <de1057d3-a342-7cf0-6350-e24748bf37cb@gmx.de>
Date: Fri, 6 Jan 2017 19:34:47 +0100
Message-ID: <CAH-PCH6Nvm6HTCTjXBQATf-NsjTLwswJf4=hvTprsXaHmx7NYg@mail.gmail.com>
To: "Christoph M. Becker" <cmbecker69@gmx.de>
Cc: Andrea Faulds <ajf@ajf.me>, PHP Internals <internals@lists.php.net>, PHP Systems <systems@php.net>
Content-Type: multipart/alternative; boundary=001a1143ec80c6cf1f054571459b
Subject: Re: Spam protection: false positives
From: tyra3l@gmail.com (Ferenc Kovacs)

--001a1143ec80c6cf1f054571459b
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Fri, Jan 6, 2017 at 6:39 PM, Christoph M. Becker <cmbecker69@gmx.de>
wrote:

> On 23.12.2016 at 23:48, Christoph M. Becker wrote:
>
> > On 23.12.2016 at 22:41, Andrea Faulds wrote:
> >
> >> Andrea Faulds wrote:
> >>
> >>> Is my website in my signature illegal? SURBL doesn't blacklist it, ye=
t
> >>> the news server rejected a previous email containing it and one other
> >>> domain.
> >>>
> >>> If this email gets through, the answer is "no".
> >>
> >> Is mentioning the wiki in an email body illegal? SURBL doesn't blackli=
st
> >> it, yet the news server rejected a previous email containing it along
> >> with my domain.
> >>
> >> I tried sending a follow-up test email with
> >>
> >> https colon slash slash wiki dot php dot net slash rfc slash
> >> on_demand_name_mangling
> >>
> >> It did not get through.
> >>
> >> So, wiki dot php dot net is the issue, I guess.
> >
> > I'm afraid that all of php dot net is rejected currently. :-(
>
> Apparently, this issue has been solved.  Testing: <https://wiki.php.net/>=
.
>
> --
> Christoph M. Becker
>

I've restarted ecelerity on lists.php.net after I wasn't able to send out
the 5.6.30RC1 announcement emails.
I'm not sure if that was the direct cause of the resolution or just a
coincidence.
I've looked into my emails and they were rejected by ecelerity with
sbl_hits=3D1, I've looked into our ecelerity config and here is the relevan=
t
part:

Validate validate/omniti_tools url_ripper {
  base=3D"sbl-xbl.spamhaus.org"
  max_lookups =3D 100
  forward =3D true
  bits [
    0.0.0.2 =3D "sbl_hits"
    0.0.0.4 =3D "xbl_hits"
  ]
  address_headers =3D "Errors-To:From:Reply-To:Return-Path:Sender"
}


  if anyof(
    vctx :contains "sbl_hits" "",
    vctx :contains "xbl_hits" ""
#    vctx :contains "sc_surbl_hits" "",
#    vctx :contains "ws_surbl_hits" "",
#    vctx :contains "ph_surbl_hits" "",
#    vctx :contains "ob_surbl_hits" "",
#    vctx :contains "ab_surbl_hits" "",
#    vctx :contains "jp_surbl_hits" ""
) {

    if vctx_conn :is "p_esmtp" "true" {
      ec_tarpit 40 "spam tarpit";
    }
  ec_action 550 text:
5.7.1 mail rejected by policy.  SURBL hit
Spammy URLs in your message
See http://master.php.net/mail/why.php?why=3DSURBL
.
  "spam:Spammy URLs in message";
  stop;
  }

unfortunatelly the validate/omniti_tools is a shared object which has an
exposed url_ripper function, but there is no available sourcecode or even
documentation what I could find, so I have no idea what does that exactly
do (I'm assuming it uses the sbl-xbl.spamhaus.org dns interface, but I
don't know how exactly it fetches the links from the message), and couldn't
find any of the domains mentioned in my email body on (php.net and
github.com) on the blacklist.

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--001a1143ec80c6cf1f054571459b--