Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:97539
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.218.41 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAH-PCH6Nvm6HTCTjXBQATf-NsjTLwswJf4=hvTprsXaHmx7NYg@mail.gmail.com>
References: <11.E3.04761.2199D585@pb1.pair.com> <D9.F3.04761.F0A9D585@pb1.pair.com>
 <ab6205f1-2b8d-0e4e-9430-37ad390878fa@gmx.de> <de1057d3-a342-7cf0-6350-e24748bf37cb@gmx.de>
 <CAH-PCH6Nvm6HTCTjXBQATf-NsjTLwswJf4=hvTprsXaHmx7NYg@mail.gmail.com>
Date: Fri, 6 Jan 2017 19:50:58 +0100
Message-ID: <CAH-PCH7SeCGAyiCyXPrB5nJxOV0bS3ZVtuR-OsK-GBeECg-0=w@mail.gmail.com>
To: "Christoph M. Becker" <cmbecker69@gmx.de>
Cc: Andrea Faulds <ajf@ajf.me>, PHP Internals <internals@lists.php.net>, PHP Systems <systems@php.net>
Content-Type: multipart/alternative; boundary=001a1130c122a867e50545717fff
Subject: Re: Spam protection: false positives
From: tyra3l@gmail.com (Ferenc Kovacs)

--001a1130c122a867e50545717fff
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Fri, Jan 6, 2017 at 7:34 PM, Ferenc Kovacs <tyra3l@gmail.com> wrote:

>
>
> On Fri, Jan 6, 2017 at 6:39 PM, Christoph M. Becker <cmbecker69@gmx.de>
> wrote:
>
>> On 23.12.2016 at 23:48, Christoph M. Becker wrote:
>>
>> > On 23.12.2016 at 22:41, Andrea Faulds wrote:
>> >
>> >> Andrea Faulds wrote:
>> >>
>> >>> Is my website in my signature illegal? SURBL doesn't blacklist it, y=
et
>> >>> the news server rejected a previous email containing it and one othe=
r
>> >>> domain.
>> >>>
>> >>> If this email gets through, the answer is "no".
>> >>
>> >> Is mentioning the wiki in an email body illegal? SURBL doesn't
>> blacklist
>> >> it, yet the news server rejected a previous email containing it along
>> >> with my domain.
>> >>
>> >> I tried sending a follow-up test email with
>> >>
>> >> https colon slash slash wiki dot php dot net slash rfc slash
>> >> on_demand_name_mangling
>> >>
>> >> It did not get through.
>> >>
>> >> So, wiki dot php dot net is the issue, I guess.
>> >
>> > I'm afraid that all of php dot net is rejected currently. :-(
>>
>> Apparently, this issue has been solved.  Testing: <https://wiki.php.net/
>> >.
>>
>> --
>> Christoph M. Becker
>>
>
> I've restarted ecelerity on lists.php.net after I wasn't able to send out
> the 5.6.30RC1 announcement emails.
> I'm not sure if that was the direct cause of the resolution or just a
> coincidence.
> I've looked into my emails and they were rejected by ecelerity with
> sbl_hits=3D1, I've looked into our ecelerity config and here is the relev=
ant
> part:
>
> Validate validate/omniti_tools url_ripper {
>   base=3D"sbl-xbl.spamhaus.org"
>   max_lookups =3D 100
>   forward =3D true
>   bits [
>     0.0.0.2 =3D "sbl_hits"
>     0.0.0.4 =3D "xbl_hits"
>   ]
>   address_headers =3D "Errors-To:From:Reply-To:Return-Path:Sender"
> }
>
>
>   if anyof(
>     vctx :contains "sbl_hits" "",
>     vctx :contains "xbl_hits" ""
> #    vctx :contains "sc_surbl_hits" "",
> #    vctx :contains "ws_surbl_hits" "",
> #    vctx :contains "ph_surbl_hits" "",
> #    vctx :contains "ob_surbl_hits" "",
> #    vctx :contains "ab_surbl_hits" "",
> #    vctx :contains "jp_surbl_hits" ""
> ) {
>
>     if vctx_conn :is "p_esmtp" "true" {
>       ec_tarpit 40 "spam tarpit";
>     }
>   ec_action 550 text:
> 5.7.1 mail rejected by policy.  SURBL hit
> Spammy URLs in your message
> See http://master.php.net/mail/why.php?why=3DSURBL
> .
>   "spam:Spammy URLs in message";
>   stop;
>   }
>
> unfortunatelly the validate/omniti_tools is a shared object which has an
> exposed url_ripper function, but there is no available sourcecode or even
> documentation what I could find, so I have no idea what does that exactly
> do (I'm assuming it uses the sbl-xbl.spamhaus.org dns interface, but I
> don't know how exactly it fetches the links from the message), and couldn=
't
> find any of the domains mentioned in my email body on (php.net and
> github.com) on the blacklist.
>
> --
> Ferenc Kov=C3=A1cs
> @Tyr43l - http://tyrael.hu
>

and I wanted to mention that we should really-really move away from
ecelerity it is a closed source product, which we have an old unsupported
version on lists.php.net (from the version number it seems it can be even a
custom built one by wez) and nobody else but Wez is familiar with it, who
is rarely around the php project anymore, so would be nice replacing this
one with postfix as we(Sascha mostly) did it for the php.net MX
--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--001a1130c122a867e50545717fff--