false positive Spam and Scam with thunderbird

johannes_77 · Post by **johannes_77** » Tue Mar 17, 2009 9:14 am

Hello there,

I am new to openemm and have just installed it on a new root server. I did this, since I don't want to run openemm on a production system with a high traffic load.

The problem now is, that thunderbird marks my newsletters as scam and gives spam assasin gives it a spam source of 3.5:
X-Spam-hits: BAYES_99 3.5, HTML_MESSAGE 0.001, IP_LINK_PLUS 0.001,
NORMAL_HTTP_TO_IP 0.001, BAYES_USED global

The text of the e-mail is a normal newsletter text for my community so no words inside that could lead to scam identification or similar.

One thing that is different of course, the sender is the IP of the root server, while the links lead to my original domain name. Would it help to have a domain name instead of a blank IP?

Thank you for any help,

Johannes

johannes_77 · Post by **johannes_77** » Tue Mar 17, 2009 10:15 am

update: This does also happen with the original template from openemm, so it is independet from the newsletter text I use.

lord_alan · Post by **lord_alan** » Tue Mar 17, 2009 2:54 pm

Would it help to have a domain name instead of a blank IP?

Hi there,

I think it would yes.

We have noticed similar issues with TB. Its spam detection routines look for dots "." from what we found on-line.

The format of the trackable URLs from OpenEMM contains some dots, and it seems that sometimes it triggers the spam filter but it doesn't seem to happen consistently.

But there is certainly some benefit to not using numbers and dots (like IP addresses) which is something the filter looks for AFAICT.

I mentioned this already on another thread here: http://www.openemm.org/forums/ftopic1046.html

johannes_77 · Post by **johannes_77** » Tue Mar 17, 2009 4:53 pm

interesting point with the dots.

I am now runnig it on a domain name and it did unfortunatelly not solve the problem. However, there are many dots inside the links. E.g:
http://www.server.com:8080/r.html?uid=1 ... mh01grgrtp

Not sure if this is the reason.

Please note, that TB flags it as "Scam" and not as "spam" which is totaly different. There is a yellow warning above the message that points out that this might be scam. Like I said this also goes for the standard template shiped by openemm!