unexpected outgoing spam classification based on X-Originating-IP

[Wolfgang Rosenauer]

Hi,

I'm running Postfix + amavisd-new + spamassassin on my mailserver(s) and my users have access to a webmail system to send mails.
Just recently I got an unexpected spam classifiation from an outgoing mail which I do not really fully understand:


First upstream SMTP client IP address: [148.251.71.226]
Received from: 148.251.71.226
-> this is my webmail system which sends mail as a client via Submission and SMTP AUTH.

Return-Path: <anonymized> mailto:***@rosenauer.org
From: anonymized
Message-ID: <***@ox.an-netz.de> mailto:***@ox.an-netz.de
X-Mailer: Open-Xchange Mailer v7.10.0-Rev12
Subject: Re: Anfrage
Not quarantined.

The message WILL BE relayed to:
<anonymized> mailto:***@aon.at

Spam scanner report:
Spam detection software, running on the system "my mailserver",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
postmaster for details.

Content preview:

Content analysis details: (7.2 points, 5.0 required)

pts rule name description
---- ---------------------- --------------------------------------------------
0.0 HTML_MESSAGE BODY: HTML included in message
3.6 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
[80.187.102.207 listed in zen.spamhaus.org]
0.7 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.
[80.187.102.207 listed in bb.barracudacentral.org]
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS



The IP listed above is the dialup IP used send the mail via the webmailer. It is rightfully listed in PBL because it's "dialup".
But it only is listed/used as X-Originating-IP.
So this is a fully legitimate mail as it was sent authenticated.

I was quite a bit surprised. I guess (haven't checked yet) that I can workaround this issue by whitelisting something. I also would be interested in pointers to that but I'm wondering also from a more general point of view if looking at X-Originating-IP for RBLs really makes sense?
I already tag and filter authenticated delivered mail as originating and send it to a different amavis port and tag it there as "ORIGINATING" policy.

$policy_bank{'ORIGINATING'} = { # mail supposedly originating from our users
originating => 1, # declare that mail was submitted by our smtp client
allow_disclaimers => 0, # enables disclaimer insertion if available
virus_admin_maps => ["virusalert\@$mydomain"],
spam_admin_maps => ["virusalert\@$mydomain"],
warnbadhsender => 1,
smtpd_discard_ehlo_keywords => ['8BITMIME'],
bypass_banned_checks_maps => [1], # allow sending any file names and types
terminate_dsn_on_notify_success => 0, # don't remove NOTIFY=SUCCESS option
};

Any indicators about this issue? Does it make sense? How to fix it?


Thanks,
Wolfgang

[Wolfgang Rosenauer]

Hi,

Post by Wolfgang Rosenauer
The IP listed above is the dialup IP used send the mail via the webmailer. It is rightfully listed in PBL because it's "dialup".
But it only is listed/used as X-Originating-IP.

<http://spamassassin.apache.org/full/3.4.x/doc/Mail_SpamAssassin_Conf.html#originating_ip_headers_header_default_x_yahoo_post_ip_x_originating_ip_x_apparently_from_x_senderip>

hmm, sounds like a workaround.
Meanwhile I have found https://bz.apache.org/SpamAssassin/show_bug.cgi?id=6501 which sounds quite similar.
But the reason why it was closed is that there was no indication of being authenticated.

In my case though the received header clearly shows this IMHO:
Received: from null (ox1.an-netz.net [148.251.71.226])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
(No client certificate requested)
by ds9.rosenauer.org (Postfix) with ESMTPSA id E5D1BA12E2
for <EMAIL>; Fri, 17 Aug 2018 15:41:44 +0200 (CEST)
X-Originating-IP: 80.187.102.207

So I still think that this should not PBL checked.

OTOH: what's the point in adding an X-Originating-IP header to mails
sent by authenticated users?

that is probably some point to argue about. Honestly I think it's useful because if a user uses a "normal" MUA the client IP is also exposed via received headers. It also seems to be the case quite many commercial webmail providers.

Oh, BTW: IMO posting HTML to a technical mailing list is a very bad
idea. But I wasn't aware that there's yet another reason to adhere to

Indeed. Unfortunately I'm on the road and did/do not have my regular mail client here and forgot to switch to plain text only before I sent the mail. Sorry for that. Typically I take care.

Post by Wolfgang Rosenauer
Return-Path: <anonymized>

[...]

Yeah, I'm not too concerned about having this exposed but good point.


Thanks,
Wolfgang