Stuart Gathman
92 lines
3.3 KiB
Plaintext
92 lines
3.3 KiB
Plaintext
Title: Python Milter Log Documentation
|
|
<style>
|
|
DT { font-weight: bolder; padding-top: 1em }
|
|
</style>
|
|
|
|
<h1> Milter Log Documentation </h1>
|
|
|
|
The milter log from the bms.py application has a variety of "tags" in it that
|
|
indicate what it did.
|
|
|
|
<dl>
|
|
<dt> DSPAM: honeypot SCREENED
|
|
<dd> message was quarantined to the honeypot quarantine
|
|
|
|
<dt> REJECT: hello SPF: fail 550 access denied
|
|
<dt> REJECT: hello SPF: softfail 550 domain in transition
|
|
<dt> REJECT: hello SPF: neutral 550 access neither permitted nor denied
|
|
<dd> message was rejected because there was an SPF policy for the
|
|
HELO name, and it did not pass.
|
|
|
|
<dt> CBV: sender-17-44662668-643@bluepenmagic.com
|
|
<dd> we performed a call back verification
|
|
|
|
<dt> dspam
|
|
<dd> dspam identifier was added to the message
|
|
|
|
<dt> REJECT: spam from self: jsconnor.com
|
|
<dd> message was reject because HELO was us (jsconnor.com)
|
|
|
|
<dt> INNOC: richh
|
|
<dd> message was used to update richh's dspam dictionary
|
|
|
|
<dt> HONEYPOT: pooh@bwicorp.com
|
|
<dd> message was sent to a honeypot address (pooh@bwicorp.com), the
|
|
message was added to the honeypot dspam dictionary as spam
|
|
|
|
<dt> REJECT: numeric hello name: 63.217.19.146
|
|
<dd> message was rejected because helo name was invalid (numeric)
|
|
|
|
<dt> eom
|
|
<dd> message was successfully received
|
|
|
|
<dt> TEMPFAIL: CBV: 450 No MX servers available
|
|
<dd> we tried to do a call back verification but could not look up
|
|
MX record, we told the sender to try again later
|
|
|
|
<dt> CBV: info@emailpizzahut.com (cached)
|
|
<dd> call back verification was needed, we had already done it recently
|
|
|
|
<dt> abort after 0 body chars
|
|
<dd> sender hung up on us
|
|
|
|
<dt> REJECT: SPF fail 550 SPF fail: see
|
|
http://openspf.com/why.html?sender=m.hendersonxk@163.net&ip=213.47.161.100
|
|
<dd> message was reject because its sender's spf policy said to
|
|
|
|
<dt> REJECT: Subject: Cialis - No prescription needed!
|
|
<dd> message was rejected because its subject contained a bad expression
|
|
|
|
<dt> REJECT: zombie PC at 192.168.3.37 sending MAIL FROM seajdr@amritind.com
|
|
<dd> message was rejected because the connect ip was internal, but the
|
|
sender was not. This is usually because a Windows PC is infected with
|
|
malware.
|
|
|
|
<dt> X-Guessed-SPF: pass
|
|
<dd> When the SPF result is NONE, we guess a result based on the generic
|
|
SPF policy "v=spf1 a/24 mx/24 ptr".
|
|
|
|
<dt> DSPAM: tonyc tonyc@example.com
|
|
<dd> message was sent to tonyc@example.com and it was identified as spam
|
|
and placed in the tonyc dspam quarantine
|
|
|
|
<dt> REJECT: CBV: 550 calvinalstonis@ix.netcom.com...User unknown
|
|
<dt> REJECT: CBV: 553 sorry, that domain isn't in my list
|
|
<dt> REJECT: CBV: 554 delivery error: dd This user doesn't have an account
|
|
<dd> message was rejected because call back verification gave us a fatal
|
|
error
|
|
<dt> Auto-Whitelist: user@example.com
|
|
<dd> recipient has been added to auto_whitelist.log because the message
|
|
was sent from an internal IP and the recipient is not internal.
|
|
<dt> WHITELIST user@example.com
|
|
<dd> message is whitelisted because sender appears in auto_whitelist.log
|
|
<dt> BLACKLIST user@example.com
|
|
<dd> message is blacklisted because sender appears in blacklist.log or
|
|
failed a CBV test.
|
|
<dt> TRAINSPAM: honeypot X-Dspam-Score: 0.002278
|
|
<dd> message was used to train screener dictionary as spam
|
|
<dt> TRAIN: honeypot X-Dspam-Score: 0.980203
|
|
<dd> message was used to train screener dictionary as ham
|
|
</dl>
|
|
<br>
|