[RndTbl] SpamAssassin false positives on DATE_IN_FUTURE_96_Q?

Gilbert E. Detillieux gedetil at cs.umanitoba.ca
Mon Nov 14 16:56:53 CST 2011


I mentioned this problem at the last round-table session, but didn't get 
a solution, so I thought I'd post it here, just in case anyone has any 
suggestions to offer.

I'm still seeing a whole bunch of false positives in SpamAssassin, since 
an update was installed in mid-September on a CentOS 5.7 system, for a 
rule called DATE_IN_FUTURE_96_Q, which is only supposed to be triggered 
when the "Date:" header has a date that is 4 days to 4 month ahead of 
the date in the "Received" header that has the _smallest_ difference in 
date.

Here are the headers from the latest e-mail I've received with this 
false-positive.  (I've stripped out irrelevant headers, for the sake of 
clarity and simplicity.)

 From topfivestories at messagent.itworldcanada.com  Mon Nov 14 07:50:13 2011
Received: from mail.messagent.itworldcanada.com 
(mail.messagent.itworldcanada.com [207.112.10.80])
         by palladium.cs.umanitoba.ca (8.13.8/8.13.8) with SMTP id 
pAEDoAxV028594
         for <gedetil at cs.umanitoba.ca>; Mon, 14 Nov 2011 07:50:12 -0600
Date: Mon, 14 Nov 2011 08:50:13 -0500
X-Spam-Status: No, score=-0.3 required=5.0 
tests=BAYES_00,DATE_IN_FUTURE_96_Q,
         HTML_MESSAGE,RP_MATCHES_RCVD autolearn=no version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
         palladium.cs.umanitoba.ca

Note that I'm calling spamd via the spamass-milter on a system running 
sendmail.  Note also, that in the above example, the only "Received" 
header was the one generated by my own server.  (I've had other false 
positives, however, with multiple "Received" headers, all of which were 
within seconds of the time in the "Date" header.)

Any ideas?

-- 
Gilbert E. Detillieux		E-mail: <gedetil at muug.mb.ca>
Manitoba UNIX User Group	Web:	http://www.muug.mb.ca/
PO Box 130 St-Boniface		Phone:  (204)474-8161
Winnipeg MB CANADA  R2H 3B4	Fax:    (204)474-7609


More information about the Roundtable mailing list