Re: False Positives
Dharmesh Mevawala <[email protected]> Fri, 20 Nov 2015 16:04:55 +0530
| Newsgroups | gmane.mail.qmail.scanner |
|---|---|
| Organization | You Broadband India Pvt. Ltd. |
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============0676705403342290686== Content-Type: multipart/alternative; boundary="------------020402060408000703030709" This is a multi-part message in MIME format. --------------020402060408000703030709 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Hi Salvatore, Thanks for the quick response. I have emailed to bank's IT department asking them to correct this issue at there end. Lets see if I receive any positive reply from them. Else I will go with 2nd option where in I will route all mails from this bank to "qmail-scanner-queue-no-mime.pl" using tcp.smtp rules. Thanks once again for your valuable suggestions. Regards, Dharmesh On Friday 20 November 2015 02:55 PM, Salvatore Toribio wrote: > Re: [Qmail-scanner-general] False Positives > Hi Dharmesh > > The email was quarantined because a 'Disallowed breakage found > in*header name*', and I think the problem is the last two lines of the > headers in the mail the automatic procedure of the bank sent to your > client. > > *Inward Cheque Debit Alert : UTF8* > > Should be > > *Inward-Cheque-bit-Alert: UTF8* > > There are plenty of spaces between 'Alert' and ':', or maybe this line > wasn't meant to be in the headers... > > The problem is: what can you do about it? > > You could contact the bank's IT guys and tell them that their mail it > is not formatted correctly... (good luck witn this) > > Or you can disable this check for "all" your incoming emails, setting > the variable BAD_MIME_CHECKS (editing qmail-scanner-queue.pl) to '0': > > #Try to fix bad MIME messages before passing to MIME unpacker > my $BAD_MIME_CHECKS='0'; > > Or reconfiguring qmail-scanner with "--fix-mime no" > > > You can also try to do something more complicated, like having another > "qmail-scanner-queue-no-mime.pl" and redirecting to this 'queue' > through the 'tcp.smtp' rules the email from the servers of the bank, > and other servers with similar problems. But you need to understand > well how this works. > > Regards > > Salvatore > > At 11:47 +0530 20-11-2015, Dharmesh Mevawala wrote: >> We are a leading ISP in India & we are running qmail & qmail-scanner >> on our various email servers. >> Since last few days, we have observed that some of the emails are >> getting quarantined by qmail-scanner. >> These are legal emails sent by bank to our customer, to whom we >> provide internet services. He is using email-id >> provided by us. Bank is sending him various emails based on financial >> transactions done by him. Since these emails >> are getting quarantined, its not getting delivered to our customer. >> He raised a complain for the same. Emails seems auto-generated >> by bank's email sever & seems to be a false positive to me. This is >> happening to multiple customers of ours. Pl. help me resolve this issue. >> >> I have attached few sample mails here with. >> >> -- >> Regards, >> *Regards,* >> *Dharmesh Mevawala* >> Manager-Networks >> YOU Broadband India Pvt. Ltd. >> 2nd Floor, Millennium Arcade >> Adajan-Hazira Road, Surat-395009 >> Mobile: +91 98790 00854 >> Landline: +91 261 6676767 Ext: 1650 >> Email: [email protected] >> <mailto:[email protected]> >> http://www.youbroadband.in >> >> >> X-Account-Key: account1 >> X-Mozilla-Keys: >> Return-Path: <> >> Delivered-To: [email protected] >> Received: (qmail 1623 invoked by uid 508); 19 Nov 2015 07:43:12 -0000 >> X-Qmail-Scanner-Diagnostics: from inmail.youbroadband.in by >> getmail.youbroadband.in (envelope-from <>, >> uid 500) with qmail-scanner-2.11 >> (mhr: 1.0. clamdscan: 0.98.7/21068. spamassassin: 3.3.2. >> Clear:RC:0(203.187.192.7):SA:0(2.2/5.0):. >> Processed in 1.027606 secs); 19 Nov 2015 07:43:12 -0000 >> X-Spam-Status: No, score=2.2 required=5.0 >> X-Spam-Level: ++ >> Received: from inmail.youbroadband.in ([203.187.192.7]) >> (envelope-sender <>) >> by getmail.youbroadband.in (qmail-ldap-1.03) with SMTP >> for <[email protected]>; 19 Nov 2015 07:43:11 -0000 >> Received: (qmail 9324 invoked by alias); 19 Nov 2015 07:42:24 -0000 >> Delivered-To: [email protected] >> Received: (qmail 9321 invoked by alias); 19 Nov 2015 07:42:24 -0000 >> Delivered-To: [email protected] >> Received: (qmail 9318 invoked by uid 508); 19 Nov 2015 07:42:24 -0000 >> Received: from mx1.youbroadband.in ([203.187.192.28]) >> (envelope-sender <>) >> by inmail.youbroadband.in (qmail-ldap-1.03) with SMTP >> for <[email protected]>; 19 Nov 2015 07:42:24 -0000 >> Received: (qmail 24907 invoked by uid 508); 19 Nov 2015 07:41:59 -0000 >> Date: 19 Nov 2015 07:41:59 -0000 >> From: "System Anti-Virus Administrator" <[email protected]> >> To: [email protected] >> Subject: policy-violation found in sent message "Inward Cheque Debit >> Alert" >> Message-ID: <[email protected]> >> Auto-Submitted: auto-replied >> In-Reply-To: <63833038.1447918944174.JavaMail.wasadm@alertapp> >> References: <63833038.1447918944174.JavaMail.wasadm@alertapp> >> MIME-Version: 1.0 >> Content-type: text/plain >> Content-Transfer-Encoding: 8bit >> >> >> Attention: [email protected] >> >> >> A policy-violation was found in an Email message you sent. >> This Email scanner intercepted it and stopped the entire message >> reaching its destination. >> >> The policy-violation was reported to be: >> Disallowed breakage found in header name - not valid email >> >> >> Please contact your IT support personnel with any queries regarding this >> policy. >> >> >> Your message was sent with the following envelope: >> >> MAIL FROM: [email protected] >> RCPT TO: [email protected] >> >> ... and with the following headers: >> >> --- >> MAILFROM: [email protected] >> RCPTTO: [email protected] >> IP-Addr: 115.112.212.211 >> Received: from alerts8.kotak.com ([115.112.212.211]) >> (envelope-sender <[email protected]>) >> by mx1.youbroadband.in (qmail-ldap-1.03) with SMTP >> for <[email protected]>; 19 Nov 2015 07:41:59 -0000 >> Message-ID: <63833038.1447918944174.JavaMail.wasadm@alertapp> >> Date: Thu, 19 Nov 2015 13:12:24 +0530 (GMT+05:30) >> From: [email protected] >> To: [email protected] >> Subject: Inward Cheque Debit Alert >> Mime-Version: 1.0 >> Content-Type: multipart/mixed; >> boundary="----=_Part_162766_54788932.1447918944171" >> *Inward Cheque Debit Alert : UTF8* >> >> >> --- >> >> >> >> The original message is kept in: >> >> mx1.youbroadband.in:/var/spool/qscan/quarantine/policy/new/mx1.youbroadband.in144791891958824895 >> >> where the System Anti-Virus Administrator can further diagnose it. >> >> The Email scanner reported the following when it scanned that message: >> >> --- >> >> ---perlscanner results --- >> problem 'Disallowed breakage found in header name - not valid email' >> found in message >> --- > --------------020402060408000703030709 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: 8bit <html> <head> <meta content="text/html; charset=windows-1252" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">Hi Salvatore,<br> <br> Thanks for the quick response. I have emailed to bank's IT department asking them to correct this issue at there end.<br> Lets see if I receive any positive reply from them. Else I will go with 2nd option where in I will route all mails from this bank<br> to "qmail-scanner-queue-no-mime.pl" using tcp.smtp rules.<br> <br> Thanks once again for your valuable suggestions.<br> <br> Regards,<br> <br> Dharmesh<br> <br> <br> On Friday 20 November 2015 02:55 PM, Salvatore Toribio wrote:<br> </div> <blockquote cite="mid:a06240801d274875ab323@%5B10.10.82.254%5D" type="cite"> <style type="text/css"><!-- blockquote, dl, ul, ol, li { padding-top: 0 ; padding-bottom: 0 } --></style> <title>Re: [Qmail-scanner-general] False Positives</title> <div>Hi Dharmesh</div> <div><br> </div> <div>The email was quarantined because a 'Disallowed breakage found in<b> header name</b>', and I think the problem is the last two lines of the headers in the mail the automatic procedure of the bank sent to your client.</div> <div><br> </div> <div><b>Inward Cheque Debit Alert <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> : UTF8</b></div> <div><br> </div> <div>Should be</div> <div><br> </div> <div><b>Inward-Cheque-bit-Alert: UTF8</b></div> <div><br> </div> <div>There are plenty of spaces between 'Alert' and ':', or maybe this line wasn't meant to be in the headers...</div> <div><br> </div> <div>The problem is: what can you do about it?</div> <div><br> </div> <div>You could contact the bank's IT guys and tell them that their mail it is not formatted correctly... (good luck witn this)</div> <div><br> </div> <div>Or you can disable this check for "all" your incoming emails, setting the variable BAD_MIME_CHECKS (editing qmail-scanner-queue.pl) to '0':</div> <div><br> </div> <div>#Try to fix bad MIME messages before passing to MIME unpacker</div> <div>my $BAD_MIME_CHECKS='0';</div> <div><br> </div> <div>Or reconfiguring qmail-scanner with "--fix-mime no"</div> <div><br> </div> <div><br> </div> <div>You can also try to do something more complicated, like having another "qmail-scanner-queue-no-mime.pl" and redirecting to this 'queue' through the 'tcp.smtp' rules the email from the servers of the bank, and other servers with similar problems. But you need to understand well how this works.</div> <div><br> </div> <div>Regards</div> <div><br> </div> <div>Salvatore</div> <div><br> </div> <div>At 11:47 +0530 20-11-2015, Dharmesh Mevawala wrote:</div> <blockquote type="cite" cite=""><font face="Verdana">We are a leading ISP in India & we are running qmail & qmail-scanner on our various email servers.<br> Since last few days, we have observed that some of the emails are getting quarantined by qmail-scanner.<br> These are legal emails sent by bank to our customer, to whom we provide internet services. He is using email-id<br> provided by us. Bank is sending him various emails based on financial transactions done by him. Since these emails<br> are getting quarantined, its not getting delivered to our customer. He raised a complain for the same. Emails seems auto-generated<br> by bank's email sever & seems to be a false positive to me. This is happening to multiple customers of ours. Pl. help me resolve this issue.<br> <br> I have attached few sample mails here with.<br> </font><br> </blockquote> <blockquote type="cite" cite="">--<br> Regards,<br> </blockquote> <blockquote type="cite" cite=""><b>Regards,</b><br> </blockquote> <blockquote type="cite" cite=""><b>Dharmesh Mevawala</b><br> </blockquote> <blockquote type="cite" cite="">Manager-Networks<br> </blockquote> <blockquote type="cite" cite="">YOU Broadband India Pvt. Ltd.<br> </blockquote> <blockquote type="cite" cite="">2nd Floor, Millennium Arcade<br> </blockquote> <blockquote type="cite" cite="">Adajan-Hazira Road, Surat-395009<br> </blockquote> <blockquote type="cite" cite="">Mobile: +91 98790 00854<br> </blockquote> <blockquote type="cite" cite="">Landline: +91 261 6676767 Ext: 1650<br> </blockquote> <blockquote type="cite" cite="">Email: <a moz-do-not-send="true" href="mailto:[email protected]">[email protected]</a><br> </blockquote> <blockquote type="cite" cite=""><a moz-do-not-send="true" href="http://www.youbroadband.in">http://www.youbroadband.in</a><br> </blockquote> <blockquote type="cite" cite=""> <br> </blockquote> <blockquote type="cite" cite=""><br> X-Account-Key: account1<br> X-Mozilla-Keys:<br> Return-Path: <><br> Delivered-To: <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a><br> Received: (qmail 1623 invoked by uid 508); 19 Nov 2015 07:43:12 -0000<br> X-Qmail-Scanner-Diagnostics: from inmail.youbroadband.in by<br> <x-tab> </x-tab>getmail.youbroadband.in (envelope-from <>,<br> <x-tab> </x-tab>uid 500) with qmail-scanner-2.11<br> <x-tab> </x-tab>(mhr: 1.0. clamdscan: 0.98.7/21068. spamassassin: 3.3.2. <br> <x-tab> </x-tab>Clear:RC:0(203.187.192.7):SA:0(2.2/5.0):.<br> <x-tab> </x-tab>Processed in 1.027606 secs); 19 Nov 2015 07:43:12 -0000<br> X-Spam-Status: No, score=2.2 required=5.0<br> X-Spam-Level: ++<br> Received: from inmail.youbroadband.in ([203.187.192.7]) (envelope-sender <>)<br> <x-tab> </x-tab>by getmail.youbroadband.in (qmail-ldap-1.03) with SMTP<br> <x-tab> </x-tab>for <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a>; 19 Nov 2015 07:43:11 -0000<br> Received: (qmail 9324 invoked by alias); 19 Nov 2015 07:42:24 -0000<br> Delivered-To: <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a><br> Received: (qmail 9321 invoked by alias); 19 Nov 2015 07:42:24 -0000<br> Delivered-To: <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a><br> Received: (qmail 9318 invoked by uid 508); 19 Nov 2015 07:42:24 -0000<br> Received: from mx1.youbroadband.in ([203.187.192.28]) (envelope-sender <>)<br> <x-tab> </x-tab>by inmail.youbroadband.in (qmail-ldap-1.03) with SMTP<br> <x-tab> </x-tab>for <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a>; 19 Nov 2015 07:42:24 -0000<br> Received: (qmail 24907 invoked by uid 508); 19 Nov 2015 07:41:59 -0000<br> Date: 19 Nov 2015 07:41:59 -0000<br> From: "System Anti-Virus Administrator" <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a></blockquote> <blockquote type="cite" cite="">To: <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a><br> Subject: policy-violation found in sent message "Inward Cheque Debit Alert"<br> Message-ID: <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a><br> Auto-Submitted: auto-replied<br> In-Reply-To: <63833038.1447918944174.JavaMail.wasadm@alertapp><br> References: <63833038.1447918944174.JavaMail.wasadm@alertapp><br> MIME-Version: 1.0<br> Content-type: text/plain<br> Content-Transfer-Encoding: 8bit<br> <br> <br> Attention: <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a><br> <br> <br> A policy-violation was found in an Email message you sent.<br> This Email scanner intercepted it and stopped the entire message<br> reaching its destination.<br> <br> The policy-violation was reported to be:<br> </blockquote> <blockquote type="cite" cite="">Disallowed breakage found in header name - not valid email<br> <br> <br> Please contact your IT support personnel with any queries regarding this<br> policy.<br> <br> <br> Your message was sent with the following envelope:<br> <br> MAIL FROM: <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a><br> RCPT TO: <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a><br> <br> ... and with the following headers:<br> <br> ---<br> MAILFROM: <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a><br> RCPTTO: <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a><br> IP-Addr: 115.112.212.211<br> Received: from alerts8.kotak.com ([115.112.212.211])<br> (envelope-sender <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a>)<br> by mx1.youbroadband.in (qmail-ldap-1.03) with SMTP<br> for <a class="moz-txt-link-rfc2396E" href="mailto:[email protected]"><[email protected]></a>; 19 Nov 2015 07:41:59 -0000<br> Message-ID: <63833038.1447918944174.JavaMail.wasadm@alertapp><br> Date: Thu, 19 Nov 2015 13:12:24 +0530 (GMT+05:30)<br> From: <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a><br> To: <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a><br> Subject: Inward Cheque Debit Alert<br> Mime-Version: 1.0<br> Content-Type: multipart/mixed;<br> <x-tab> </x-tab>boundary="----=_Part_162766_54788932.1447918944171"</blockquote> <blockquote type="cite" cite=""><b>Inward Cheque Debit Alert <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> <span></span> : UTF8</b></blockquote> <blockquote type="cite" cite=""><br> <br> ---<br> <br> <br> <br> The original message is kept in:<br> <br> mx1.youbroadband.in:/var/spool/qscan/quarantine/policy/new/mx1.youbro<span></span>adband.in144791891958824895<br> <br> where the System Anti-Virus Administrator can further diagnose it.<br> <br> The Email scanner reported the following when it scanned that message:<br> <br> ---<br> <br> ---perlscanner results ---<br> problem 'Disallowed breakage found in header name - not valid email' found in message</blockquote> <blockquote type="cite" cite="">---<br> </blockquote> <div><br> </div> </blockquote> <br> <br> <div class="moz-signature"><br> </div> </body> </html> --------------020402060408000703030709-- --===============0676705403342290686== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ --===============0676705403342290686== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Qmail-scanner-general mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/qmail-scanner-general --===============0676705403342290686==--