Re: testing razor, understanding positive results
Stef Simoens <[email protected]> Thu, 13 Dec 2012 21:14:56 +0100
| Newsgroups | gmane.mail.spam.razor.user |
|---|---|
| Message-ID | <[email protected]> |
--===============8630774499497906470== Content-Type: multipart/alternative; boundary="Apple-Mail=_B9BF1C8B-B9CF-4673-80E0-6097EE1C4C77" --Apple-Mail=_B9BF1C8B-B9CF-4673-80E0-6097EE1C4C77 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 Hi Andy, I had the same issue with our e-mails some time ago. I posted a message like yours, but I never got an answer ;-) I'm afraid = this list is rather dead. Besides this, I did some research about 'E4' (engine 4) and 'E8' (engine = 8). One of the engines is calculating a hash on (parts of) URL's contained = in the e-mail; the other is a calculation on certain parts of the = e-mail. You could add some extra verbosity in some of the perl modules to = exactly know which URL/which parts are causing problems. For me, after some research and some mail server reconfiguration, the = problem disappeared: - I disabled Razor2 checks for the outgoing e-mail flow; - I'm "revoking" good e-mail (besides "reporting" bad e-mail). After less than a week Razor2 works nicely again with a very low rate of = false positives=85 If you want, you can send me a sample message via a private message. Good luck. Stef Op 13-dec.-2012, om 18:55 heeft Andy Smith <[email protected]> het = volgende geschreven: > Hi, >=20 > I think mail from our company may have been listed in razor. Having = googled a little on checking razor and the possibility of resolving the = issue I've not got much furhter than testing via razor-check.=20 >=20 >=20 > For example can someone help me understand the output of razor-check = -H, ie:=20 >=20 > 1.0 e4: KOQdDz58L451g4akrfcPDgthXSQA, ep4: 7542-10=20 > 1.0 e8: uNFZFVRwA-4A=20 > 1.0 e8: FVW9OG-WA-4A=20 > 1.1 e4: 79gYKj8Bv9VDBcS6OuDcKi1axXsA, ep4: 7542-10=20 > 1.1 e8: FVW9OG-WUy0A=20 > 1.2 e4: WUK1-RYSRgTSHNJXJAUVqa60eC0A, ep4: 7542-10=20 > 1.3 e4: dhdlKnsGuKKLx6zOxQZnZaKVVEEA, ep4: 7542-10=20 > 1.4 e4: JPPq_hiy3gtLKsfYr-f5l3FR7AEA, ep4: 7542-10=20 >=20 >=20 > I'd like to be able to understand this so I can undestand better what = mails are being flagged and what I can do about this.=20 >=20 >=20 > Thanks in advance for any help,=20 >=20 > Andy.=20 >=20 > = --------------------------------------------------------------------------= ---- > LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial > Remotely access PCs and mobile devices and provide instant support > Improve your efficiency, and focus on delivering more value-add = services > Discover what IT Professionals Know. Rescue delivers > = http://p.sf.net/sfu/logmein_12329d2d______________________________________= _________ > Razor-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/razor-users --Apple-Mail=_B9BF1C8B-B9CF-4673-80E0-6097EE1C4C77 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=windows-1252 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html = charset=3Dwindows-1252"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hi = Andy,<div><br></div><div>I had the same issue with our e-mails some time = ago.</div><div>I posted a message like yours, but I never got an answer = ;-) I'm afraid this list is rather = dead.</div><div><br></div><div>Besides this, I did some research about = 'E4' (engine 4) and 'E8' (engine 8).</div><div>One of the engines is = calculating a hash on (parts of) URL's contained in the e-mail; the = other is a calculation on certain parts of the = e-mail.</div><div><br></div><div>You could add some extra verbosity in = some of the perl modules to exactly know which URL/which parts are = causing problems.</div><div><br></div><div>For me, after some research = and some mail server reconfiguration, the problem = disappeared:</div><div>- I disabled Razor2 checks for the outgoing = e-mail flow;</div><div>- I'm "revoking" good e-mail (besides "reporting" = bad e-mail).</div><div><br></div><div>After less than a week Razor2 = works nicely again with a very low rate of false = positives=85</div><div><br></div><div>If you want, you can send me a = sample message via a private message.</div><div><br></div><div>Good = luck.</div><div><br></div><div>Stef</div><div><br><div><div>Op = 13-dec.-2012, om 18:55 heeft Andy Smith <<a = href=3D"mailto:[email protected]">[email protected]</a>> het = volgende geschreven:</div><br = class=3D"Apple-interchange-newline"><blockquote type=3D"cite"> =20 <meta http-equiv=3D"content-type" content=3D"text/html; = charset=3DISO-8859-1"> =20 <div text=3D"#000000" bgcolor=3D"#FFFFFF"> <div class=3D"moz-text-flowed" style=3D"font-family: -moz-fixed; font-size: 14px;" lang=3D"x-western">Hi,<br> <br> I think mail from our company may have been listed in = razor. Having googled a little on checking razor and the possibility of resolving the issue I've not got much furhter than testing via razor-check. <br> <br> <br> For example can someone help me understand the output of razor-check -H, ie: <br> <br> 1.0 e4: KOQdDz58L451g4akrfcPDgthXSQA, ep4: 7542-10 <br> 1.0 e8: uNFZFVRwA-4A <br> 1.0 e8: FVW9OG-WA-4A <br> 1.1 e4: 79gYKj8Bv9VDBcS6OuDcKi1axXsA, ep4: 7542-10 <br> 1.1 e8: FVW9OG-WUy0A <br> 1.2 e4: WUK1-RYSRgTSHNJXJAUVqa60eC0A, ep4: 7542-10 <br> 1.3 e4: dhdlKnsGuKKLx6zOxQZnZaKVVEEA, ep4: 7542-10 <br> 1.4 e4: JPPq_hiy3gtLKsfYr-f5l3FR7AEA, ep4: 7542-10 <br> <br> <br> I'd like to be able to understand this so I can undestand better what mails are being flagged and what I can do about this. <br> <br> <br> Thanks in advance for any help, <br> <br> Andy. <br> <br> </div> </div> = --------------------------------------------------------------------------= ----<br>LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free = Trial<br>Remotely access PCs and mobile devices and provide instant = support<br>Improve your efficiency, and focus on delivering more = value-add services<br>Discover what IT Professionals Know. Rescue = delivers<br><a = href=3D"http://p.sf.net/sfu/logmein_12329d2d______________________________= _________________">http://p.sf.net/sfu/logmein_12329d2d___________________= ____________________________</a><br>Razor-users mailing = list<br>[email protected]<br>https://lists.sourceforge.net= /lists/listinfo/razor-users<br></blockquote></div><br></div></body></html>= --Apple-Mail=_B9BF1C8B-B9CF-4673-80E0-6097EE1C4C77-- --===============8630774499497906470== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial Remotely access PCs and mobile devices and provide instant support Improve your efficiency, and focus on delivering more value-add services Discover what IT Professionals Know. Rescue delivers http://p.sf.net/sfu/logmein_12329d2d --===============8630774499497906470== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Razor-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/razor-users --===============8630774499497906470==--