Googlegroups spam Re: MAILING_LIST_MULTI

On Tue, 25 Feb 2025, Bill Cole wrote:

> On 2025-02-25 at 09:31:44 UTC-0500 (Tue, 25 Feb 2025 09:31:44 -0500)
[snip..]
>> The problem with googlegroups is that google seems to let people create
>> groups and add people to them.  Really, that google seems to choose to
>> allow spamming with gmail in general.
>
> Yes, Google is a net bad actor regarding spam. I personally treat them as a 
> default spam source, so that mail from any part of their open sewer must have 
> some affirmatively positive indicators to even be seen by SA. Obviously, I 
> don't believe that such a policy fits SA or even the mail systems I work with 
> that are not my own.
>
> However, I would strongly advise that anyone needing to reliably receive 
> Google Groups mail look at local protective practices for specific groups 
> based on  the List-ID, X-Google-Group-Id, or Mailing-list headers. Even if 
> our RuleQA doesn't prove out the value of an exclusion of them from the 
> MAILING_LIST_MULTI rule, there will probably be some other work towards 
> catching that spam. This is something like the fourth time people have 
> brought this problem up here, so it is not going away until SA starts marking 
> Google Groups mail as spam or it stops being predominantly spam.

In several of the Google headers added for their groups there are domain names 
of spamvertizers. (EG: X-BeenThere, X-Spam-Checked-In-Group, List-Archive, etc).

Is there a straightforward way to harvest those domain names and then feed them 
to an RBL for filtering? (short of writing my own custom module).

I've got my own local RBL that I use for spamvertizing DNS names but the default 
SA processing doesn't seem to 'see' those imbedded names.

Dave

-- 
Dave Funk                               University of Iowa
<dbfunk (at) engineering.uiowa.edu>     College of Engineering
319/335-5751   FAX: 319/384-0549        1256 Seamans Center, 103 S Capitol St.
Sys_admin/Postmaster/cell_admin         Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{