Re: Still seeing lots of false positives caused by SHOPIFY_IMG_NOT_RCVD_SFY

On Sat, 10 Jan 2026, John Hardin wrote:

> On Sat, 10 Jan 2026, Bill Cole wrote:
>
>>  header	__HDR_RCVD_KLAYVIO	X-Spam-Relays-External =~ /\srdns=\S+\.klayvio\.com\s/
>
> Pretty much what I was going to do. I'm less trusting of sendgrid, though, as 
> I regularly get spam via them, so I'm only adding Klayvio.

...well, actually "klaviyo". Typo, Bill (though an easy one). :)

(actually "klaviyomail.com" - marketing emails from their clients don't 
come through klaviyo.com)

It doesn't look like Shopify is actually transparently outsourcing all 
merchant email to Klaviyo, it's more they are encouraging merchants to use 
Klaviyo for their marketing email as a preferred or recommended partner. 
So there will still be email coming from the Shopify infrastructure.

Klaviyo also aapparently allows MTA branding / custom DNS so we need to 
look for Klaviyo headers in addition to checking the relay domain name.

Exclusion committed and _should_ go out tomorrow, but the score limit will 
take a week to have any effect because the networked scoring run was 
yesterday.

-- 
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  [email protected]                         pgpk -a [email protected]
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   So Microsoft's invented the ASCII equivalent to ugly ink spots that
   appear on your letter when your pen is malfunctioning.
          -- Greg Andrews, about Microsoft's way to encode apostrophes
-----------------------------------------------------------------------
  7 days until Benjamin Franklin's 320th Birthday