Mailing List Archive: What is triggering BAD_X

What is triggering BAD_X_HEADERS?

Feb 25, 2004, 3:39 PM

Post #1 of 4 (593 views)

Hello,

Can anyone tell me what is causing the BAD_X_HEADERS hit on these
headers? Is it the X-URL?

X-URL: http://www.pocomail.com
X-Scanned-By: MIMEDefang 2.36
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) (SAProxy Pro
2.5) on
mat-hkdnjivb2sj
X-Spam-Level: ******
X-Spam-Status: Yes, hits=6.5 required=5.0
tests=BAD_X_HEADERS,PRETERNATURALLY
autolearn=spam version=2.63
X-Spam-Report:
* 3.0 BAD_X_HEADERS Message uses spammy X- header
* 3.5 PRETERNATURALLY BODY: full body contains
PRETERNATURALLY
X-From-Domain: pocomail.com
X-Poco-UID: 99596811
X-Poco-Status: RW
X-Account: NTL

I've removed the other headers for privacy but if they're needed i'll
post them. The X-From-Domain is added after download (i think all of
the last four must be) so it isn't that but this is from an authentic
email so i don't want it to trigger the BAD_X_HEADERS test.

Any info is much appreciated!

Thanks,
Mat

Re: What is triggering BAD_X_HEADERS? [ In reply to ]

kelson at speed

Feb 25, 2004, 4:40 PM

Post #2 of 4 (546 views)

Permalink

At 02:39 PM 2/25/2004, Mat Bowen wrote:
>Can anyone tell me what is causing the BAD_X_HEADERS hit on these
>headers? Is it the X-URL?

Assuming you're using the rule from
http://www.merchantsoverseas.com/wwwroot/gorilla/nov2rules.cf it looks like
X-URL would trip it.

A brief Google search for BAD_X_HEADERS turns up the following report of
false positives with the same cause:
http://www.mail-archive.com/spamassassin-talk@lists.sourceforge.net/msg25144.html

Kelson Vibber
SpeedGate Communications <www.speed.net>

Re: What is triggering BAD_X_HEADERS? [ In reply to ]

M.K.Bowen at lboro

Feb 25, 2004, 5:02 PM

Post #3 of 4 (547 views)

Permalink

On Wed, 25 Feb 2004 15:40:42 -0800, Kelson Vibber wrote:
> At 02:39 PM 2/25/2004, Mat Bowen wrote:
>> Can anyone tell me what is causing the BAD_X_HEADERS hit on these
>> headers? Is it the X-URL?
>
> Assuming you're using the rule from
> http://www.merchantsoverseas.com/wwwroot/gorilla/nov2rules.cf it
> looks like
> X-URL would trip it.
>
> A brief Google search for BAD_X_HEADERS turns up the following
> report of
> false positives with the same cause:
> http://www.mail-archive.com/spamassassin-
> talk@lists.sourceforge.net/msg25144.html
>
>
> Kelson Vibber
> SpeedGate Communications <www.speed.net>;

Thanks i see it now in nov2rules.cf and have removed it. I hope the
URL test gets removed from future updates, or at least the score
decreased.

Thanks again,
Mat

PS: My apologies to Kelson in sending my first reply directly to him
and not to the list.

RE: What is triggering BAD_X_HEADERS? [ In reply to ]

csanterre at MerchantsOverseas

Feb 26, 2004, 8:30 AM

Post #4 of 4 (528 views)

Permalink

Noted! Will take care of this on next update of SARE. Which is actually
being worked on ;)

--Chris

> -----Original Message-----
> From: Mat Bowen [mailto:M.K.Bowen@lboro.ac.uk]
> Sent: Wednesday, February 25, 2004 7:02 PM
> To: spamassassin-users@incubator.apache.org
> Subject: Re: What is triggering BAD_X_HEADERS?
>
>
> On Wed, 25 Feb 2004 15:40:42 -0800, Kelson Vibber wrote:
> > At 02:39 PM 2/25/2004, Mat Bowen wrote:
> >> Can anyone tell me what is causing the BAD_X_HEADERS hit on these
> >> headers? Is it the X-URL?
> >
> > Assuming you're using the rule from
> > http://www.merchantsoverseas.com/wwwroot/gorilla/nov2rules.cf it
> > looks like
> > X-URL would trip it.
> >
> > A brief Google search for BAD_X_HEADERS turns up the following
> > report of
> > false positives with the same cause:
> > http://www.mail-archive.com/spamassassin-
> > talk@lists.sourceforge.net/msg25144.html
> >
> >
> > Kelson Vibber
> > SpeedGate Communications <www.speed.net>;
>
> Thanks i see it now in nov2rules.cf and have removed it. I hope the
> URL test gets removed from future updates, or at least the score
> decreased.
>
> Thanks again,
> Mat
>
> PS: My apologies to Kelson in sending my first reply directly to him
> and not to the list.
>
>
>