[Rspamd-Users] understanding FAKE_REPLY

[Albrecht Backhaus]

Am 09.10.2019 17:55:00, "Emanuel Gonzalez" 
<emanuel_gonzalez at live.com.ar> schrieb:

>Hi, attached the header of an email could you tell me why you add the symbol FAKE_REPLY
>
>
>Return-Path: <technical_support=dell.com__0-1ccvg86c7wc2wu at zz1jge3esx6njv.0b-gampeak.na80.bnc.salesforce.com>
>Authentication-Results:  mx3-ia2-sp2.mta.salesforce.com x-tls.subject="/C=US/ST=California/L=San Francisco/O=salesforce.com, inc./OU=0:app;1:ia2;2:ia2-sp2;3:na80;4:prod/CN=na80-app1-7-ia2.ops.sfdc.net"; auth=pass (cipher=ECDHE-RSA-AES256-GCM-SHA384)
>Received: from [10.227.195.157] ([10.227.195.157:40478] helo=na80-app1-7-ia2.ops.sfdc.net)
>by mx3-ia2-sp2.mta.salesforce.com (envelope-from <technical_support=dell.com__0-1ccvg86c7wc2wu at zz1jge3esx6njv.0b-gampeak.na80.bnc.salesforce.com>)
>(ecelerity 4.2.38.62368 r(Core:release/4.2.38.0)) with ESMTPS (cipher=ECDHE-RSA-AES256-GCM-SHA384
>subject="/C=US/ST=California/L=San Francisco/O=salesforce.com, inc./OU=0:app;1:ia2;2:ia2-sp2;3:na80;4:prod/CN=na80-app1-7-ia2.ops.sfdc.net")
>id D0/10-14285-526DD9D5; Wed, 09 Oct 2019 12:44:21 +0000
>Date: Wed, 9 Oct 2019 12:44:21 +0000 (GMT)
>From: Dell Tech Support <technical_support at dell.com>
>To: "sistemas at goldenjack.com.ar" <sistemas at goldenjack.com.ar>
>Message-ID: <Z8qjT000000000000000000000000000000000000000000000PZ3Y1U00jKhpj_iQShSLrsOIQTRBIg at sfdc.net>
>Subject: =?UTF-8?Q?RE:_Soporte_Dell_EMC_|_N=C3=BAmero_de_Caso:_998807779_de?=
>  =?UTF-8?Q?_Leonel_Osorio____[_ref:=5F00D0bGaMp.=5F5001PwLV7w:ref_]?=
>MIME-Version: 1.0
>Content-Type: multipart/alternative;
>boundary="----=_Part_14077_1920494717.1570625061936"
>X-SFDC-LK: 00D0b000000GaMp
>X-SFDC-User: 0051P000002qxTs
>X-Sender: postmaster at salesforce.com
>X-mail_abuse_inquiries: http://www.salesforce.com/company/abuse.jsp
>X-SFDC-TLS-NoRelay: 1
>X-SFDC-Binding: 1WrIRBV94myi25uB
>X-SFDC-EmailCategory: quickActionEmail
>X-SFDC-EntityId: 5001P00000wLV7w
>X-SFDC-Interface: internall
>
>
FAKE_REPLY_C {
re = "(Subject=/^R[eE]:/H) & (!((header_exists(References) | 
header_exists(In-Reply-To)))) & ((X-Mailer=/^Gnus v/H) | 
(X-Mailer=/^Microsoft Outlook Express 5/H) | (X-Mailer=/^Microsoft 
Outlook Express 6/H) | (X-Mailer=/^Mozilla 4/H) | 
(X-Mailer=/^SKYRiXgreen/H) | (X-Mailer=/^WWW-Mail \\d/H) | 
(User-Agent=/^Gnus/H) | (User-Agent=/^KNode/H) | (User-Agent=/^Mutt/H) | 
(User-Agent=/^Pan/H) | (User-Agent=/^Xnews/H)) & !(X-Mailer=/^Microsoft 
Outlook Express 6/H)";
group = "subject";
description = "Fake reply (has RE in subject, but has not References 
header)";

Regards, Albrecht