[Rspamd-Users] understanding FAKE_REPLY

[Sophie Loewenthal]

> On 9 Oct 2019, at 6:48 pm, Albrecht Backhaus <albrecht.backhaus at gmail.com> wrote:
> 
> 
> Am 09.10.2019 17:55:00, "Emanuel Gonzalez" <emanuel_gonzalez at live.com.ar> schrieb:
> 
>> Hi, attached the header of an email could you tell me why you add the symbol FAKE_REPLY
>> 
>> 
>> Return-Path: <technical_support=dell.com__0-1ccvg86c7wc2wu at zz1jge3esx6njv.0b-gampeak.na80.bnc.salesforce.com>
>> Authentication-Results:  mx3-ia2-sp2.mta.salesforce.com x-tls.subject="/C=US/ST=California/L=San Francisco/O=salesforce.com, inc./OU=0:app;1:ia2;2:ia2-sp2;3:na80;4:prod/CN=na80-app1-7-ia2.ops.sfdc.net"; auth=pass (cipher=ECDHE-RSA-AES256-GCM-SHA384)
>> Received: from [10.227.195.157] ([10.227.195.157:40478] helo=na80-app1-7-ia2.ops.sfdc.net)
>> by mx3-ia2-sp2.mta.salesforce.com (envelope-from <technical_support=dell.com__0-1ccvg86c7wc2wu at zz1jge3esx6njv.0b-gampeak.na80.bnc.salesforce.com>)
>> (ecelerity 4.2.38.62368 r(Core:release/4.2.38.0)) with ESMTPS (cipher=ECDHE-RSA-AES256-GCM-SHA384
>> subject="/C=US/ST=California/L=San Francisco/O=salesforce.com, inc./OU=0:app;1:ia2;2:ia2-sp2;3:na80;4:prod/CN=na80-app1-7-ia2.ops.sfdc.net")
>> id D0/10-14285-526DD9D5; Wed, 09 Oct 2019 12:44:21 +0000
>> Date: Wed, 9 Oct 2019 12:44:21 +0000 (GMT)
>> From: Dell Tech Support <technical_support at dell.com>
>> To: "sistemas at goldenjack.com.ar" <sistemas at goldenjack.com.ar>
>> Message-ID: <Z8qjT000000000000000000000000000000000000000000000PZ3Y1U00jKhpj_iQShSLrsOIQTRBIg at sfdc.net>
>> Subject: =?UTF-8?Q?RE:_Soporte_Dell_EMC_|_N=C3=BAmero_de_Caso:_998807779_de?=
>> =?UTF-8?Q?_Leonel_Osorio____[_ref:=5F00D0bGaMp.=5F5001PwLV7w:ref_]?=
>> MIME-Version: 1.0
>> Content-Type: multipart/alternative;
>> boundary="----=_Part_14077_1920494717.1570625061936"
>> X-SFDC-LK: 00D0b000000GaMp
>> X-SFDC-User: 0051P000002qxTs
>> X-Sender: postmaster at salesforce.com
>> X-mail_abuse_inquiries: http://www.salesforce.com/company/abuse.jsp
>> X-SFDC-TLS-NoRelay: 1
>> X-SFDC-Binding: 1WrIRBV94myi25uB
>> X-SFDC-EmailCategory: quickActionEmail
>> X-SFDC-EntityId: 5001P00000wLV7w
>> X-SFDC-Interface: internall
>> 
>> 
> FAKE_REPLY_C {
> re = "(Subject=/^R[eE]:/H) & (!((header_exists(References) | header_exists(In-Reply-To)))) & ((X-Mailer=/^Gnus v/H) | (X-Mailer=/^Microsoft Outlook Express 5/H) | (X-Mailer=/^Microsoft Outlook Express 6/H) | (X-Mailer=/^Mozilla 4/H) | (X-Mailer=/^SKYRiXgreen/H) | (X-Mailer=/^WWW-Mail \\d/H) | (User-Agent=/^Gnus/H) | (User-Agent=/^KNode/H) | (User-Agent=/^Mutt/H) | (User-Agent=/^Pan/H) | (User-Agent=/^Xnews/H)) & !(X-Mailer=/^Microsoft Outlook Express 6/H)";
> group = "subject";
> description = "Fake reply (has RE in subject, but has not References header)";
> 
> Regards, Albrecht
> 

Thats good to know.  So many of our work emails meet that criteria. Another rule to disable!