[Rspamd-Users] weird MIME penalisation on (IMO) right formated mail attachments - RSPAMD or our mistake?
Franta Hanzlík
franta at hanzlici.cz
Mon Apr 14 15:02:28 UTC 2025
At our high school we have now problem with internal mail delivery -
emails from students with the completion of assigned tasks are not
delivered because of poor RSPAMD classification.
As example in attachment is email to the teacher, where three homework
files are attached - their MIME types are .js, .html and .css - where
important penalisation are:
MIME_BAD_EXTENSION - highest penalty (although legitimate attachments)
MIME_BAD_ATTACHMENT - ?WHY penalty? According to RFC9239 .js MUST be text/javascript type. RSPAMD bug?
MIME_BASE64_TEXT_BOGUS - true for attachment "dolezali.css" - but it
is as mail client (SOGo webmail) attached it)
R_MIXED_CHARSET - ?WHY penalty? For "Subject:" header value? But it is only in ASCII!
MID_RHS_NOT_FQDN - IMO this is because of internal mail within our domain...
Please, what is best solution for email reliable delivery in cases as
these?
Non-delivery of an email with a student's completed homework is
a serious problem for us...
Attached are email source as 'postcat -q $MID' output and from base64
decoded attachments (mail addresses and domain are very slightly changed).
RSPAMD classification is as follows:
2025-04-01 09:14:00 #23604(rspamd_proxy) <ae75e7>; proxy; rspamd_task_write_log:
id: <22a0-67eb9200-97-199599a0 at 203688857>, qid: <>, ip: 127.0.0.1,
FROM: <dolezali at spseplzen.cy>, RCPT: <soukuo at spseplzen.cy>,
CFrom:Iakub Doležal <dolezali at spseplzen.cy>, CTo: Matěj Soukuo (vyučující) <soukuo at spseplzen.cy>, CCc:nil,
CSubj:dolezali - test,
(default: T (quarantine): [12.14/16.00] [
MIME_BAD_EXTENSION(8.00){js;html;} # 1/20 : Bad extension
MIME_BAD_ATTACHMENT(1.60){js:text/javascript;} # 2/20 : Invalid attachment mime type
MIME_BASE64_TEXT_BOGUS(1.00){} # 3/20 : Has text part encoded in base64 that does not contain any 8bit characters
R_MIXED_CHARSET(1.00){subject;} # 4/20 : Mixed characters in a message
MID_RHS_NOT_FQDN(0.50){} # 5/20 : the Message-ID does not contain a fully qualified domain name (fqdn).
MIME_BASE64_TEXT(0.10){} # 6/20 : Has text part encoded in base64
BAYES_SPAM(0.04){52.89%;} # 8/20 : Message probably spam, probability
MIME_GOOD(-0.10){multipart/mixed;multipart/alternative;text/plain;text/javascript;} # 7/20 : Known content-type
ARC_NA(0.00){} # 9/20 : ARC signature absent
DKIM_SIGNED(0.00){spseplzen.cy:s=default;} # 10/20 : message has a DKIM signature (without prejudging its validity)
FROM_EQ_ENVFROM(0.00){} # 11/20 : From address is the same as the envelope
FROM_HAS_DN(0.00){} # 12/20 : From header has a display name
HAS_ATTACHMENT(0.00){} # 13/20 : Message contains attachments
MIME_TRACE(0.00){0:+;1:+;2:+;3:~;4:-;4:+;5:-;5:~;...;} # 14/20 : something to do with MIME types, but I do not know what exactly
NEURAL_SPAM(0.00){1.000;} # 15/20 : ?_what is it supposed to be_? ?_what set it_?
RCPT_COUNT_ONE(0.00){1;} # 16/20 : a single recipient
RCVD_COUNT_ZERO(0.00){0;} # 17/20 : Message has no Received headers
TO_DN_ALL(0.00){} # 18/20 : All the recipients have display names
TO_DOM_EQ_FROM_DOM(0.00){} # 19/20 : To domain is the same as From domain
TO_MATCH_ENVRCPT_ALL(0.00){} # 20/20 : All of the recipients match the envelope
]
), len: 4657, time: 4019.702ms, dns req: 3, digest: <f33227080d4fee9afaacdf37a1e0b828>
(Or a one-line, less readable original from the RSPAMD log:
2025-04-01 09:14:00 #23604(rspamd_proxy) <ae75e7>; proxy; rspamd_task_write_log: id: <22a0-67eb9200-97-199599a0 at 203688857>, qid: <D3F3544015>, ip: 127.0.0.1, FROM: <dolezali at spseplzen.cy>, RCPT: <soukuo at spseplzen.cy>, CFrom:Iakub Doležal <dolezali at spseplzen.cy>, CTo: Matěj Soukuo (vyučující) <soukuo at spseplzen.cy>, CCc:nil, CSubj:dolezali - test,\
(default: T (quarantine): [12.14/16.00] [MIME_BAD_EXTENSION(8.00){js;html;},MIME_BAD_ATTACHMENT(1.60){js:text/javascript;},MIME_BASE64_TEXT_BOGUS(1.00){},R_MIXED_CHARSET(1.00){subject;},MID_RHS_NOT_FQDN(0.50){},MIME_BASE64_TEXT(0.10){},MIME_GOOD(-0.10){multipart/mixed;multipart/alternative;text/plain;text/javascript;},BAYES_SPAM(0.04){52.89%;},\
ARC_NA(0.00){},DKIM_SIGNED(0.00){spseplzen.cy:s=default;},FROM_EQ_ENVFROM(0.00){},FROM_HAS_DN(0.00){},HAS_ATTACHMENT(0.00){},MIME_TRACE(0.00){0:+;1:+;2:+;3:~;4:-;4:+;5:-;5:~;...;},NEURAL_SPAM(0.00){1.000;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ZERO(0.00){0;},TO_DN_ALL(0.00){},TO_DOM_EQ_FROM_DOM(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){}]), len: 4657, time: 4019.702ms, dns req: 3, digest: <f33227080d4fee9afaacdf37a1e0b828>
)
--
Thanks in advance, Franta Hanzlík
-------------- next part --------------
An embedded message was scrubbed...
From: unknown sender
Subject: no subject
Date: no date
Size: 6480
URL: <https://lists.rspamd.com/pipermail/users/attachments/20250414/23b72028/attachment.eml>
-------------- next part --------------
body {
background-color: lightgray;
margin-left: 725px;
margin-top: 100px;
}
h1 {
font-family: 'Gill Sans', 'Gill Sans MT', Calibri, 'Trebuchet MS', sans-serif;
}
input {
height: 30px;
width: 400px;
margin-bottom: 5px;
border: 1px solid black;
border-radius: 5px;
}
button {
padding: 10px 20px;
border: 1px solid black;
border-radius: 5px;
background-color: lightskyblue;
margin-left: 155px;
margin-top: 10px;
}
button:hover {
background-color: lightblue;
cursor: pointer;
}
p {
font-family: 'Gill Sans', 'Gill Sans MT', Calibri, 'Trebuchet MS', sans-serif;
font-size: 18px;
margin-left: 180px;
}
-------------- next part --------------
function vypocitat() {
let napeti = document.getElementById("U").value;
let proud = document.getElementById("I").value;
let odpor = document.getElementById("R").value;
let vykon = document.getElementById("P").value;
if (napeti === "0") {
vykon = (proud*proud*odpor);
document.getElementById("P").innerHTML = "Výkon: " + vykon + "W";
}
if (proud === "0") {
vykon = (napeti*napeti/odpor);
document.getElementById("P").innerHTML = "Výkon: " + vykon + "W";
}
if (odpor === "0") {
vykon = (napeti*proud);
document.getElementById("P").innerHTML = "Výkon: " + vykon + "W";
}
else {
vykon = (napeti*proud);
document.getElementById("P").innerHTML = "Výkon: " + vykon + "W";
}
}
More information about the Users
mailing list