Re: [Nmh-workers] Emails being tagged as spam -- NMH solution???

[Bob Carragher]

On Mon, 02 Mar 2015 20:57:10 -0500 Ken Hornstein <address@hidden> sez:

> >     Re: [SPAM:#####] <original-subject>
> >
> >with the number of "#"s indicating how strongly the tagging is.
> >(This had happened previously, but the number of "#"s never
> >exceeded 3.) Also, their list servers are now silently rejecting
> >my posts, whereas that had never occurred previously.  (If I
> >switch back to using sendmail, then the posts go through to the
> >mailing lists.)
> 
> It looks like Stanford uses Proofpoint:
> 
> https://itservices.stanford.edu/service/emailcalendar/email/spam/antispam
> 
> And there should be a X-Proofpoint-Spam-Details header that
> should give you some information.  But a quick Googling
> suggests to me that Proofpoint is notoriously stingy on what
> those things mean.

Yep!  Here's 1 set from the header of the above message:

     X-Proofpoint-Virus-Version: vendor=fsecure 
engine=2.50.10432:5.13.68,1.0.33,0.0.0000
      definitions=2015-03-01_03:2015-02-27,2015-03-01,1970-01-01 signatures=0
     X-Proofpoint-Spam-Details: rule=spam policy=default score=99 spamscore=99 
suspectscore=7 phishscore=0
      adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1
      engine=7.0.1-1402240000 definitions=main-1503010244

It's pretty clear why they tagged my message with 5 "#"s.

There are three occurrences of the following, associated with
Received: entries, in the header:

     (No client certificate requested)

I'm guessing that those are harmless.

There's also an "spf=softfail" in there.

     Authentication-Results: mx.google.com <http://mx.google.com>;
            spf=softfail (google.com <http://google.com>: domain of 
transitioning address@hidden <address@hidden> does not designate 171.67.219.78 
as permitted sender) address@hidden <address@hidden>;
            dkim=fail address@hidden <http://gmail.com>;
            dmarc=fail (p=NONE dis=NONE) header.from=gmail.com 
<http://gmail.com>

Note that 171.67.219.78 is smtp-grey.stanford.edu.

Might this be the smoking gun?

                                Bob