[Ksummit-discuss] If you are using gmail, check your spam folders

[Ksummit-discuss] If you are using gmail, check your spam folders

[Theodore Ts'o]

Hi,

The first round of invites for the kernel summit was sent out over the
weekend.

Unfortunately, it's come to my attention that at least two people who
are using GMail had their invites trapped as spam.  This is despite
the fact that I went to careful lengths to make sure that the
invitation passed both SPF and DKIM checks.  A forwarded message from
Greg K-H from his Gmail spam folder confirmed that whatever got
GMail's anti-spam filters upset, it wasn't SPF or DKIM.  (The From
address was tytso@thunk.org, specifically so the SPF would pass, and
so the SPF identity would == the DKIM identity.)

Sigh.  Maybe there's some Nigerian scam involving inviting people to
Kernel Summits, or some such.  :-(

I'm trying to investigate this internally inside Google, but in the
meantime, if you are using Gmail as your mail reader, plesae check
your spam filters.  I apologize in advance for the inconvenience.

     	  	      		   	   - Ted

Re: [Ksummit-discuss] If you are using gmail, check your spam folders

[Randy Dunlap]

On 06/04/2014 06:06 AM, Theodore Ts'o wrote:
> Hi,
> 
> Unfortunately, it's come to my attention that at least two people who
> are using GMail had their invites trapped as spam.  This is despite
> the fact that I went to careful lengths to make sure that the
> invitation passed both SPF and DKIM checks.  A forwarded message from
> Greg K-H from his Gmail spam folder confirmed that whatever got
> GMail's anti-spam filters upset, it wasn't SPF or DKIM.  (The From
> address was tytso@thunk.org, specifically so the SPF would pass, and
> so the SPF identity would == the DKIM identity.)

I often get rejects from gmail when I reply to email and one of the
Cc:s is torvalds@, akpm@, or gregkh@  linux-foundation.org (which is
using gmail).  It's all bogus AFAIK.  It's just Linux patch-related stuff.

> I'm trying to investigate this internally inside Google, but in the
> meantime, if you are using Gmail as your mail reader, plesae check
> your spam filters.  I apologize in advance for the inconvenience.

Good. Hope that works for you.

-- 
~Randy

Re: [Ksummit-discuss] If you are using gmail, check your spam folders

[Theodore Ts'o]

On Wed, Jun 04, 2014 at 09:18:18AM -0700, Randy Dunlap wrote:
> 
> I often get rejects from gmail when I reply to email and one of the
> Cc:s is torvalds@, akpm@, or gregkh@  linux-foundation.org (which is
> using gmail).  It's all bogus AFAIK.  It's just Linux patch-related stuff.

Are you getting outright rejects, or is it ending up in Linus's spam
folder?  (Which has happened to me with a PULL request, which is why I
set up DKIM....)

In any case, if you get outright rejects, if you can save the full
e-mail (including headers) in a file, and then put it somewhere I can
download it, I'd much appreciate it.  (I've been having false
positives with MIT's Brightmail anti-spam service, so this problem is,
alas, not unique to Gmail.  So if you want to send me samples which
Gmail has rejected as spam, it's better to put it up on a web or ftp
server, and send me the URL.)

If it ends up in a gmail spam folder, it's best if you can get the
recipient to send me the full e-mail, complete with headers.

The reason why the headers are useful is because we can use these to
hopefully send complaints to the anti-SPAM folks and ask them what's
up with their algorithms.  For example, this was bounced by Gmail
despite the SPF and DKIM pass indications:

Received: from imap.thunk.org (imap.thunk.org. [2600:3c02::f03c:91ff:fe96:be03])
        by mx.google.com with ESMTPS id m48si15663526yhl.39.2014.05.31.13.16.22
        for <gregkh@linuxfoundation.org>
        (version=TLSv1.2 cipher=RC4-SHA bits=128/128);
        Sat, 31 May 2014 13:16:22 -0700 (PDT)
Received-SPF: pass (google.com: domain of tytso@thunk.org designates 2600:3c02::f03c:91ff:fe96:be03 as permitted sender) client-ip=2600:3c02::f03c:91ff:fe96:be03;
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of tytso@thunk.org designates 2600:3c02::f03c:91ff:fe96:be03 as permitted sender) smtp.mail=tytso@thunk.org;
       dkim=pass header.i=@thunk.org
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=thunk.org; s=ef5046eb;
	h=Date:Message-Id:To:Reply-To:Subject:From; bh=EYhTkkgyOXFA9DVUyhv3DV8emZh08SW9NRYmxy6b18s=;
	b=XWykrAMWFJTkNFUb4AW2VrdrBu+45vDXNJQqcpADZcb8waUpl02GGfpFQ1qqJ7x6h4kHuB04ah3/7QcINWs1GEByE2Hy35ID/cTTlUtFg9pOEjqbIgoWnfeoKRbp6ZpdxZlK0o6McJcmIJOJN492fVk1UGXnKWR//r5X6RDbuNM=;

      	  	     	   	       	       - Ted

Re: [Ksummit-discuss] If you are using gmail, check your spam folders

[Randy Dunlap]

On 06/04/2014 09:52 AM, Theodore Ts'o wrote:
> On Wed, Jun 04, 2014 at 09:18:18AM -0700, Randy Dunlap wrote:
>>
>> I often get rejects from gmail when I reply to email and one of the
>> Cc:s is torvalds@, akpm@, or gregkh@  linux-foundation.org (which is
>> using gmail).  It's all bogus AFAIK.  It's just Linux patch-related stuff.
> 
> Are you getting outright rejects, or is it ending up in Linus's spam
> folder?  (Which has happened to me with a PULL request, which is why I
> set up DKIM....)

They say: ... this message has been blocked. ...
That's an outright reject?

> In any case, if you get outright rejects, if you can save the full
> e-mail (including headers) in a file, and then put it somewhere I can
> download it, I'd much appreciate it.  (I've been having false
> positives with MIT's Brightmail anti-spam service, so this problem is,
> alas, not unique to Gmail.  So if you want to send me samples which
> Gmail has rejected as spam, it's better to put it up on a web or ftp
> server, and send me the URL.)

I'll do that now and send you the URLs.

> If it ends up in a gmail spam folder, it's best if you can get the
> recipient to send me the full e-mail, complete with headers.
> 
> The reason why the headers are useful is because we can use these to
> hopefully send complaints to the anti-SPAM folks and ask them what's
> up with their algorithms.  For example, this was bounced by Gmail
> despite the SPF and DKIM pass indications:

Thanks for your help.

-- 
~Randy

Re: [Ksummit-discuss] If you are using gmail, check your spam folders

[Greg KH]

On Wed, Jun 04, 2014 at 09:11:50PM -0700, Randy Dunlap wrote:
> On 06/04/2014 09:52 AM, Theodore Ts'o wrote:
> > On Wed, Jun 04, 2014 at 09:18:18AM -0700, Randy Dunlap wrote:
> >>
> >> I often get rejects from gmail when I reply to email and one of the
> >> Cc:s is torvalds@, akpm@, or gregkh@  linux-foundation.org (which is
> >> using gmail).  It's all bogus AFAIK.  It's just Linux patch-related stuff.
> > 
> > Are you getting outright rejects, or is it ending up in Linus's spam
> > folder?  (Which has happened to me with a PULL request, which is why I
> > set up DKIM....)
> 
> They say: ... this message has been blocked. ...
> That's an outright reject?

That not good at all, and is strange, and not something that I want to
see on my end.

Try sending me email directly to my lf.org account.  If it bounces, send
me the full headers to this account and I'll work with the lf.org admins
to figure it out.

thanks,

greg k-h

Re: [Ksummit-discuss] If you are using gmail, check your spam folders

[Theodore Ts'o]

On Wed, Jun 04, 2014 at 09:40:40PM -0700, Greg KH wrote:
> That not good at all, and is strange, and not something that I want to
> see on my end.
> 
> Try sending me email directly to my lf.org account.  If it bounces, send
> me the full headers to this account and I'll work with the lf.org admins
> to figure it out.

I'vve lookedat the blocked messages which Randy sent me, and that's
something yet something else.  This particular issue is specific to
infradead.org:

  torvalds@linux-foundation.org
    SMTP error from remote mail server after end of data:
    host ASPMX.L.GOOGLE.COM [2607:f8b0:4001:c05::1b]:
    550-5.7.1 [2001:4978:20e::2      12] Our system has detected that this message
    550-5.7.1 is likely unsolicited mail. To reduce the amount of spam sent to
    550-5.7.1 Gmail, this message has been blocked. Please visit
    550-5.7.1 http://support.google.com/mail/bin/answer.py?hl=en&answer=188131 for
    550 5.7.1 more information. z2si16384135icq.90 - gsmtp
  akpm@linux-foundation.org

Doing a quick check, courtesy of http://mxtoolbox.com/blacklists.aspx,
it looks like merlin.infradead.org is on the SORBS spam list:

Problem hostnames/domains (could cause email problems.)
2 "Spamvertised" entries [22:09:23 01 Nov 2011 GMT+00].	
205.233.59.134 - 2 entries [22:09:23 01 Nov 2011 GMT+00].	

For more details, you might want to check:

	http://www.sorbs.net/delisting/overview.shtml

It looks like in November of last year, one of SORBS spamtraps
received spam mail sent from infradead.org.  You might try submitting
a delisting request to SORBS.  This might hopefully solve the problem.

  	    	       	       	    - Ted

Re: [Ksummit-discuss] If you are using gmail, check your spam folders

[David Woodhouse]

[-- Attachment #1: Type: text/plain, Size: 668 bytes --]

On Thu, 2014-06-05 at 08:33 -0400, Theodore Ts'o wrote:
> 
> It looks like in November of last year, one of SORBS spamtraps
> received spam mail sent from infradead.org. 

At that point, merlin was lists.infradead.org. We do a fairly good job
of keeping spam off the lists, but some gets through.

>  You might try submitting a delisting request to SORBS.  This might
> hopefully solve the problem.

I've done so; thanks.

In the meantime, Randy, you ought to be able to use other hosts in the
cluster for outbound SMTP. I note that the 'smtpauth.infradead.org' rôle
address doesn't even include merlin's IP addresses at the moment...


-- 
dwmw2

[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 5745 bytes --]

Re: [Ksummit-discuss] If you are using gmail, check your spam folders

[Randy Dunlap]

On 06/05/2014 05:33 AM, Theodore Ts'o wrote:
> On Wed, Jun 04, 2014 at 09:40:40PM -0700, Greg KH wrote:
>> That not good at all, and is strange, and not something that I want to
>> see on my end.
>>
>> Try sending me email directly to my lf.org account.  If it bounces, send
>> me the full headers to this account and I'll work with the lf.org admins
>> to figure it out.
> 
> I'vve lookedat the blocked messages which Randy sent me, and that's
> something yet something else.  This particular issue is specific to
> infradead.org:

Thanks for your help, Ted, Greg, and David.

-- 
~Randy

Re: [Ksummit-discuss] If you are using gmail, check your spam folders

[David Woodhouse]

[-- Attachment #1: Type: text/plain, Size: 1303 bytes --]

On Thu, 2014-06-05 at 08:33 -0400, Theodore Ts'o wrote:
> 
>   torvalds@linux-foundation.org
>     SMTP error from remote mail server after end of data:
>     host ASPMX.L.GOOGLE.COM [2607:f8b0:4001:c05::1b]:
>     550-5.7.1 [2001:4978:20e::2      12] Our system has detected that this message
>     550-5.7.1 is likely unsolicited mail. To reduce the amount of spam sent to
>     550-5.7.1 Gmail, this message has been blocked. Please visit
>     550-5.7.1 http://support.google.com/mail/bin/answer.py?hl=en&answer=188131 for
>     550 5.7.1 more information. z2si16384135icq.90 - gsmtp
>   akpm@linux-foundation.org
> 
> Doing a quick check, courtesy of http://mxtoolbox.com/blacklists.aspx,
> it looks like merlin.infradead.org is on the SORBS spam list:
> 
> Problem hostnames/domains (could cause email problems.)
> 2 "Spamvertised" entries [22:09:23 01 Nov 2011 GMT+00]. 
> 205.233.59.134 - 2 entries [22:09:23 01 Nov 2011 GMT+00].   

Those are historical listings from 2011, not from last year. They are
not currently active, and shouldn't have been relevant. The host wasn't
listed in the blacklist.

If you ever get a response from the gmail side of the house, an
explanation of why Randy's email was rejected would still be much
appreciated; thanks.

-- 
dwmw2


[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 5745 bytes --]

Re: [Ksummit-discuss] If you are using gmail, check your spam folders

[James Bottomley]

On Wed, 2014-06-04 at 09:06 -0400, Theodore Ts'o wrote:
> Hi,
> 
> The first round of invites for the kernel summit was sent out over the
> weekend.
> 
> Unfortunately, it's come to my attention that at least two people who
> are using GMail had their invites trapped as spam.  This is despite
> the fact that I went to careful lengths to make sure that the
> invitation passed both SPF and DKIM checks.  A forwarded message from
> Greg K-H from his Gmail spam folder confirmed that whatever got
> GMail's anti-spam filters upset, it wasn't SPF or DKIM.  (The From
> address was tytso@thunk.org, specifically so the SPF would pass, and
> so the SPF identity would == the DKIM identity.)
> 
> Sigh.  Maybe there's some Nigerian scam involving inviting people to
> Kernel Summits, or some such.  :-(
> 
> I'm trying to investigate this internally inside Google, but in the
> meantime, if you are using Gmail as your mail reader, plesae check
> your spam filters.  I apologize in advance for the inconvenience.

I don't know if it helps, but my pull requests used to end up in Linus
spam folder on gmail before he added a specific whitelist for me.  I've
not really had trouble with other peoples' gmail addresses (that I know
of).

There are a lot of stupid spam filters out there.  The parallels one is
exchange based and it seems to classify a lot of open source related
stuff as spam (mostly patches), which is why I mostly miss things if
they don't go to the right mailing lists (I keep all my mailing list
subscriptions on hansenpartnership.com which uses spamassassin and
greylisting).

I did discover a while ago that lots of companies selling "spam"
services are completely unreliable.  Novell used to use one (forget
which) for groupwise.  It had a "this is spam" tag on the netblock of
the colo the hansenpartnership.com server was located in, however, none
of their removal procedures actually worked ... not even contacting the
company directly from a novell.com email worked ... they were only
interested in collecting money for providing a dubious service, not
actually in improving their service ...

The problem with these private services is that it's very hard to tell
if you're listed (I had to get the novell admin to diagnose) and it's
impossible to get removed if you do.  Ted you might like to check if
google has any inputs other than the ones
http://mxtoolbox.com/blacklists.aspx knows about.

James