{"action":"created","issue":{"url":"https://api.github.com/repos/vstakhov/rspamd/issues/902","repository_url":"https://api.github.com/repos/vstakhov/rspamd","labels_url":"https://api.github.com/repos/vstakhov/rspamd/issues/902/labels{/name}","comments_url":"https://api.github.com/repos/vstakhov/rspamd/issues/902/comments","events_url":"https://api.github.com/repos/vstakhov/rspamd/issues/902/events","html_url":"https://github.com/vstakhov/rspamd/issues/902","id":173645611,"number":902,"title":"EXCESS_BASE64","user":{"login":"rpv-tomsk","id":13328211,"avatar_url":"https://avatars.githubusercontent.com/u/13328211?v=3","gravatar_id":"","url":"https://api.github.com/users/rpv-tomsk","html_url":"https://github.com/rpv-tomsk","followers_url":"https://api.github.com/users/rpv-tomsk/followers","following_url":"https://api.github.com/users/rpv-tomsk/following{/other_user}","gists_url":"https://api.github.com/users/rpv-tomsk/gists{/gist_id}","starred_url":"https://api.github.com/users/rpv-tomsk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rpv-tomsk/subscriptions","organizations_url":"https://api.github.com/users/rpv-tomsk/orgs","repos_url":"https://api.github.com/users/rpv-tomsk/repos","events_url":"https://api.github.com/users/rpv-tomsk/events{/privacy}","received_events_url":"https://api.github.com/users/rpv-tomsk/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-08-28T13:00:09Z","updated_at":"2016-08-28T14:10:11Z","closed_at":null,"body":"Hi!\r\n\r\nI have an email with the following headers:\r\n\r\n```\r\nFrom: =?UTF-8?B?R29vZHdpbiBDaW5lbWE=?= <USERNAME1@bk.ru>\r\nTo: =?UTF-8?B?ZGo=?= <dj@domain.tld>\r\nSubject: =?UTF-8?B?RndkOiA=?=\r\nMIME-Version: 1.0\r\nX-Mailer: Mail.Ru Mailer 1.0\r\nX-Originating-IP: [195.206.53.54]\r\nDate: Sun, 28 Aug 2016 09:09:57 +0300\r\nReply-To: =?UTF-8?B?R29vZHdpbiBDaW5lbWE=?= <USERNAME1@bk.ru>\r\nX-Priority: 3 (Normal)\r\nMessage-ID: <1472364597.464828483@f49.i.mail.ru>\r\nContent-Type: multipart/mixed;\r\n\tboundary=\"----q8cqDo4P0R2K8OND2o35hfkzXKCANlMC-quAXU0e8FkVWQitR-1472364597\"\r\nX-Mailru-Sender: 68F6BD668818CD2CEE6E9FD2A8433876B53BD1FE7A6A39AD112F1BAEC09DDF52535B054CEE07E02E660823B2EEFD31DC\r\nX-Mras: OK\r\nX-Spam: yes\r\n```\r\n\r\nThat headers produces scores:\r\n\r\n```\r\n2016-08-28 13:20:14 #10875(normal) <62f256>; task; rspamd_task_write_log: id: <1472364597.464828483@f49.i.mail.ru>, qid: <67B85180066>, ip: 94.100.181.253, from: <vozvrat_goodwin@bk.ru>, (default: F (add header): [7.73/15.00] [RECEIVED_SPAMHAUS_XBL(3.00),FROM_EXCESS_BASE64(1.50),REPLYTO_EXCESS_BASE64(1.50),TO_EXCESS_BASE64(1.50),BAYES_SPAM(0.73),R_DKIM_ALLOW(-0.20),R_SPF_ALLOW(-0.20),MIME_GOOD(-0.10),RCVD_IN_DNSWL_LOW(0.00)]), len: 835506, time: 491.995ms real, 18.702ms virtual, dns req: 26\r\n```\r\n\r\nThe  `FROM_EXCESS_BASE64(1.50),REPLYTO_EXCESS_BASE64(1.50),TO_EXCESS_BASE64(1.50)` \r\n\r\ncombination looks too strong. \r\n\r\nWhat is the correct way to reduce such scores?"},"comment":{"url":"https://api.github.com/repos/vstakhov/rspamd/issues/comments/242976907","html_url":"https://github.com/vstakhov/rspamd/issues/902#issuecomment-242976907","issue_url":"https://api.github.com/repos/vstakhov/rspamd/issues/902","id":242976907,"user":{"login":"moisseev","id":2275981,"avatar_url":"https://avatars.githubusercontent.com/u/2275981?v=3","gravatar_id":"","url":"https://api.github.com/users/moisseev","html_url":"https://github.com/moisseev","followers_url":"https://api.github.com/users/moisseev/followers","following_url":"https://api.github.com/users/moisseev/following{/other_user}","gists_url":"https://api.github.com/users/moisseev/gists{/gist_id}","starred_url":"https://api.github.com/users/moisseev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/moisseev/subscriptions","organizations_url":"https://api.github.com/users/moisseev/orgs","repos_url":"https://api.github.com/users/moisseev/repos","events_url":"https://api.github.com/users/moisseev/events{/privacy}","received_events_url":"https://api.github.com/users/moisseev/received_events","type":"User","site_admin":false},"created_at":"2016-08-28T14:10:11Z","updated_at":"2016-08-28T14:10:11Z","body":"Yes, mail.ru encodes in base64 everything. I'm using `settings`.\r\n\r\nrspamd.conf.local:\r\n~~~nginx\r\nsettings {\r\n    base64_mail_ru {\r\n        priority = high;\r\n        from = \"@mail.ru\";\r\n        from = \"@inbox.ru\";\r\n        from = \"@list.ru\";\r\n        from = \"@bk.ru\";\r\n        apply \"default\" {\r\n            REPLYTO_EXCESS_BASE64  = 0.0;\r\n            FROM_EXCESS_BASE64     = 0.0;\r\n            TO_EXCESS_BASE64       = 0.0;\r\n        }\r\n    }\r\n}\r\n~~~\r\n@fatalbanana could you please post a composites example for this particular case?"}}
{"actor":{"display_login":"moisseev"}}