Jump to content

Error message : This email contains no date


Freddie

Recommended Posts

  • Replies 79
  • Created
  • Last Reply
Since yesterday, I get this error message when pasting spam : This email contains no date

It would appear that your "(LogSat Software SMTP Server - Unlicensed Evaluation Copy)" is really hosed ... the "only" date line in a Received: line is tossed out as trash ...

Received: from 69.21.205.165 by (LogSat Software SMTP Server - Unlicensed Evaluation Copy) Sat, 27 May 2006 06:32:26 +0200

Invalid "received by"

Therefore, no way to make a call as to the age of this spam .. and therefore .. "nothing to do" ...

From http://www.logsat.com/sfi-spam-filter-download.asp

"The only license indicators are on the application itself and in the SMTP header it adds to emails."

And as it "is a Proxy" .... is it that it replaced existing header lines, dropped existing header lines, didn't display the full header, the whole header wasn't copied ....????? only you can answer / provide the details ... compare the headers of other e-mail received a few days ago ... what changed?

Link to comment
Share on other sites

I've been getting the same error message and no reports filed for the last few days.

I'm using sendmail 8.12.11 on RedHat Linux ES 3. Nothing has changed in mail for months.

Here are the actual headers

Return-Path: <unbcmfbco[at]cern.ch>

Received: from homepc (any212.neoplus.adsl.tpnet.pl [83.26.106.212])

by planter.areeda.com (8.12.11.20060308/8.12.11) with SMTP id k4RL8JcG025862

for <xxx[at]areeda.com>; Sat, 27 May 2006 14:08:21 -0700

Message-ID: <001301c681d1$ac854180$d46a1a53[at]homepc>

From: "Smallwood Noemi" <unbcmfbco[at]cern.ch>

To: xxx[at]areeda.com

Subject: wlmzhxu

Date: Sat, 27 May 2006 23:08:16 -0000

MIME-Version: 1.0

Content-Type: multipart/related;

type="multipart/alternative";

boundary="----=_NextPart_000_000F_01C681E2.700E1180"

Here's what report http://www.spamcop.net/sc?id=z955857363zff...df3003323415bfz says

Received: from homepc (any212.neoplus.adsl.tpnet.pl [83.26.106.212]) by planter.areeda.com (8.12.11.20060308/8.12.11) with SMTP id k4RL8JcG025862

83.26.106.212 found

host 83.26.106.212 = any212.neoplus.adsl.tpnet.pl. (cached)

.

.

.

This email contains no date

Message is old

Any suggestions?

Thanks

Joe

Link to comment
Share on other sites

While you claim that the original had a date/time included, the "View Source" link fails to confirm this. How did you submit this message for reporting?

Messages are submitted for quick reporting using perl scripts that strip off the spamassassin headers and forward the attached message. While they are my scripts and may have errors they essentially extract the attached message forward them and save the message in the SpamReported folder. Any errors would affect the first and last lines I would expect not delete lines from the interior. These scripts have not been touched for well over 18 months and this error started this week.

Perhaps a way to prove they are working would be to copy myself on a report. I'll do that and report back.

Joe

Link to comment
Share on other sites

Messages are submitted for quick reporting using perl scripts that strip off the spamassassin headers and forward the attached message. While they are my scripts and may have errors they essentially extract the attached message forward them and save the message in the SpamReported folder. Any errors would affect the first and last lines I would expect not delete lines from the interior. These scripts have not been touched for well over 18 months and this error started this week.

Perhaps a way to prove they are working would be to copy myself on a report. I'll do that and report back.

OK I give up, it was my bug. I added code (and didn't put it in the changelog) that only reports spam less than 3 hrs old. Evidently that just got detected.

Thanks for the help.

Joe

Link to comment
Share on other sites

Messages are submitted for quick reporting using perl scripts that strip off the spamassassin headers and forward the attached message.

Thanks for clearing the air ... blew an hour plus, made a couple of phone calls, crashed this system twice ... trying to figure out the whys and wherefores of a ".ch" e-mail addressed item being served through a 'customer' DSL line on a ".pl" system doing a 'direct-to-MX' connection to a system in California, U.S. ... advertising a "new" Domain / URL registered with an outfit that makes all kinds of wild and goofy claims about its service and 'special' features ... the DNS records on that Domain are a complete disaster ...

and why your system wouldn't be helping out by applying its own time/date stamp somewhere ....

and as in the previous case, the submitted spam is not in fact whole and complete ....

OK I give up, it was my bug. I added code (and didn't put it in the changelog) that only reports spam less than 3 hrs old. Evidently that just got detected.

Makes little sense, does not apply, something else is / was involved .... "3 hours" does not compute anywhere other than the "Yum fresh" .. action results in the parser output

Link to comment
Share on other sites

and as in the previous case, the submitted spam is not in fact whole and complete ....

It was my fault, I apologize. Sorry for having you chase a red herring that turns out to be my bug. I appreciate the work you put in on my problem.

Makes little sense, does not apply, something else is / was involved .... "3 hours" does not compute anywhere other than the "Yum fresh" .. action results in the parser output

I added a 3 hr age limit to what I report in order to make the reports more timely. It's an arbitrary number, I figured old reports are probably less useful.

The way my scripts work if spamassassin identifies it as definetely spam score > 6 it goes into the auto reporting bin. If it is borderline 5< score < 6 it gets manually checked. Manually checked and false positives go to separate folders. Looks like spamassassin has about 5% false negative rate and way less than 1% false positive at least in my situation.

Joe

Link to comment
Share on other sites

It was my fault, I apologize. Sorry for having you chase a red herring that turns out to be my bug. I appreciate the work you put in on my problem.

I tried three times to make a fairly large post with the data gathered .. turns out that my ISP was doing some unannounced (well, they never announce it...) maintenance ... I gave up on posting all the data ..

I added a 3 hr age limit to what I report in order to make the reports more timely. It's an arbitrary number, I figured old reports are probably less useful.

That's all well and good, but .. doesn't explain the missing time/date bits in the Received lines ...

Link to comment
Share on other sites

It would appear that your "(LogSat Software SMTP Server - Unlicensed Evaluation Copy)" is really hosed ... the "only" date line in a Received: line is tossed out as trash ...

Received: from 69.21.205.165 by (LogSat Software SMTP Server - Unlicensed Evaluation Copy) Sat, 27 May 2006 06:32:26 +0200

Invalid "received by"

Therefore, no way to make a call as to the age of this spam .. and therefore .. "nothing to do" ...

From http://www.logsat.com/sfi-spam-filter-download.asp

"The only license indicators are on the application itself and in the SMTP header it adds to emails."

And as it "is a Proxy" .... is it that it replaced existing header lines, dropped existing header lines, didn't display the full header, the whole header wasn't copied ....????? only you can answer / provide the details ... compare the headers of other e-mail received a few days ago ... what changed?

I have been using this for quite a while and I have not changed anything for a long time and suddenly this problem started. Until recently, everything was working perfectly. Since I didnt change anything, I assume something has been changed at your end

Nobody else having similar problems ?

Link to comment
Share on other sites

That's all well and good, but .. doesn't explain the missing time/date bits in the Received lines ...

Sorry I wasn't clear. It was due to a bug in my perl scri_pt that couldn't possibly delete lines from the middle but it did.

It's fixed now and my reports are going through.

Joe

Link to comment
Share on other sites

I have been using this for quite a while and I have not changed anything for a long time and suddenly this problem started. Until recently, everything was working perfectly. Since I didnt change anything, I assume something has been changed at your end

I made some aqssumptions just the other day, had to admit the mistakes made in overlooking the ovbious.

Nobody else having similar problems ?

Thi must be a bit of a rhetorical question, right? No other Forum Topics on the same subject, the other poster in the same discussion with the same issue having already pointed to an error in a scri_pt involved ....

Did you compare old stuff vice new to see what the difference was .... ????

Link to comment
Share on other sites

I get the same error. I use cut and paste from Outlook Express(properties/details/messagesource). This is the header:

Received: for <xxx.at.sezampro.yu>

Received: from ip5653367e.direct-adsl.nl [86.83.54.126] by SezamPro with SMTP on Sun, 28 May 2006 22:28:32 +0200

From: "Joesph" <Antonioosn6[at]usagimail.com>

To: <xxxyyy.at.sezampro.yu>

Subject: sttock market analysis for beneficial cooperation - C T X E

Date: Sun, 28 May 2006 22:25:56 -0100

MIME-Version: 1.0

X-Mailer: Microsoft Office Outlook, Build 11.0.5510

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

Thread-Index: lFrpG4SRFbiNaIblPiwZYQ5qsKYuUMZXV0qw

Content-Type: text/plain;

charset="Windows-1251"

Content-Transfer-Encoding: 7bit

X-Antivirus: AVG for E-mail 7.1.394 [268.7.2/349]

and this is the error

SpamCop v 1.573.2.1 Copyright © 1998-2005, IronPort Systems, Inc. All rights reserved.

...

Received: for <xxx.at.sezampro.yu>

Received: from ip5653367e.direct-adsl.nl [86.83.54.126] by SezamPro with SMTP on Sun, 28 May 2006 22:28:32 +0200

...

View entire message

Parsing header:

...

Received: from ip5653367e.direct-adsl.nl [86.83.54.126] by SezamPro with SMTP on Sun, 28 May 2006 22:28:32 +0200

86.83.54.126 found

host 86.83.54.126 = ip5653367e.direct-adsl.nl (cached)

...

This email contains no date

Message is old

86.83.54.126 not listed in dnsbl.njabl.org

...

Link to comment
Share on other sites

I get the same error. I use cut and paste from Outlook Express(properties/details/messagesource). This is the header:

The question is: where is the Tracking URL?????? ... such that this much screen space is not consumed, the wondering what got 'touched' due to the whitespace issues of this application, and the actual content of the actual submittal as seen by the parser, etc., tc., etc.

Have you turned on "Show Full/Technical details" on your account yet to see "all" the parsng output yourself?

Compare your sample line (yet again, the only Received line showing, but totally different players from your last sample, but no explanation ...?????) to the following samples;

Received: from ip5653367e.direct-adsl.nl [86.83.54.126] by SezamPro with SMTP on Sun, 28 May 2006 22:28:32 +0200

Received: from c60.cesmail.net (c60.cesmail.net [216.154.195.49])
		by mx.gmail.com with ESMTP id i17si1671394wxd.2006.05.27.17.17.48;
		Sat, 27 May 2006 17:17:48 -0700 (PDT)

Received: from mediacom.knotice.com ([198.87.1.180])
		  by sccqmxc96.asp.att.net (sccqmxc96) with SMTP
		  id &lt;20060428213358q9600q1mipe&gt;; Fri, 28 Apr 2006 21:33:58 +0000

Received: from  (sccqloc01-qfe1.ops.asp.att.net[192.168.203.54])
		  by sccmmhc91.asp.att.net (sccmmhc91) with SMTP
		  id &lt;20060321180407adm1795301e&gt;; Tue, 21 Mar 2006 18:54:05 +0000

There's a number of differences .. and yet, the question I have asked twice now still hasn't been touched ... how does the current e-mail header content compare with that from a few days back "when things worked" ...???

Link to comment
Share on other sites

Received: from 3Cust40.VR1.LAX4.broadband.uu.net [63.13.242.40] by SezamPro with SMTP on Sun, 28 May 2006 22:27:03 +0200

is not working ('This email contains no date')

http://www.spamcop.net/sc?id=z957177498z05...c209a52e6b1748z

Received: from 3Cust40.VR1.LAX4.broadband.uu.net [63.13.242.40] by SezamPro with SMTP; Sun, 28 May 2006 22:27:03 +0200

is working

http://www.spamcop.net/sc?id=z957180765za4...ae1e6054fdc998z

My provider was using '...with SMTP on Sun, 28 May...' before and reporting worked fine.

Link to comment
Share on other sites

My provider was using '...with SMTP on Sun, 28 May...' before and reporting worked fine.

RFC 2822

2.2. Header Fields

Header fields are lines composed of a field name, followed by a colon

(":"), followed by a field body, and terminated by CRLF.

(Then one jumps down to Section 3 and tear through all that data ...)

3.6.7. Trace fields

The trace fields are a group of header fields consisting of an

optional "Return-Path:" field, and one or more "Received:" fields.

The "Return-Path:" header field contains a pair of angle brackets

that enclose an optional addr-spec. The "Received:" field contains a

(possibly empty) list of name/value pairs followed by a semicolon and

a date-time specification. .....

The point is, you've offered the demonstration of what works and what doesn't, just as in the examples I offered ... The SpamCop.net parser is much more strict about the details.

Followed by the commonly known fact that the SpamCop.net parser is under constant revision, primarily due to the spammers' continuing attempts at defeating it .....

Link to comment
Share on other sites

I have been using this for quite a while and I have not changed anything for a long time and suddenly this problem started. Until recently, everything was working perfectly. Since I didnt change anything, I assume something has been changed at your end

Nobody else having similar problems ?

From Freddy's post

Freddie,

Apparently, at least two people have had problems. Perhaps someone will correct my understanding of what happened.

One person did change something on his end. The other person didn't change anything.

The problem for the second person seems to be that the parser is no longer tolerant of headers that do not strictly follow RFCs concerning the date. The parser code is constantly tweaked to keep ahead of the spammers. This time when they tweaked it, the code insists on RFC compliant headers to recognize the date. This change may not have been intentional.

Your problem may be something entirely different. Your ISP may have changed something in the headers without your knowledge. Or your ISP may be using headers that don't strictly follow RFCs. Even if it is a change on spamcop's part, it is not a problem for most people.

A Tracking URL of when it was working compared to the one that is entirely messed up might shed some light on what has happened.

Miss Betsy

Link to comment
Share on other sites

The problem for the second person seems to be that the parser is no longer tolerant of headers that do not strictly follow RFCs concerning the date. The parser code is constantly tweaked to keep ahead of the spammers. This time when they tweaked it, the code insists on RFC compliant headers to recognize the date. This change may not have been intentional.

Your problem may be something entirely different. Your ISP may have changed something in the headers without your knowledge. Or your ISP may be using headers that don't strictly follow RFCs. Even if it is a change on spamcop's part, it is not a problem for most people.

A Tracking URL of when it was working compared to the one that is entirely messed up might shed some light on what has happened.

As already mentioned, absolutely nothing has been changed at my end. I wouldn't know how to find old tracking URL's from when it worked - how would I find that ?

Where can I find the RFC for dates in internet mail headers ?

Link to comment
Share on other sites

As already mentioned, absolutely nothing has been changed at my end. I wouldn't know how to find old tracking URL's from when it worked - how would I find that ?

Where can I find the RFC for dates in internet mail headers ?

If you submit your spam via email, you should receive a reply that contains your tracking URL.

You could also simply compare the date format with an older message from a couple months ago to see any difference in the date format. This would not prove spamcop changed things, however.

Wazoo gave the link for the RFC: http://www.faqs.org/rfcs/rfc2822.html as well as the relative section: 3.6.7. Trace fields

Link to comment
Share on other sites

As already mentioned, absolutely nothing has been changed at my end. I wouldn't know how to find old tracking URL's from when it worked - how would I find that ?

SpamCOp FAQ links at the top of this very page

Getting a Tracking URL from a Report ID

Where can I find the RFC for dates in internet mail headers ?

Same place I linked to and copied information from in my last post ....

Link to comment
Share on other sites

As already mentioned, absolutely nothing has been changed at my end. I wouldn't know how to find old tracking URL's from when it worked - how would I find that ?

Where can I find the RFC for dates in internet mail headers ?

Unless you are running the mail server, you don't know that nothing has been changed at your end. ISPs are very bad at not telling customers when they make technical changes.

If you are running the mail server, then perhaps you need to find some professional help to understand what has happened and how to avoid it in the future. I am still thinking of the first example that seemed to the knowledgable ones as being really messed up.

Miss Betsy

Link to comment
Share on other sites

I too have been getting these "no date" errors". SpamCop is relying on a date stamp for EVERY hop. If there is one missing you get the error. If you look at the reports that you've had problems with, like me you'll see that the clever spammers are now creating a forged email that does not include a date for the originating message. Why would a spammer do this? To avoid being reported by SpamCop Users!

So, the question is this, now that the spammers have taken a new step at fooling SpamCop, what is SpamCop going to do? I suggest that the date validation be done on the FIRST Receive line ONLY. This line must exist and be correct or my server could not have received it before I reported it.

Other than the last hop (first reported Received line) ALL other parts of the email headers can be forged !

Looks like the spammers are one step ahead at this point.

-MJR, admin

SpamRejection.com

Link to comment
Share on other sites

I too have been getting these "no date" errors". SpamCop is relying on a date stamp for EVERY hop. If there is one missing you get the error. If you look at the reports that you've had problems with, like me you'll see that the clever spammers are now creating a forged email that does not include a date for the originating message. Why would a spammer do this? To avoid being reported by SpamCop Users!

???? Tracking URLS please .. None of the samples provided thus far match your description.

So, the question is this, now that the spammers have taken a new step at fooling SpamCop, what is SpamCop going to do? I suggest that the date validation be done on the FIRST Receive line ONLY. This line must exist and be correct or my server could not have received it before I reported it.

Other than the last hop (first reported Received line) ALL other parts of the email headers can be forged !

And as in the examples seen in this Topic, the first line is the only line that exists .. do you have an explanation and cure for this also?

Link to comment
Share on other sites

???? Tracking URLS please .. None of the samples provided thus far match your description.

And as in the examples seen in this Topic, the first line is the only line that exists .. do you have an explanation and cure for this also?

http://www.spamcop.net/sc?id=z965065222z02...631cba12fa268az

As stated previously, SpamCop has a need to verify the timeliness of reports and I suggest that the date validation be done on the FIRST Receive line ONLY. This line must exist and be correct or my server could not have received it before I reported it.

-MJR, Admin

SpamRejection.com

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.


×
×
  • Create New...