EmailDiscussions.com  

Go Back   EmailDiscussions.com > Email Service Provider-specific Forums > FastMail Forum
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read
Stay in touch wirelessly

FastMail Forum All posts relating to FastMail.FM should go here: suggestions, comments, requests for help, complaints, technical issues etc.

Reply
 
Thread Tools
Old 14 Nov 2018, 09:05 PM   #1
sflorack
The "e" in e-mail
 
Join Date: Feb 2002
Posts: 2,886
False Positives from ME_VADESPAM

Lately, I've been receiving quite a few legitimate emails in my SPAM folder. When checking the headers, they all have the same SA rule causing the email to be marked SPAM: ME_VADESPAM 5.

Is VadeSpam new? The only reference I'm able to find regarding VadeSpam is a different email forum where the poster is having the same problem (with VadeSpam being overly aggressive).
sflorack is offline   Reply With Quote

Old 14 Nov 2018, 11:20 PM   #2
powerserve
Junior Member
 
Join Date: Nov 2018
Posts: 3
Vadespam

I have not heard of it before. Very few English language results when searching. I did find this from 2 years ago specific to DreamHost:

"Spam Filtering is terrible, I’m seeing literally a 50% false positive rate."
https://discussion.dreamhost.com/t/f...iltering/63813
powerserve is offline   Reply With Quote
Old 15 Nov 2018, 01:59 AM   #3
BritTim
The "e" in e-mail
 
Join Date: May 2003
Location: mostly in Thailand
Posts: 2,687
Many of the meanings of "vade" in other languages seem to revolve around expiration, date, time etc. If might be interesting to look at the domains associated with the senders of the emails. Maybe, there is an expired certificate or something causing the messages not to be trusted.
BritTim is offline   Reply With Quote
Old 18 Nov 2018, 09:20 AM   #4
n5bb
Intergalactic Postmaster
 
Join Date: May 2004
Location: Irving, Texas
Posts: 8,407
I’m pretty sure the term “vade” is from the company Vade Secure:
https://www.vadesecure.com
I have seen a few messages with ME_VADESPAM and ME_VADEPHISHING. In most cases the ME_VADESPAM messages had other spam tags (such as front the Bayes filter) which were negative enough to not trigger my spam settings (which I have modified from the defaults). I just received a ME_VADEPHISHING message which should have been classified as spam except the weight applied was only 1 so the spam score was too low.

My guess is that Fastmail has recently starting using the vadesecure results and they are experimenting with the weight of these failures.

Were your ME_VADESPAM false positives from messages which were forwarded or sent through a message board or some other mailing list server?

Bill
n5bb is offline   Reply With Quote
Old 18 Nov 2018, 08:31 PM   #5
Berenburger
The "e" in e-mail
 
Join Date: Sep 2004
Location: The Netherlands
Posts: 2,396
Quote:
Originally Posted by n5bb View Post
My guess is that Fastmail has recently starting using the vadesecure results and they are experimenting with the weight of these failures.
I think your right, Bill. In the Spam View section in the Pobox admin tool I now see lines with ‘caught by vadesecure’.
Berenburger is offline   Reply With Quote
Old 18 Nov 2018, 11:29 PM   #6
sflorack
The "e" in e-mail
 
Join Date: Feb 2002
Posts: 2,886
Quote:
Originally Posted by n5bb View Post
Were your ME_VADESPAM false positives from messages which were forwarded or sent through a message board or some other mailing list server?
No, just regular messages. And the value for both ME_VADESPAM and ME_VADEPHISHING has been 5. Previously, my "move to SPAM" setting was 6.0, so I had to adjust it to 6.5 to account for the new aggressive service.
sflorack is offline   Reply With Quote
Old 19 Nov 2018, 12:15 AM   #7
n5bb
Intergalactic Postmaster
 
Join Date: May 2004
Location: Irving, Texas
Posts: 8,407
Quote:
Originally Posted by sflorack View Post
No, just regular messages. And the value for both ME_VADESPAM and ME_VADEPHISHING has been 5. Previously, my "move to SPAM" setting was 6.0, so I had to adjust it to 6.5 to account for the new aggressive service.
Be sure they are not fake. Then I suggest reporting them as non-spam and filing a Fastmail support request attaching those messages.
n5bb is offline   Reply With Quote
Old 6 Dec 2018, 01:54 AM   #8
SideshowBob
Junior Member
 
Join Date: Jan 2017
Posts: 28
In addition to ME_VADESPAM and ME_VADEPHISHING, I'm seeing ME_VADESCAM and ME_VADEDCE.

Based on this article, which explains some of Vade's terminology, DCE is "bad reputation marketing/Commercial Email" (I'm guessing the D is for disreputable).

There are several Vade headers, but the x-vs= section of the Authentication-Results header seems to be the most complete. I'm seeing entries like:
Code:
 x-vs=clean score=69 state=0
 x-vs=clean score=91 state=0
 x-vs=commercial:dce score=107 state=12
 x-vs=commercial:mce score=17 state=11
 x-vs=commercial:pce score=7 state=10
 x-vs=malware score=9999 state=2
 x-vs=phishing score=190 state=101
 x-vs=phishing score=300 state=101
 x-vs=spam score=100 state=1
 x-vs=spam score=700 state=1
 x-vs=transactional:account score=20 state=14
 x-vs=transactional:alerts score=50 state=14
 x-vs=transactional:purchases score=10 state=14
This may be useful for sieve filtering, if it's accurate.

The article I quoted above states: "The score is a arbitrary number given by Vade. It is NOT an indicator that an email is SPAM or SN or any of the other statuses mentioned". Despite that there's a clear threshold of 100.

The state seems to be an alternative version of the classification, but oddly with less information for transactional email.

The phishing classification seems particularly weak. So far I've had 1 FP, on an ordinary email from a family member, and 6 hits on spam. Of those 6 spams, only 1 could be called a phish, and 1 was an obvious ED spam.
SideshowBob is offline   Reply With Quote
Reply


Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Forum Jump


All times are GMT +9. The time now is 02:08 PM.

 

Copyright EmailDiscussions.com 1998-2013. All Rights Reserved. Privacy Policy