[SpamCop-List] Re: "Sorry, this email is too old to file a spam report"

[Mike Easter]

Steven Maesslein wrote:
> Mike Easter
>> But your service received it two days before, and that makes the item
>> 'old spam'.
>
> infosat.net is not my service.
>
> This mail was sent directly to my spamcop.net address by the spammer.

Oh.  I don't use mailhosts and so I'm inexperienced at 'reading' the
mailhosts verbose from SC and I didn't pay attention to 'where you're
from' which appears to be .fr not .za.

SC sed:

Hostname verified: tsamail.co.za
Trusted site 66.18.69.6 received mail from 196.38.110.54

... so I foolishly 'assumed' the tsamail was a hostname.  I've got to
learn how to listen 'properly' to the verbose from mailhosts parsings.

I read those headers as being received by tsamail.co.za's MX [which is
infosat] and 'relayed' [forwarded] to SC, but that isn't what happened.

The item is apparently sourced via a free webmailer at tsamail
http://www.tsamail.co.za/ which is SC and spamhaus listed and the
account holder is probably a free 'straightup' From account
jfrankline at tsamail.co.za who is accessing from the .ci IP 213.136.99.130
rDNS bke-130.aviso.ci

So, my earlier statement about

Mike Easter wrote:
> The non-mailhost uses the first good line;  the mailhosts system
> breaks the parse off if it is in 'legitimate mailhost territory' and
> the item becomes old.

isn't accurate with respect to 'legitimate mailhost territory'.  I
appears that the parser breaks the chain and ceases to parse for a
mailhost user based on a different algorithmic principle than a
non-mailhost which would cause any relay delay to make the item
'unparsable' on the basis of age for a mailhost user but not a
non-mailhost user.

Whether that is a good change or not is debatable.  I would say that it
is unfortunate that the parse actually breaks off prematurely.  I think
it should complete the parse first, and then refuse to report it because
of age -- rather than the way your tracker handled it.

-- 
Mike Easter
kibitzer, not SC admin