Issue with receiving mails (for example for Github notifications)

[traxys]

I'm not sure if it's a misconfiguration on my part, but mails for example mails that start GitHub PRs have a really high spam score (X-Spam-Status: Yes, score=8.00312487378562)

Spam details:

X-Spam-Result: TO_DN_ALL (0),
	R_SUSPICIOUS_URL (5),
	ALLOWLIST_DKIM (-1),
	MV_CASE (0.5),
	HTTP_TO_HTTPS (0.5),
	ARC_NA (0),
	FROM_NEQ_ENVFROM (0),
	PHISHING (4),
	RCPT_LOCAL_IN_SUBJECT (2),
	FORGED_SENDER (0.3),
	RCVD_IN_DNSWL_LOW (-0.1),
	R_PARTS_DIFFER (1),
	HAS_LIST_UNSUB (-0.01),
	URI_COUNT_ODD (0.5),
	DMARC_POLICY_ALLOW (-0.5),
	DKIM_SIGNED (0),
	RWL_MAILSPIKE_POSSIBLE (0),
	DWL_DNSWL_LOW (-1),
	DKIM_ALLOW (-0.2),
	REPLYTO_DOM_EQ_FROM_DOM (0),
	RCPT_COUNT_TWO (0),
	HAS_REPLYTO (0),
	FROM_HAS_DN (0),
	FORGED_RCVD_TRAIL (1),
	MID_RHS_MATCH_FROM (1),
	MAILLIST (-0.2),
	RCVD_COUNT_ONE (0),
	SPF_DNSFAIL (0),
	FORGED_SENDER_MAILLIST (0),
	RCVD_TLS_LAST (0)

I see this in my logs for a reception:

INFO SMTP EHLO command (smtp.ehlo) listenerId = "smtp", localPort = 25, remoteIp = 192.30.252.206, remotePort = 60861, domain = "out-23.smtp.github.com"
INFO SPF EHLO check failed (smtp.spf-ehlo-fail) listenerId = "smtp", localPort = 25, remoteIp = 192.30.252.206, remotePort = 60861, domain = "out-23.smtp.github.com", result = No SPF record (spf.none), elapsed = 36ms
INFO TLS handshake (tls.handshake) listenerId = "smtp", localPort = 25, remoteIp = 192.30.252.206, remotePort = 60861, listenerId = "smtp", version = "TLSv1_3", details = "TLS13_AES_256_GCM_SHA384"
INFO IPREV check passed (smtp.iprev-pass) listenerId = "smtp", localPort = 25, remoteIp = 192.30.252.206, remotePort = 60861, domain = "out-23.smtp.github.com", result = IPREV check passed (iprev.pass) { details = ["out-23.smtp.github.com."] }, elapsed = 72ms
INFO Authentication successful (auth.success) listenerId = "imaptls", localPort = 993, remoteIp = 90.73.208.50, remotePort = 44572, accountName = "traxys", accountId = 55
INFO SPF From check failed (smtp.spf-from-fail) listenerId = "smtp", localPort = 25, remoteIp = 192.30.252.206, remotePort = 60861, domain = "out-23.smtp.github.com", from = "noreply@github.com", result = SPF temporary error (spf.temp-error), elapsed = 15003ms
INFO SMTP MAIL FROM command (smtp.mail-from) listenerId = "smtp", localPort = 25, remoteIp = 192.30.252.206, remotePort = 60861, from = "noreply@github.com"
INFO SMTP RCPT TO command (smtp.rcpt-to) listenerId = "smtp", localPort = 25, remoteIp = 192.30.252.206, remotePort = 60861, to = "quentin+dev@familleboyer.net"
INFO DKIM verification passed (smtp.dkim-pass) listenerId = "smtp", localPort = 25, remoteIp = 192.30.252.206, remotePort = 60861, strict = false, result = [DKIM verification passed (dkim.pass) { domain = "github.com" }], elapsed = 0ms
INFO ARC verification passed (smtp.arc-pass) listenerId = "smtp", localPort = 25, remoteIp = 192.30.252.206, remotePort = 60861, strict = false, result = No DKIM signature (dkim.none), elapsed = 0ms
INFO DMARC check passed (smtp.dmarc-pass) listenerId = "smtp", localPort = 25, remoteIp = 192.30.252.206, remotePort = 60861, strict = false, domain = "github.com", policy = "reject", result = DMARC check passed (dmarc.pass), elapsed = 38ms
INFO Queued message for delivery (queue.queue-message) listenerId = "smtp", localPort = 25, remoteIp = 192.30.252.206, remotePort = 60861, queueId = 215677357078475314, from = "noreply@github.com", to = ["quentin+dev@familleboyer.net"], size = 9352, nextRetry = 2024-12-25T10:36:23Z, nextDsn = 2024-12-26T10:36:23Z, expires = 2024-12-30T10:36:23Z
INFO Delivery attempt started (delivery.attempt-start) queueId = 215677357078475314, from = "noreply@github.com", to = ["quentin+dev@familleboyer.net"], size = 9352, total = 1
INFO New delivery attempt for domain (delivery.domain-delivery-start) queueId = 215677357078475314, from = "noreply@github.com", to = ["quentin+dev@familleboyer.net"], size = 9352, total = 1, domain = "familleboyer.net", total = 0
INFO Possible spam message ingested (message-ingest.spam) queueId = 215677357078475314, from = "noreply@github.com", to = ["quentin+dev@familleboyer.net"], size = 9352, total = 1, accountId = 55, documentId = 47295, mailboxId = [2], blobId = "1854a8fed84cf491583cf4ee03bfbfe810a36ff088e95a2e7d6465ae6cd1b4f0", changeId = 215677368753323513, messageId = "[REDACTED ID]", size = 9352, elapsed = 102ms
INFO DSN success notification (delivery.dsn-success) queueId = 215677357078475314, from = "noreply@github.com", to = ["quentin+dev@familleboyer.net"], size = 9352, total = 1, to = "quentin+dev@familleboyer.net", hostname = "localhost", code = 250, details = "OK"
INFO Delivery completed (delivery.completed) queueId = 215677357078475314, from = "noreply@github.com", to = ["quentin+dev@familleboyer.net"], size = 9352, total = 1, elapsed = 0ms
INFO Delivery attempt ended (delivery.attempt-end) queueId = 215677357078475314, from = "noreply@github.com", to = ["quentin+dev@familleboyer.net"], size = 9352, total = 1, elapsed = 103ms

I'm a bit surprised by R_SUSPICIOUS_URL (5), I would think that github would be sufficiently trustworthy

[mdecimus]

Please try again next week with version 0.11 which comes with the new spam filter.