Barracuda tagging email with 'date grossly in the future.'
I have a Barracuda 300. Granted it's running on some old firmware and the Energize updates are quite outdated. I'd like to update them, but, not my financial decision to do so.
Starting around the first of the year, our Barracuda began tagging a rather large amount of emails (that were normally allowed into our network) as SPAM because of a high target score due to it perceiving that the date of said email was 'grossly in the future.'
Here is a copy of the Source of the email taken from the Barracuda.
X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.2.29990 Rule breakdown below pts rule name description
3.38 FH_DATE_PAST_20XX The date is grossly in the future.
Keep in mind, that updating the firmware and applying the Energizer updates at this time is just not feasible. Not that I am guarnateed that that would solve the problem, but, it needs to be taken out of the equation as a possible answer.
I am not that familiar with the inner workings of the Barracuda line of products, does anyone have any idea(s) as to why the Barracuda is thinking that an email sent yesterday at 8:21PM was tagged as a date 'grossly in the future.'
Since the barracudas are so new to me, I'm happy to provide any other information that help suss out what's going on.
Thanks.
J
UPDATE: Outlook Full Header from a tagged message
X-ASG-Debug-ID: 1325823247-07a81a820001-d0RUwY
Received: from mail-iy0-f176.google.com (mail-iy0-f176.google.com [209.85.210.176]) by >mail.firstwave.aero with ESMTP id IhB0n11vCN63DDRC for ; Thu, 05 >Jan 2012 22:14:07 -0600 (CST)
X-Barracuda-Envelope-From: [email protected]
Received: by iapp10 with SMTP id p10so2613260iap.21 for ; Thu, 05 Jan 2012 >20:14:07 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma; h=from:to:subject:date:message-id:mime-version:content-type:x-mailer :thread-index:content-language; bh=J9QYd5h7+/IRzvhASN6GQUNYK13b2JGzZnFkRPfE66o=; b=m+Nob2ezR5LLx7bpFzjzIlOwrWURTYpVfcVPWS1IoqHSF3729M9ZPWqImMU+eZP9wK dVeWbiFiv+Pa/9qjrqiqJdoIKeqlVdY2kJQDzijQY81TS0sIQf7Ll+xANRNZ8HdRTXZD kLjviq5cgijZrQAIxEEF0GXjl2cG4boBUbO5I=X-Barracuda-BBL-IP: nil
Received: by 10.50.156.130 with SMTP id we2mr5673047igb.10.1325823247091; Thu, 05 Jan 2012 20:14:07 -0800 (PST) Received: from Joker (deleted IP) by mx.google.com with ESMTPS id l35sm209064912ibj.0.2012.01.05.20.14.05 (version=TLSv1/SSLv3 cipher=OTHER); Thu, 05 Jan 2012 20:14:06 -0800 (PST)
From: me
X-ASG-Orig-Subj:
Subject: [Barracuda SPAM]
Date: Thu, 5 Jan 2012 22:14:06 -0600
Message-ID: <000001cccc29$a31db3e0$e9591ba0$@com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0001_01CCCBF7.588343E0"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: AczMKaF4b0TpPhsDRDOgSYGxa8UwLw==
Content-Language: en-us
X-Barracuda-Connect: mail-iy0-f176.google.com[209.85.210.176]
X-Barracuda-Start-Time: 1325823247
X-Barracuda-URL: deleted
X-Virus-Scanned: by bsmtpd at me.com
X-Barracuda-Spam-Score: 4.68
X-Barracuda-Spam-Status: Yes, SCORE=4.68 using global scores of TAG_LEVEL=3.5
QUARANTINE_LEVEL=1000.0 KILL_LEVEL=5.0 tests=FH_DATE_PAST_20XX, HTML_MESSAGE, >MIME_HTML_MOSTLY, MISSING_SUBJECT, MISSING_SUBJECT_2
X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.2.29990
Rule breakdown below
pts rule name description
3.38 FH_DATE_PAST_20XX The date is grossly in the future.
0.00 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
0.00 HTML_MESSAGE BODY: HTML included in message
0.01 MISSING_SUBJECT Missing Subject: header
1.28 MISSING_SUBJECT_2 Missing Subject: header
X-Priority: 5 (Lowest)
X-MSMail-Priority: Low
Importance: Low
X-Barracuda-Spam-Flag: YES
Return-Path: [email protected]
X-OriginalArrivalTime: 06 Jan 2012 04:14:08.0496 (UTC) FILETIME=[A2DC1700:01CCCC29]
>
Bit of a formatted mess, but, all there.
Solution 1:
I'm seeing the same situation. Yes, it's due to the god-awful old firmware. I have one Barracuda unit out there that I cannot update because of a lapsed warranty and Barracuda's terrible renewal policy. I'm working to possibly root into the box and disable the offending SpamAssasin rule or manually update firmware...
Edit: I'm seeing reports of customers whose Barracuda units lapsed in December 2011 and have the same issue. That means that Barracuda didn't fix this long-standing bug until very recently.
This is a 2012 bug and is covered in the Barracuda Support Forums and a knowledge base posting.
Solution 2:
We are experiencing the same thing and we have a Barracuda 400. For now we boosted up our spam score plus 3.8 to try to compensate.