How to stop Thunderbird from classifying my collegue's Airmail messages as scam
Thunderbird keeps classifying almost all mail from one of my colleagues as scam.
His sending address is in my address book.
I suspect it has to do with how his MUA (Apple Airmail) formats the emails.
I do not want to disable Scam detection in general.
Any ideas?
Using Thunderbird 52.3.0+build1-0ubuntu0.16.04.1 on Ubuntu 16.04.3 LTS
Chosen solution
sure. The detection is very basic so all that triggers it is listed here https://support.mozilla.org/en-US/kb/thunderbirds-scam-detection#w_thunderbirds-automatic-scam-filtering
To summarize
- Links with numerical server names (http://127.0.0.1/).
- Links where the text doesn't match the server name (for example, the text of the message might say "https://secure.example.com" but the link actually goes to "http://phishing.example.com" instead). Phishers do this to fool you into going to their site. Unfortunately some legitimate mailing lists also do this with redirectors for tracking purposes.
- A remote image link that has different image source than the link points to (spoofing a legitimate web site, similar to the link spoofing described above).
All Replies (4)
You have no choices beyond what you apparently are aware of. Modify the email or disable the scam detection are the choices. There are no hidden tweaks or settings is is really an incomplete feature that has languished for years.
Thank you Matt.
Is there any documentation of how my colleague could change the format of his mails that make it less likely to trigger Thunderbird's scam detection?
Chosen Solution
sure. The detection is very basic so all that triggers it is listed here https://support.mozilla.org/en-US/kb/thunderbirds-scam-detection#w_thunderbirds-automatic-scam-filtering
To summarize
- Links with numerical server names (http://127.0.0.1/).
- Links where the text doesn't match the server name (for example, the text of the message might say "https://secure.example.com" but the link actually goes to "http://phishing.example.com" instead). Phishers do this to fool you into going to their site. Unfortunately some legitimate mailing lists also do this with redirectors for tracking purposes.
- A remote image link that has different image source than the link points to (spoofing a legitimate web site, similar to the link spoofing described above).
Thank you Matt. Your hint helped me find the broken link "where the text doesn't match the server name" in the sender's HTML signature. Mystery solved, i notified my colleague!
Modified by Nils T