Hi All,
I have a (hopefully) unique problem where it appears that a small percentage
of the email coming in are not being assigned a score. In fact, the headers
look messed up.
I've been running SpamAssassin for a 150 user company for some time now with
great results. The system runs on:
Qmail-1.03
SpamAssassin 2.61
Qmail-Scanner-1.20
ClamAV-0.65
We tag emails that score over 5 and forward them to users. A complete run
down of the score is included in every email - spam or not. In these cases
though, I cannot see the score at all, though it is definitely passing
through our spam gateway (cygnus).
Here are some of the headers I've received - this is somewhat of an anomaly
though, as it seems to work for everyone else in the organization. We do
not configure on a per user basis. There is a properly tagged email at the
end.
-------------------------------
Return-Path:
<[EMAIL PROTECTED]
ketonline.com>
Received: from spambox.mydomain.com (205.189.158.134) by mydomain.com with
SMTP
(Eudora Internet Mail Server 3.2.1) for <[EMAIL PROTECTED]>;
Thu, 22 Jan 2004 17:40:18 -0500
Received: (qmail 14115 invoked by uid 104); 22 Jan 2004 17:40:18 -0500
Received: from
[EMAIL PROTECTED]
etonline.com by spambox.mydomain.com by uid 100 with qmail-scanner-1.20st
(clamscan: 0.65. spamassassin: 2.60.
Clear:RC:0(69.6.16.123):SA:0(Received: from 23.bluerocketonline.com
(69.6.16.123)/?):.
Processed in 4.794342 secs); 22 Jan 2004 22:40:18 -0000
X-Spam-Status: No, hits=Received: from 23.bluerocketonline.com (69.6.16.123)
required=?
Received: from 23.bluerocketonline.com (69.6.16.123)
by spambox.mydomain.com with SMTP; 22 Jan 2004 17:40:13 -0500
Received: (from [EMAIL PROTECTED])
by 23.bluerocketonline.com (8.8.8/8.8.8) id LAA43990;
Thu, 22 Jan 2004 11:58:18 -0800 (PST)
Date: Thu, 22 Jan 2004 14:41:52 -0800 (PST)
Message-Id: <[EMAIL PROTECTED]>
From: AD Kessler <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: 10,000 a Month
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="MIME_BOUNDARY-6598-0-1074794163"
---------------------------------------------------------
Return-Path:
<[EMAIL PROTECTED]>
Received: from spambox.mydomain.com (205.189.158.134) by mydomain.com with
SMTP
(Eudora Internet Mail Server 3.2.1) for <[EMAIL PROTECTED]>;
Fri, 23 Jan 2004 02:53:22 -0500
Received: (qmail 15061 invoked by uid 104); 23 Jan 2004 02:53:22 -0500
Received: from
[EMAIL PROTECTED] by
spambox.mydomain.com by uid 100 with qmail-scanner-1.20st
(clamscan: 0.65. spamassassin: 2.60.
Clear:RC:0(69.6.28.135):SA:0(Received: from 20.pntaa.com (69.6.28.135)/?):.
Processed in 0.998673 secs); 23 Jan 2004 07:53:22 -0000
X-Spam-Status: No, hits=Received: from 20.pntaa.com (69.6.28.135) required=?
Received: from 20.pntaa.com (69.6.28.135)
by spambox.mydomain.com with SMTP; 23 Jan 2004 02:53:21 -0500
Received: (from [EMAIL PROTECTED])
by 20.pntaa.com (8.8.8/8.8.8) id SAA17094;
Thu, 22 Jan 2004 18:31:29 -0800 (PST)
Date: Thu, 22 Jan 2004 18:48:29 -0800 (PST)
Message-Id: <[EMAIL PROTECTED]>
From: Dish Management <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-info: Please report complaints to [EMAIL PROTECTED]
X-info: All e-mails sent through this system contains full working
unsubscription info.
Subject: Free Digital Video Recorder & 3 Free Months of Dish Network
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="MIME_BOUNDARY-18751-0-1074830530"
----------------------------------------------------------------------------
-------------
Return-Path:
<[EMAIL PROTECTED]
ketonline.com>
Received: from spambox.mydomain.com (205.189.158.134) by mydomain.com with
SMTP
(Eudora Internet Mail Server 3.2.1) for <[EMAIL PROTECTED]>;
Thu, 22 Jan 2004 20:28:13 -0500
Received: (qmail 25275 invoked by uid 104); 22 Jan 2004 20:28:13 -0500
Received: from
[EMAIL PROTECTED]
etonline.com by spambox.mydomain.com by uid 100 with qmail-scanner-1.20st
(clamscan: 0.65. spamassassin: 2.60.
Clear:RC:0(69.6.16.125):SA:0(Received: from 25.bluerocketonline.com
(69.6.16.125)/?):.
Processed in 1.421739 secs); 23 Jan 2004 01:28:13 -0000
X-Spam-Status: No, hits=Received: from 25.bluerocketonline.com (69.6.16.125)
required=?
Received: from 25.bluerocketonline.com (69.6.16.125)
by spambox.mydomain.com with SMTP; 22 Jan 2004 20:28:12 -0500
Received: (from [EMAIL PROTECTED])
by 25.bluerocketonline.com (8.8.8/8.8.8) id QAA41643;
Thu, 22 Jan 2004 16:22:34 -0800 (PST)
Date: Thu, 22 Jan 2004 17:24:27 -0800 (PST)
Message-Id: <[EMAIL PROTECTED]>
From: Tail Wagging Offers News Letter
<[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject:
=?iso-8859-1?B?My44NzUlIEZpeGVkIE1vcnRnYWdlIGZvciBKdW1ibyBMb2Fuc5I=?=
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
----------------------------------------------------------------------------
---
Return-Path:
<[EMAIL PROTECTED]
m>
Received: from spambox.mydomain.com (205.189.158.134) by mydomain.com with
SMTP
(Eudora Internet Mail Server 3.2.1) for <[EMAIL PROTECTED]>;
Fri, 23 Jan 2004 03:27:04 -0500
Received: (qmail 16880 invoked by uid 104); 23 Jan 2004 03:27:03 -0500
Received: from
[EMAIL PROTECTED]
by spambox.mydomain.com by uid 100 with qmail-scanner-1.20st
(clamscan: 0.65. spamassassin: 2.60. Clear:RC:0(69.6.39.11):SA:0(Received:
from 41.postnote.com (69.6.39.11)/?):.
Processed in 2.038251 secs); 23 Jan 2004 08:27:03 -0000
X-Spam-Status: No, hits=Received: from 41.postnote.com (69.6.39.11)
required=?
Received: from 41.postnote.com (69.6.39.11)
by spambox.mydomain.com with SMTP; 23 Jan 2004 03:27:01 -0500
Received: (from [EMAIL PROTECTED])
by 41.postnote.com (8.8.8/8.8.8) id SAA18495;
Thu, 22 Jan 2004 18:21:52 -0800 (PST)
Date: Thu, 22 Jan 2004 18:26:44 -0800 (PST)
Message-Id: <[EMAIL PROTECTED]>
From: Your New Car <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-info: Please report complaints to [EMAIL PROTECTED]
X-info: All e-mails sent through this system contains full working
unsubscription info.
Subject: Car Loans
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="MIME_BOUNDARY-24539-0-1074840363"
Here is a normal spam that was tagged by our system:
----------------------------------------------------------------------------
-----------
Return-Path: <[EMAIL PROTECTED]>
Received: from spambox.mydomain.com (205.189.158.134) by mydomain.com with
SMTP
(Eudora Internet Mail Server 3.2.1) for <[EMAIL PROTECTED]>;
Fri, 23 Jan 2004 13:00:05 -0500
Received: (qmail 31075 invoked by uid 104); 23 Jan 2004 13:00:04 -0500
Received: from [EMAIL PROTECTED] by spambox.mydomain.com by uid 100 with
qmail-scanner-1.20st
(clamscan: 0.65. spamassassin: 2.60.
Clear:RC:0(166.114.5.50):SA:1(32.7/5.0):.
Processed in 15.885335 secs); 23 Jan 2004 18:00:04 -0000
Received: from unknown (HELO 205.189.158.134) (166.114.5.50)
by spambox.mydomain.com with SMTP; 23 Jan 2004 12:59:48 -0500
Received: from 249.229.63.112 by 166.114.5.50; Fri, 23 Jan 2004
03:52:00 -0200
Message-ID: <[EMAIL PROTECTED]>
X-Habeas-SWE-1: winter into spring
X-Habeas-SWE-2: brightly anticipated
X-Habeas-SWE-3: like Habeas SWE (tm)
X-Habeas-SWE-4: Copyright 2002 Habeas (tm)
X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this
X-Habeas-SWE-6: email in exchange for a license for this Habeas
X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant
X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this
X-Habeas-SWE-9: mark in spam to <http://www.habeas.com/report/>.
From: "Josie Zavala" <[EMAIL PROTECTED]>
Reply-To: "Josie Zavala" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: [QSPAM] Real buy # X+A+Nax ; :P:ntermin > V1agr@ ~ So:m:a &
Val:i:um Lots on stocks. oirkcqBm
Date: Fri, 23 Jan 2004 00:00:00 -0600
X-Mailer: Endymion MailMan Professional Edition v3.0.14 ISU Version mp6.15
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="--86720013983828190760"
X-Priority: 5
X-Spam-Flag: YES
X-Spam-Report:
* 1.5 RCVD_NUMERIC_HELO Received: contains a numeric HELO
* 0.1 HTML_MESSAGE BODY: HTML included in message
* 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.0000]
* 0.1 HTML_70_80 BODY: Message is 70% to 80% HTML
* 0.1 HTML_FONTCOLOR_UNSAFE BODY: HTML font color not in safe 6x6x6
palette
* 0.3 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* 0.1 BIZ_TLD URI: Contains a URL in the BIZ top-level domain
* 4.1 FORGED_RCVD_NET_HELO Host HELO'd using the wrong IP network
* 1.6 NO_DNS_FOR_FROM Domain in From header has no MX or A DNS records
* 0.7 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org
* [<http://dsbl.org/listing?ip=166.114.5.50>]
* 1.5 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
* [Blocked - see <http://www.spamcop.net/bl.shtml?166.114.5.50>]
* 16 HABEAS_VIOLATOR RBL: Has Habeas warrant mark and on Infringer List
* [166.114.5.50 listed in sa-hil.habeas.com]
* 1.1 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts
X-Spam-Status: Yes, hits=32.7 required=5.0 tests=BAYES_99,BIZ_TLD,
FORGED_RCVD_NET_HELO,HABEAS_VIOLATOR,HTML_70_80,HTML_FONTCOLOR_UNSAFE,
HTML_MESSAGE,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,NO_DNS_FOR_FROM,
RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_DSBL,RCVD_NUMERIC_HELO autolearn=spam
version=2.61
X-Spam-Level: ********************************
X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on
spambox.mydomain.com
Thanks for your input - it's much appreciated!
James
-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
