OK, after more R'ing TFM and some kind advice from a list member, I think I understand now what has been happening.
>>From the Mail::SpamAssassin::Conf man page: * if the âfromâ IP address is on the same /16 network as the top Received lineâs âbyâ host, itâs trusted * if the address of the âfromâ host is in a reserved network range, then itâs trusted * if any addresses of the âbyâ host is in a reserved network range, then itâs trusted So the solution is to add these two lines to local.cf: clear_trusted_networks trusted_networks 127/8 24.173.79.19/32 IIUC this sets any traffic which originates from my server as trusted, but all other traffic is not. Thanks, Thomas