Ok, your headers sample finally showed up.
On Thu, 16 Aug 2018, Michael D. Maus Jr. wrote:
I have attached the full header from the recipient to this email in a
.txt file as well as the msg from the source computer.
None of these headers are from base SpamAssassin:
X-CMAE-Verdict: spam
X-CMAE-Score: 100
X-CMAE-Analysis: v=2.2 cv=Yb3N30Zf c=1 sm=1 tr=0 p=3ZjwRxQnAAAA:8
a=hZh4iLKdhF58aR3jzNI04g==:117 a=gy1v0Dzie5QA:10 a=rOhtlMVFSd4A:10
a=1ep11G6qA-YA:10 a=xqWC_Br6kY4A:10 a=dapMudl6Dx4A:10
a=zmVwjc9v8q8A:10
a=Tbely2v79S-1p_IH7AwA:9 a=CjuIK1q_8ugA:10 a=9bEdO6scgCIA:10
a=chuOFLwo73wA:10 a=2KX3iwCENBoA:10 a=yMhMjlubAAAA:8
a=SSmOFEACAAAA:8
a=vhqWiLM0QR2tXF_TacEA:9 a=okOrvQjJR9mQxvY3:21 a=gKO2Hq4RSVkA:10
a=UiCQ7L4-1S4A:10 a=hTZeC7Yk6K0A:10 a=frz4AuCg-hUA:10
a=LUFM9eM87TcA:10
a=1zLHRq9rx9Kcg_oBEtYA:9 a=KkSTjpL_G_2fit9M:18 a=HXjIzolwW10A:10
a=KwgpVZE-ergA:10 a=OQYAytABcVUol_NHXjI_:22
Spam-Stopper-Id: 0edc3360-ca21-4d10-8e89-6df146b345c9
Spam-Stopper-v2: Yes
X-Spam-Score: 100
X-Spam-Reasons:
Cause=gggruggvucftvghtrhhoucdtuddrgedtjedrudelgdeiiecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucdtuddrgedtjedrtddtpdfkpffvgfftoffgfffktedpggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedttdenucenucfjughrpefhvffuthffkfhitgggsehrtddtredttddvnecuhfhrohhmpedfofhitghhrggvlhcuffdrucforghushculfhrrddfuceomhhmrghushesthhruhhtvghgrhgrrdgtohhmqeenucffohhmrghinhepthhruhhtvghgrhgrrdgtohhmnecukfhppeejgedrvdduledrudefrdelkedpuddtgedrgeejrdefkedrudduiedpfhgvkedtmeemvgdtvgdtmeeksgegfeemfegvfeehmeekudejkeenucevlhhushhtvghrufhiiigvpedt
X-AES-Category: SPAM
X-Spam-Category: LEGIT
The X-CMAE stuff is (as you noted) probably Cloudmark. You'd have to
contact Cloudmark for more information. I don't know what added the
others. I've CC'd this back to the list, perhaps someone else will
recognize them.
I'm not sure that SA per se is rejecting, apart perhaps from your
content being recognized as "bulk mail".
Again, try sending a copy of the rejected message to me so that my SA
install can scan it.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Sheep have only two speeds: graze and stampede. -- LTC Grossman
-----------------------------------------------------------------------
7 days until the 1939th anniversary of the destruction of Pompeii
Received: from MBX090-W7-CO-5.EXCH090.serverpod.net (10.224.177.190) by
MBX090-W7-CO-6.EXCH090.serverpod.net (10.224.177.192) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521) id
15.1.1466.3 via Mailbox Transport; Thu, 16 Aug 2018 06:30:30 -0700
Received: from MBX090-W4-CO-5.EXCH090.serverpod.net (10.224.177.154) by
MBX090-W7-CO-5.EXCH090.serverpod.net (10.224.177.190) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521) id
15.1.1466.3; Thu, 16 Aug 2018 06:30:30 -0700
Received: from aesmt-co-1-1.serverpod.net (10.224.74.128) by
MBX090-W4-CO-5.EXCH090.serverpod.net (10.224.177.155) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P521) id
15.1.1466.3 via Frontend Transport; Thu, 16 Aug 2018 06:30:29 -0700
Received: from aesq-qt-co-1-1.aesq.serverpod.net
(aesq-qt-co-1-1.aesq.serverpod.net [10.224.95.6])
(using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits))
(No client certificate requested)
by aesmt-co-1.serverpod.net (Postfix) with ESMTPS id F03E2BFA82
for <exam...@example.com>; Thu, 16 Aug 2018 06:30:29 -0700 (PDT)
Received: from aesc090-co-1-3.serverpod.net (aesc090-co-1-3.serverpod.net
[10.224.76.76])
by aesq-qt-co-1-2.aesq.serverpod.net ([10.224.95.7])
with SMTP (Quarantine Mailbox SMTP Endpoint 3.5.40) id JKWLNXMP;
Thu, 16 Aug 2018 06:27:50 -0700 (PDT)
Received: from exmx090-co-1-2.serverpod.net (exmx090-co-1-2.serverpod.net
[10.224.72.23])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by aesmt090-co-1.serverpod.net (Postfix) with ESMTPS id 97E763DF9
for <exam...@example.com>;
Thu, 16 Aug 2018 06:27:50 -0700 (PDT)
Received: from NAM02-BL2-obe.outbound.protection.outlook.com
(mail-bl2nam02on0116.outbound.protection.outlook.com [104.47.38.116])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits))
(No client certificate requested)
by west.smtp.mx.exch090.serverdata.net (Postfix) with ESMTPS id 2897DE23
for <exam...@example.com>;
Thu, 16 Aug 2018 06:27:50 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trutegra.com;
s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=dBZHZQ5Pg4XaQHn3HFd7b+nOwySuOXPOOuECDfTDbBE=;
b=K9kystnHpc21NSZF9eTVpDuQRe4O25emu6PDAy15sNQX1NJhaHhieGcmuDrsLq+7YoGa6ntcb4mmTYdkPf3T+D9Vgm0f5KUcxEL+Wu0aMTojpjNhgAh/z87SnTV78gpZP2s6oaWQAI7DU5i3UuWrMy6SodUGBz+wTHR5/Sd+b6A=
Received: from DM5PR05MB3130.namprd05.prod.outlook.com (10.173.219.12) by
DM5PR05MB3036.namprd05.prod.outlook.com (10.168.177.20) with Microsoft SMTP
Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id
15.20.1059.19; Thu, 16 Aug 2018 13:27:48 +0000
Received: from DM5PR05MB3130.namprd05.prod.outlook.com
([fe80::e0e0:8b43:3e35:8178]) by DM5PR05MB3130.namprd05.prod.outlook.com
([fe80::e0e0:8b43:3e35:8178%10]) with mapi id 15.20.1059.017; Thu, 16 Aug
2018 13:27:48 +0000
From: "Michael D. Maus Jr." <mm...@trutegra.com>
To: "exam...@example.com" <exam...@example.com>
Subject: Test Email 1 - 8/16
Thread-Topic: Test Email 1 - 8/16
Thread-Index: AdQ1ZOU0ApV3R/7+RAKmf0UP9xsKNw==
Date: Thu, 16 Aug 2018 13:27:48 +0000
Message-ID:
<dm5pr05mb31302645f6503a2e92a8191cc4...@dm5pr05mb3130.namprd05.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is )
smtp.mailfrom=mm...@trutegra.com;
x-originating-ip: [74.219.13.98]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics:
1;DM5PR05MB3036;6:dYUXJZAuTDrSuUrkEXNigM395rK7wNNRd/zDVIm3Fl/iNioCvutmDHrHrP+58w2gE1UjK3ly2aUVuBPxfVKFdKbXp2pvB+K2aaWqesSVcnkmN1Zktvhqq0QexKx+4rJCcIv/wF2WWDmqTp8J9kAEqL3QgzG8VsQl/qvSvft02/91lUvhGCoIhb7Bf5nklpkBrFIHJTLXdzMYTBDxlrbxfM36wHKRsmIhxX5GLhSbkQeeJ7yesnTpF2rNUlSQFMjJb3+JBtvBaScS+M1cdkc3tNB+BjRf9rJtEo6FBV5+5SD6mNU5W37XsWl9SgV4IAf2ZlDhldKI/KHgzYbpwBcHw8y6jI42VNya/kUzpsDFxJi17LI2cCyjBlfPE6/FRA6VsRMWFAN/46x6jX0zRD3SErUl9MaG5do8fxVMaMGMuPmUYQmBiI2f95y0ow8vSCOnAV6PJTN9LqVojrCYjlNnXg==;5:m95s64Oe5bD4qDj78DdV0dYVnKkzSBtnR76N6ZwTAjx+PsQH5NK/7wEoBQF/6s4QuEewDgkk3laqnSI41i96XO0a19CfekfpdrzXF3BgsISwMAbKDx11bB1OqwY5ISPbo0OK7VeXcZm+EHe0GUQVVYtj5mOHPZnZkJEHPm6o0kc=;7:9TBfzLOMVmCN+CS2Ua88/8bpLJ0M1tnG4md3+6tqeb+/MTOH4Jjk8xtRicA7GdG7UZ5t8/Av38ZnsB/Ofc425XYYGWXhmMx6KT+BG54lpnV97bEmTI/MravFuF1HAfok72xeHKQSbQhvOXG3c0kGIacY3HHalwMjQBf2OrslahIO13GFzE7icB5g/SHj3a9Pek+PPtLE4/bcmapt6IhLl3RGDUKLJk62/2hJlZRvVfF1FY6+GkyGu4Kjg914fuNq
x-ms-exchange-antispam-srfa-diagnostics: SOS;
x-ms-office365-filtering-correlation-id: 9df8e3da-93a5-482e-afed-08d6037c0f26
x-microsoft-antispam:
BCL:0;PCL:0;RULEID:(7020095)(4652040)(7021125)(8989137)(4534165)(7022125)(4603075)(4627221)(201702281549075)(8990107)(7048125)(7024125)(7027125)(7028125)(7023125)(5600074)(711020)(2017052603328)(7153060)(49563074)(7193020);SRVR:DM5PR05MB3036;
x-ms-traffictypediagnostic: DM5PR05MB3036:
x-microsoft-antispam-prvs:
<dm5pr05mb3036607f2ea01b1810aa3d2bc4...@dm5pr05mb3036.namprd05.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(28532068793085)(21748063052155);
x-ms-exchange-senderadcheck: 1
x-exchange-antispam-report-cfa-test:
BCL:0;PCL:0;RULEID:(102415395)(6040522)(2401047)(5005006)(8121501046)(3231311)(944501410)(52105095)(93006095)(93001095)(10201501046)(3002001)(149027)(150027)(6041310)(20161123558120)(2016111802025)(20161123562045)(20161123564045)(20161123560045)(6043046)(201708071742011)(7699016);SRVR:DM5PR05MB3036;BCL:0;PCL:0;RULEID:;SRVR:DM5PR05MB3036;
x-forefront-prvs: 07665BE9D1
x-forefront-antispam-report:
SFV:NSPM;SFS:(10019020)(136003)(346002)(366004)(39830400003)(396003)(376002)(189003)(199004)(68736007)(558084003)(14454004)(5630700001)(486006)(2900100001)(5660300001)(476003)(6916009)(7696005)(86362001)(186003)(2906002)(26005)(102836004)(53936002)(99286004)(66066001)(2351001)(733005)(5250100002)(256004)(105586002)(54896002)(53386004)(316002)(25786009)(55016002)(54556002)(97736004)(6306002)(106356001)(6506007)(606006)(790700001)(7736002)(6436002)(861006)(236005)(8676002)(99936001)(2501003)(8936002)(6116002)(3846002)(478600001)(966005)(9686003)(5640700003)(81156014)(74316002)(33656002)(81166006);DIR:OUT;SFP:1102;SCL:1;SRVR:DM5PR05MB3036;H:DM5PR05MB3130.namprd05.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1;
received-spf: None (protection.outlook.com: trutegra.com does not designate
permitted sender hosts)
x-microsoft-antispam-message-info:
hmkutxtbtlsFccwJzUQXf1ZqHExXrkW3g90+B3madchpLELdWjrb60yWi9HdpkuKSITvWha4pONq4x88wKbpdB9k+uZctptekMIKExuFaPy1/AvIOUXeaVFxCJnY14fvT6O8EJRDPVprGiKah4FexCN8Us8vMZMOUrwRXUWF3sVEL6JxWoamgZirDv/+zjihTA1yrzgMeTNKT70Zg/D37vTapqLSBO/wxb23V83bD8bh3VG4Z0QeY8+BXaXC7jwEzCt8t4nt1d7Ziqu6IzzDRf1x1RW2YoH3vaqTjM5wkecUHyZpCG6jsT+RBTh4sOK2z5+/ay+uk0k3YYtW0mNksAarKPoh/8Bhypa7/qNpcD4=
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/related;
boundary="_004_DM5PR05MB31302645F6503A2E92A8191CC43E0DM5PR05MB3130namp_";
type="multipart/alternative"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id:
9df8e3da-93a5-482e-afed-08d6037c0f26
X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Aug 2018 13:27:48.2563
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 794e02db-234b-416b-a4e3-f6caed74de06
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR05MB3036
X-CMAE-Verdict: spam
X-CMAE-Score: 100
X-CMAE-Analysis: v=2.2 cv=Yb3N30Zf c=1 sm=1 tr=0 p=3ZjwRxQnAAAA:8
a=hZh4iLKdhF58aR3jzNI04g==:117 a=gy1v0Dzie5QA:10 a=rOhtlMVFSd4A:10
a=1ep11G6qA-YA:10 a=xqWC_Br6kY4A:10 a=dapMudl6Dx4A:10 a=zmVwjc9v8q8A:10
a=Tbely2v79S-1p_IH7AwA:9 a=CjuIK1q_8ugA:10 a=9bEdO6scgCIA:10
a=chuOFLwo73wA:10 a=2KX3iwCENBoA:10 a=yMhMjlubAAAA:8 a=SSmOFEACAAAA:8
a=vhqWiLM0QR2tXF_TacEA:9 a=okOrvQjJR9mQxvY3:21 a=gKO2Hq4RSVkA:10
a=UiCQ7L4-1S4A:10 a=hTZeC7Yk6K0A:10 a=frz4AuCg-hUA:10 a=LUFM9eM87TcA:10
a=1zLHRq9rx9Kcg_oBEtYA:9 a=KkSTjpL_G_2fit9M:18 a=HXjIzolwW10A:10
a=KwgpVZE-ergA:10 a=OQYAytABcVUol_NHXjI_:22
X-SPF-STATUS: pass
X-RDNS-STATUS: pass
X-SOURCE-IP: 104.47.38.116
Spam-Stopper-Id: 0edc3360-ca21-4d10-8e89-6df146b345c9
Spam-Stopper-v2: Yes
X-Spam-Score: 100
X-Spam-Reasons:
Cause=gggruggvucftvghtrhhoucdtuddrgedtjedrudelgdeiiecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucdtuddrgedtjedrtddtpdfkpffvgfftoffgfffktedpggftfghnshhusghstghrihgsvgenuceurghilhhouhhtmecufedttdenucenucfjughrpefhvffuthffkfhitgggsehrtddtredttddvnecuhfhrohhmpedfofhitghhrggvlhcuffdrucforghushculfhrrddfuceomhhmrghushesthhruhhtvghgrhgrrdgtohhmqeenucffohhmrghinhepthhruhhtvghgrhgrrdgtohhmnecukfhppeejgedrvdduledrudefrdelkedpuddtgedrgeejrdefkedrudduiedpfhgvkedtmeemvgdtvgdtmeeksgegfeemfegvfeehmeekudejkeenucevlhhushhtvghrufhiiigvpedt
To="exam...@example.com"
<exam...@example.com> From="Michael D. Maus Jr."
<mm...@trutegra.com>
X-AES-Category: SPAM
X-Spam-Category: LEGIT
Return-Path: mm...@trutegra.com
X-MS-Exchange-Organization-Network-Message-Id:
595fd5be-b8b4-4433-2a2f-08d6037c6f5c
X-MS-Exchange-Organization-AuthSource: MBX090-W4-CO-5.EXCH090.serverpod.net
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Exchange-Transport-EndToEndLatency: 00:00:00.5259771
X-MS-Exchange-Processed-By-BccFoldering: 15.01.1466.003
