> On 2022-01-20 at 16:21:40 UTC-0500 (Thu, 20 Jan 2022 16:21:40 -0500) > Joe Acquisto-j4 <j...@j4computers.com> > is rumored to have said: > . . . . . > To figure out what matched, you'll need to check a message with the > "rules" debug channel on: > > spamassassin -t -D rules < suspect.eml > > HOWEVER: In looking at your message, I'm 99.9% sure that what matched > was a Received header recording a client calling itself simply 'mail' > using an RFC1918 IP address which is also constructing a Message-Id > using just 'mail' as the hostname part. Whatever that machine is, it > should be using a FQDN instead of a bare hostname. Also, you could (and > probably should) add that machine to your internal_networks setting, > since an RFC1918 address is pretty much the definition of internal. > > > > -- > Bill Cole > b...@scconsult.com or billc...@apache.org > (AKA @grumpybozo and many *@billmail.scconsult.com addresses) > Not Currently Available For Hire
Thanks for the debug tip. I've meant to fix that "mail" issue for some time. guess now is as good as any. Anyway the original whine has been resolved. joe a.
