On Sun, Mar 08, 2026 at 11:05:47AM +0000, Marc wrote:
> Received: xxxxxxxx Sat, 07 Mar 2026 17:27:31 +0100
> Received: xxxxxxxx Sat, 7 Mar 2026 17:27:31 +0100
> Received: xxxxxxxx Sat, 7 Mar 2026 17:27:30 +0100
> Received: xxxxxxxx Sat, 7 Mar 2026 17:27:27 +0100
>
> Date: Sat, 7 Mar 2026 17:27:27 +0100
Interesting, that seems matching within a few seconds; and certainly
not more than 96 hours difference.
Do you have a (shareable) sample of such mail which incorrectly gets
T_DATE_IN_FUTURE_96_Q score?
> X-Spam-Status: No, score=0.0 required=3.0 tests=HTML_FONT_SIZE_HUGE,
> HTML_MESSAGE,T_DATE_IN_FUTURE_96_Q autolearn=disabled version=4.0.2
> X-Spam-Checker-Version: SpamAssassin 4.0.2 (2025-08-27) on
> efd4de05-def8-4d42-993a-d063f2d5d2d7
>
>
> Has anyone else this? How is this T_DATE_IN_FUTURE_96_Q computed?
No, haven't seen that (except in very few cases with faked "Date" headers).
But then again, I'm not on SA 4.0.2...
% grep -rh T_DATE_IN_FUTURE_96_Q /var/lib/spamassassin/
##{ T_DATE_IN_FUTURE_96_Q ifplugin Mail::SpamAssassin::Plugin::HeaderEval
header T_DATE_IN_FUTURE_96_Q eval:check_for_shifted_date('96', '2920')
describe T_DATE_IN_FUTURE_96_Q Date: is 4 days to 4 months after Received:
date
##} T_DATE_IN_FUTURE_96_Q ifplugin Mail::SpamAssassin::Plugin::HeaderEval
According to description, it should be comparing "Date" header with "Received"
headers.
To debug, I'd look what "spamassassin -D -t" says, and perhaps add dbg()
in check_for_shifted_date() and _check_date_diff() if needed in
/usr/share/perl5/Mail/SpamAssassin/Plugin/HeaderEval.pm (or what have you).
> I have the impression this has maybe something to do with incorrect date /
> timezone detection inside a container.
Perhaps wrong date; but then the SA description is wrong, which seems
unlikely.
Or, it might be a bug with parsing date (or elsewhere in SA 4.2
HeaderEval.pm), but those headers you shared look pretty standard, so
it likely would be triggering all over the place, and not just on
your server mails.
Timezone should not be suspect in any case, as it cannot make more
than 24h error, and this claims 96+ hours error.
But my best guess would be that you missed some multiline Received
header with different time, or duplicate Date or something. Or
something changed headers between SA input and the mail you are
checking.
Anyway, as I said, sharing a sample mail might be good first step.
--
Opinions above are GNU-copylefted.
