Thank you Matt!
Your letter helped me to understand my problem better. I`m not using sa-spamc, my exim using ACL spam, that connects directly to spamd ip/port. My founded solution was described in Exim FAQ: A0512: Envelope-To: is added at delivery time, by the transport. Therefore, the header doesn't exist at filter time. In a user filter, the values you probably want are in $original_local_part and $original_domain. In a system filter, the complete list of all envelope recipients is in $recipients. Incorrect lines - commented, now working config of ACL spam looks like: warn message = X-Spam-Score: $spam_score ($spam_bar) spam = $recipients # spam = $h_to warn message = X-Spam-Report: $spam_report spam = $recipients # spam = $h_to > Stop passing extra garbage in the -u parameter to spamc? > The "some text" part can't legally occur in a RCPT TO: command (which is > not a header). Did you mean are you extracting the entire contents of > the To: header? > spamc isn't designed to parse all that extra data off, username or > usern...@domain only. > I'd try to find a way to get the RCPT TO not the To: anyway. The To: > header might not contain the actual recipient and isn't a useful header > for selecting user prefs. (i.e.: posts sent to mailing lists are RCPT > TO: you, but they are To: the list) This is precisely why SA doesn't try > to parse the To: header and use that for selecting prefs.. It is often > misleading. >> But I found a bug, when I`m using whitelist, and header rcpt to: have >> address with character description, whitelist failed to catch it in >> database. For example: >> >> 1st message: >> spamd: clean message (-91.7/10.0) for t...@localdomain.com:501 in 8.2 >> seconds, 13522829 bytes. >> >> 2nd message: >> spamd: identified spam (9.2/5.0) for some text <t...@localdomain.com>:501 in >> 8.3 seconds, 14874071 bytes. Thank you! Wbr, Good luck with spam fight!