On Mon, 14 Jan 2013 13:24:55 -0500 Ben Johnson wrote:
> A clear pattern has emerged: the X-Spam-Status headers for very > obviously spammy messages never contain evidence that network tests > contributed to their SA scores. > > Ultimately, I need to know whether: > > a.) Network tests are not being run at all for these messages > > b.) Network tests are being run, but are failing in some way > > c.) Network tests are being run, and are succeeding, but return > responses that do not contribute to the messages' scores > > I've had a look at the log entries to which I link in my previous > message and I just need a little help interpreting the "dns" and > "async" messages. As I said before, it's not unusual for snowshoe spam to hit no net tests at all. Also obvious spam isn't any more likely to be in a blocklist than less obvious spam. However, try adding this to your SpamAssassin configuration, and restart the appropriate daemon: header RCVD_IN_HITALL eval:check_rbl('hitall-lastexternal', 'ipv4.fahq2.com.') tflags RCVD_IN_HITALL net score RCVD_IN_HITALL 0.001 It should add a dns test that is hit for all mail delivered from an IPv4 address.