On Mon, 14 Jan 2013 13:24:55 -0500
Ben Johnson wrote:
> A clear pattern has emerged: the X-Spam-Status headers for very
> obviously spammy messages never contain evidence that network tests
> contributed to their SA scores.
>
> Ultimately, I need to know whether:
>
> a.) Network tests are not being run at all for these messages
>
> b.) Network tests are being run, but are failing in some way
>
> c.) Network tests are being run, and are succeeding, but return
> responses that do not contribute to the messages' scores
>
> I've had a look at the log entries to which I link in my previous
> message and I just need a little help interpreting the "dns" and
> "async" messages.
As I said before, it's not unusual for snowshoe spam to hit no net
tests at all. Also obvious spam isn't any more likely to be in a
blocklist than less obvious spam.
However, try adding this to your SpamAssassin configuration, and
restart the appropriate daemon:
header RCVD_IN_HITALL eval:check_rbl('hitall-lastexternal',
'ipv4.fahq2.com.')
tflags RCVD_IN_HITALL net
score RCVD_IN_HITALL 0.001
It should add a dns test that is hit for all mail delivered from an
IPv4 address.
