MUf> This was the point. If the line that should be matched with the rule is the
MUf> first one, AND the check is done before MTA adds Received: line (which is
MUf> case when the milter is used), this is an issue of the intermediate program
MUf> that feeds mail to spamassassin.
MUf> Now, Rainer, can you confirm this is the case?
what I can tell is the following:
- spamass-milter 0.3.1 is in use. this seems to be the most current
version.
- if I understand this conversation correctly: the line
"Received: from [192.168.5.238] (xyz.example.com [90.217.201.80])"
has already been passed to spamassassin (or been "virtually created"
when the regex rules are applied, but the following lines
(authenticated bits=0)
by myserver.mydomain.at (8.13.8/8.13.8) with ESMTP id s0VEsVIv028654
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
haven't. does this make sense? is this how SA is implemented?
I'll enable spamass-milter debug output and see if I can make any
sense of it.
cu
--- NOT sent from an iPhone