On Thu, Dec 01, 2011 at 02:02:31PM +0100, Martin von Wittich wrote: > The attached mail (I've redacted the body and the from/to local parts) is sent > with Outlook via a legitimate Windows Exchange server, but SpamAssassin marks > it as FORGED_MUA_OUTLOOK. Looks to me like the Message-ID has a format that > the > SA rules don't recognize?
Yep, I think your analysis is right. The __IMS_MUA rule should have fired, which would have marked this as a valid IMS message. If it had fired, then this would not have: meta __FORGED_OUTLOOK_DOLLARS (__OUTLOOK_DOLLARS_MUA && !__OE_MSGID_2 && !__OUTLOOK_DOLLARS_OTHER && !__VISTA_MSGID && !__IMS_MSGID && !__UNUSABLE_MSGID) which would in turn make this one not fire: meta FORGED_MUA_OUTLOOK ((__FORGED_OE || __FORGED_OUTLOOK_DOLLARS) && !__FMO_EXCL_O3416 && !__FMO_EXCL_OE3790 && !__VISTA_MSGID) I can confirm that this fp is still present the latest ruleset from sa-update. I'll follow up with upstream. noah
signature.asc
Description: Digital signature
