On Fri, Nov 08, 2024 at 10:25:27PM -0800, Randy Bush via Postfix-users wrote:
well, i have seen two `^X-Spam` markings
X-Spam: Yes
X-Spam-Flag: YES
which is why my regexp was `/^X-Spam.*YES/`. i believe, but do not
know, that the first is the mark of rspamd. no idea about the other.
> Was the milter actually running (listening on port 11332 and processing
> requests) at the time that the messages in question were delivered?
well, i do nto have a time machine, but ...
# lsof -i :11332
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rspamd 113457 _rspamd 67u IPv4 24865670 0t0 TCP localhost:11332
(LISTEN)
rspamd 113459 _rspamd 67u IPv4 24865670 0t0 TCP localhost:11332
(LISTEN)
I don't know aboud rspamd, but SpamAssassin may produce headers like:
X-Spam-Status: No, score=-1.9 required=3.5 tests=BAYES_00,DKIM_SIGNED,
which would positively match the OP's regexp:
/^X-Spam.*YES/
Which is why Viktor's regexp should be used instead:
On 09.11.24 18:04, Viktor Dukhovni via Postfix-users wrote:
# I generally use "pcre" rather than "regexp", and
#
header_checks = regexp:{ {/^X-Spam(-Flag)?:[[:blank:]]*YES/ REJECT} }
Just my 0.02€
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
I wonder how much deeper the ocean would be without sponges.
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
