> > > > Thank you. I have this there. > > /^X-SPAM-FLAG:\s+YES/ REDIRECT s...@mycompany.com > > > > How can I keep this without wiping out the original header? > > This does not drop Recived: headers. You are dropping those headers > in some other way. > > Wietse
It turns out some emails arrive with Received header intact, others don't. Here is an example. The email is from walkinbathtub. It gets to me first and is delivered (with all Received headers removed). It looks like it gave spam score of 4.7 for me. It then is processed for the other user, 'otheruser'. Spam score of 8.8 for 'otheruser'. The email is redirected to spam mailbox successfully. The Received headers are in intact. Any idea which process is removing the Received headers? Thank you Durwin Jul 25 02:15:31 postfix/postscreen[25515]: PASS NEW [107.173.103.92]:53531 Jul 25 02:15:31 postfix/smtpd[25519]: warning: hostname 107-173-103-92-host.colocrossing.com does not resolve to address 107.173.103.92: Name or service not known Jul 25 02:15:31 postfix/smtpd[25519]: connect from unknown[107.173.103.92] Jul 25 02:15:31 postfix/postscreen[25515]: CONNECT from [198.16.88.118]:55051 to [172.23.93.23]:25 Jul 25 02:15:31 postfix/dnsblog[25517]: addr 198.16.88.118 listed by domain zen.spamhaus.org as 127.0.0.3 Jul 25 02:15:31 postfix/dnsblog[25518]: addr 198.16.88.118 listed by domain b.barracudacentral.org as 127.0.0.2 Jul 25 02:15:31 postfix/smtpd[25519]: C1C60A2DE9: client=unknown[107.173.103.92] Jul 25 02:15:31 postfix/cleanup[25523]: C1C60A2DE9: message-id=<0.0.0.1F.1D423FF9D63C2DE.27F46F@mail.happinesscesrs.review> Jul 25 02:15:31 postfix/qmgr[22970]: C1C60A2DE9: from=<walkinbathtub-durwin=mycompany.com@happinesscesrs.review>, size=6655, nrcpt=1 (queue active) Jul 25 02:15:31 postfix/postscreen[25515]: DNSBL rank 4 for [198.16.88.118]:55051 Jul 25 02:15:31 check[25273]: spamd: connection from localhost [::1]:43738 to port 783, fd 5 Jul 25 02:15:31 check[25273]: spamd: setuid to sa-milt succeeded Jul 25 02:15:31 postfix/smtpd[25525]: initializing the server-side TLS engine Jul 25 02:15:31 check[25273]: spamd: processing message <0.0.0.1F.1D423FF9D63C2DE.27F46F@mail.happinesscesrs.review> for sa-milt:979 Jul 25 02:15:31 postfix/smtpd[25519]: disconnect from unknown[107.173.103.92] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5 Jul 25 02:15:36 check[25273]: [ 2] [bootup] Logging initiated LogDebugLevel=3 to sys-syslog Jul 25 02:15:41 check[25273]: spamd: clean message (4.7/5.0) for sa-milt:979 in 9.7 seconds, 6525 bytes. Jul 25 02:15:41 check[25273]: spamd: result: . 4 - DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HTML_IMAGE_RATIO_04,HTML_MESSAGE,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,MPART_ALT_DIFF,RDNS_NONE,TRACKER_ID scantime=9.7,size=6525,user=sa-milt,uid=979,required_score=5.0,rhost=localhos> Jul 25 02:15:41 check[25263]: prefork: child states: II Jul 25 02:15:41 postfix/pickup[25470]: 9EBEFA2DF5: uid=979 from=<walkinbathtub-durwin=mycompany.com@happinesscesrs.review> Jul 25 02:15:41 postfix/cleanup[25523]: 9EBEFA2DF5: message-id=<0.0.0.1F.1D423FF9D63C2DE.27F46F@mail.happinesscesrs.review> Jul 25 02:15:41 postfix/pipe[25524]: C1C60A2DE9: to=<dur...@mycompany.com>, relay=spamassassin, delay=9.9, delays=0.11/0.01/0/9.7, dsn=2.0.0, status=sent (delivered via spamassassin service) Jul 25 02:15:41 postfix/qmgr[22970]: C1C60A2DE9: removed Jul 25 02:15:41 postfix/qmgr[22970]: 9EBEFA2DF5: from=<walkinbathtub-durwin=mycompany.com@happinesscesrs.review>, size=7113, nrcpt=1 (queue active) Jul 25 02:15:41 postfix/smtp[25530]: 9EBEFA2DF5: to=<dur...@mycompany.com>, relay=172.23.93.10[172.23.93.10]:25, delay=0.07, delays=0.04/0.01/0/0.02, dsn=2.0.0, status=sent (250 Message accepted for delivery) Jul 25 02:15:41 postfix/qmgr[22970]: 9EBEFA2DF5: removed Jul 25 02:15:54 postfix/postscreen[25515]: CONNECT from [107.173.103.92]:57886 to [172.23.93.23]:25 Jul 25 02:15:54 postfix/postscreen[25515]: PASS OLD [107.173.103.92]:57886 Jul 25 02:15:54 postfix/smtpd[25519]: warning: hostname 107-173-103-92-host.colocrossing.com does not resolve to address 107.173.103.92: Name or service not known Jul 25 02:15:54 postfix/smtpd[25519]: connect from unknown[107.173.103.92] Jul 25 02:15:55 postfix/smtpd[25519]: 2755FA2DE9: client=unknown[107.173.103.92] Jul 25 02:15:55 postfix/cleanup[25523]: 2755FA2DE9: message-id=<0.0.0.27.1D423EEA6BE83FC.21E930@mail.happinesscesrs.review> Jul 25 02:15:55 postfix/qmgr[22970]: 2755FA2DE9: from=<walkinbathtub-otheruser=mycompany.com@happinesscesrs.review>, size=6580, nrcpt=1 (queue active) Jul 25 02:15:55 check[25273]: spamd: connection from localhost [::1]:43746 to port 783, fd 5 Jul 25 02:15:55 check[25273]: spamd: setuid to sa-milt succeeded Jul 25 02:15:55 check[25273]: spamd: processing message <0.0.0.27.1D423EEA6BE83FC.21E930@mail.happinesscesrs.review> for sa-milt:979 Jul 25 02:15:55 postfix/smtpd[25519]: disconnect from unknown[107.173.103.92] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5 Jul 25 02:15:56 check[25273]: [ 2] [bootup] Logging initiated LogDebugLevel=3 to sys-syslog Jul 25 02:15:57 check[25273]: [ 3] mail 1 is not known spam. Jul 25 02:15:57 check[25273]: spamd: identified spam (8.8/5.0) for sa-milt:979 in 1.3 seconds, 6450 bytes. Jul 25 02:15:57 check[25273]: spamd: result: Y 8 - DCC_CHECK,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HTML_IMAGE_RATIO_04,HTML_MESSAGE,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,MPART_ALT_DIFF,RDNS_NONE,TRACKER_ID scantime=1.3,size=6450,user=sa-milt,uid=979,required_score=5.0,rhos> Jul 25 02:15:57 check[25263]: prefork: child states: II Jul 25 02:15:57 postfix/pickup[25470]: 37B74A2DF5: uid=979 from=<walkinbathtub-otheruser=mycompany.com@happinesscesrs.review> Jul 25 02:15:57 postfix/cleanup[25523]: 37B74A2DF5: redirect: header X-Spam-Flag: YES from local; from=<walkinbathtub-otheruser=mycompany.com@happinesscesrs.review> to=<otheru...@mycompany.com>: s...@mycompany.com Jul 25 02:15:57 postfix/cleanup[25523]: 37B74A2DF5: message-id=<0.0.0.27.1D423EEA6BE83FC.21E930@mail.happinesscesrs.review> Jul 25 02:15:57 postfix/pipe[25524]: 2755FA2DE9: to=<otheru...@mycompany.com>, relay=spamassassin, delay=2.1, delays=0.69/0/0/1.4, dsn=2.0.0, status=sent (delivered via spamassassin service) Jul 25 02:15:57 postfix/qmgr[22970]: 2755FA2DE9: removed Jul 25 02:15:57 postfix/qmgr[22970]: 37B74A2DF5: from=<walkinbathtub-otheruser=mycompany.com@happinesscesrs.review>, size=7954, nrcpt=1 (queue active) Jul 25 02:15:57 postfix/smtp[25530]: 37B74A2DF5: to=<s...@mycompany.com>, orig_to=<otheru...@mycompany.com>, relay=172.23.93.10[172.23.93.10]:25, delay=0.06, delays=0.04/0/0.01/0.01, dsn=2.0.0, status=sent (250 Message accepted for delivery) Jul 25 02:15:57 postfix/qmgr[22970]: 37B74A2DF5: removed This email message and any attachments are for the sole use of the intended recipient(s) and may contain proprietary and/or confidential information which may be privileged or otherwise protected from disclosure. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient(s), please contact the sender by reply email and destroy the original message and any copies of the message as well as any attachments to the original message.
