At Tue Jul 29 08:35:26 2003, Erik van der Meulen wrote: [reformatted] > > As can be seen, there are 2 attachments 'original message before > SpamAssassin'. Interesting thing is that the 'content preview' of > one shows the SA disclaimer. Also, it frequently happens that in > (that I assume to be) the first pass the spam score is higher than > in the second, sometimes to the point where the message is > identified as spam the first time, but not the second! It ends up in
This is expected behaviour if mail is passed through SpamAssassin twice. On the first run through, if the message is considered spam, it is converted to an attachment to a new message. Now, bear in mind that SpamAssassin looks closely at the headers of messages, and can build up a fairly large score before it even looks at the body. When the new "tagged as spam" message is run through SpamAssassin, the original headers are now in the body, and the new headers are very innocuous (because SpamAssassin has generated them). Because the old headers are now in the attachment, they are treated as part of the body of the new mail and are not seen by the "header" rules. Hence the difference in scores. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://counter.li.org | mirror it ;)" - Linus Torvalds _\_V ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
