Dirk, I noticed that same effect while reading this list (sa-talk). Turns out it was my flawed attempt at processed emails only once by spamassassin. My faulty logic in procmail skipped piping through spamassassin if the header X-Spam-Status already existed.
Since some of the emails from this list had already been processed by somebody else's spamassassin (the sender's perhaps?) and had the X-Spam-Status header, my procmail rule bypassed the spamassassin filter. I don't remember where I got the idea to skip spamassassin if the X-Spam-Status header was set, but I believe I found it somebody's reference page long ago. If that's the case, some spammers may have picked up on this as well and added their own X-Spam-Status header, or perhaps you are seeing some processing happening upstream... Based on the high score of your example (6.3), the latter seems more likely. In any case, I've changed my setup to skip filtering only if my custom header exists (which indicates my local spamassassin has processed the email), as follows: # SpamAssassin spam check. :0 f * ! ^X-CUSTOMTHINGGY-SA: * < 256000 | formail -fa "X-CUSTOMTHINGGY-SA: Yes" | /usr/bin/spamassassin Then again I'm probably way off-base. -chris Dirk Nienhaus said: > Hello, > i have a question. Normaly sa works find and the mail header of a spam > mail is like this: > > X-Spam-Flag: YES > X-Spam-Status: Yes, hits=5.7 required=5.0 > tests=BANG_MORE,BARGAIN_URL,CLICK_BELOW,FORGED_MUA_OIMO, > HTML_50_60,HTML_IMAGE_ONLY_08,HTML_IMAGE_RATIO_06, > HTML_MESSAGE,HTML_WEB_BUGS > version=2.55 > X-Spam-Level: ***** > X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp) > > But sometimes spam mail is not known as spam because the required-value > is set to 9999.0. Like this mail: > > X-Spam-Status: No, hits=6.3 required=9999.0 > tests=CLICK_BELOW_CAPS,DOMAIN_4U2,EXCUSE_14,HTML_50_60, > HTML_LINK_CLICK_HERE,HTML_MESSAGE,HTML_SHOUTING3, > MIME_BOUND_MA,OFFER,OFFERS_ETC,OPT_IN,TO_MALFORMED, > WHILE_SUPPLIES > version=2.55 > X-Spam-Level: ****** > X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp) > > I don't understand this. Can someone help me, please? :) > > -- > MfG > D. Nienhaus > _________________ > [EMAIL PROTECTED] ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
