I emailed this out Friday and haven't seen any replies. Not sure if it was
missed, but I'd appreciate any help anyone can give. This problem seems to
be afflicting one specific users for some issue. The user in question is
[EMAIL PROTECTED] - maybe the hyphen is screwing things up? I
have no idea ;-P
If you need any more information please let me know!
Hi All,
I have a (hopefully) unique problem where it appears that a small percentage
of the email coming in are not being assigned a score. In fact, the headers
look messed up.
I've been running SpamAssassin for a 150 user company for some time now with
great results. The system runs on:
Qmail-1.03
SpamAssassin 2.61
Qmail-Scanner-1.20
ClamAV-0.65
We tag emails that score over 5 and forward them to users. A complete run
down of the score is included in every email - spam or not. In these cases
though, I cannot see the score at all, though it is definitely passing
through our spam gateway (cygnus).
Here are some of the headers I've received - this is somewhat of an anomaly
though, as it seems to work for everyone else in the organization. We do
not configure on a per user basis. There is a properly tagged email at the
end.
-------------------------------
Return-Path:
<[EMAIL PROTECTED]
ketonline.com>
Received: from spambox.mydomain.com (205.189.158.134) by mydomain.com with
SMTP
(Eudora Internet Mail Server 3.2.1) for <[EMAIL PROTECTED]>;
Thu, 22 Jan 2004 17:40:18 -0500
Received: (qmail 14115 invoked by uid 104); 22 Jan 2004 17:40:18 -0500
Received: from
[EMAIL PROTECTED]
etonline.com by spambox.mydomain.com by uid 100 with qmail-scanner-1.20st
(clamscan: 0.65. spamassassin: 2.60.
Clear:RC:0(69.6.16.123):SA:0(Received: from 23.bluerocketonline.com
(69.6.16.123)/?):.
Processed in 4.794342 secs); 22 Jan 2004 22:40:18 -0000
X-Spam-Status: No, hits=Received: from 23.bluerocketonline.com (69.6.16.123)
required=?
Received: from 23.bluerocketonline.com (69.6.16.123)
by spambox.mydomain.com with SMTP; 22 Jan 2004 17:40:13 -0500
Received: (from [EMAIL PROTECTED])
by 23.bluerocketonline.com (8.8.8/8.8.8) id LAA43990;
Thu, 22 Jan 2004 11:58:18 -0800 (PST)
Date: Thu, 22 Jan 2004 14:41:52 -0800 (PST)
Message-Id: <[EMAIL PROTECTED]>
From: AD Kessler <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: 10,000 a Month
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="MIME_BOUNDARY-6598-0-1074794163"
---------------------------------------------------------
Return-Path:
<[EMAIL PROTECTED]>
Received: from spambox.mydomain.com (205.189.158.134) by mydomain.com with
SMTP
(Eudora Internet Mail Server 3.2.1) for <[EMAIL PROTECTED]>;
Fri, 23 Jan 2004 02:53:22 -0500
Received: (qmail 15061 invoked by uid 104); 23 Jan 2004 02:53:22 -0500
Received: from
[EMAIL PROTECTED] by
spambox.mydomain.com by uid 100 with qmail-scanner-1.20st
(clamscan: 0.65. spamassassin: 2.60.
Clear:RC:0(69.6.28.135):SA:0(Received: from 20.pntaa.com (69.6.28.135)/?):.
Processed in 0.998673 secs); 23 Jan 2004 07:53:22 -0000
X-Spam-Status: No, hits=Received: from 20.pntaa.com (69.6.28.135) required=?
Received: from 20.pntaa.com (69.6.28.135)
by spambox.mydomain.com with SMTP; 23 Jan 2004 02:53:21 -0500
Received: (from [EMAIL PROTECTED])
by 20.pntaa.com (8.8.8/8.8.8) id SAA17094;
Thu, 22 Jan 2004 18:31:29 -0800 (PST)
Date: Thu, 22 Jan 2004 18:48:29 -0800 (PST)
Message-Id: <[EMAIL PROTECTED]>
From: Dish Management <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-info: Please report complaints to [EMAIL PROTECTED]
X-info: All e-mails sent through this system contains full working
unsubscription info.
Subject: Free Digital Video Recorder & 3 Free Months of Dish Network
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="MIME_BOUNDARY-18751-0-1074830530"
----------------------------------------------------------------------------
-------------
Return-Path:
<[EMAIL PROTECTED]
ketonline.com>
Received: from spambox.mydomain.com (205.189.158.134) by mydomain.com with
SMTP
(Eudora Internet Mail Server 3.2.1) for <[EMAIL PROTECTED]>;
Thu, 22 Jan 2004 20:28:13 -0500
Received: (qmail 25275 invoked by uid 104); 22 Jan 2004 20:28:13 -0500
Received: from
[EMAIL PROTECTED]
etonline.com by spambox.mydomain.com by uid 100 with qmail-scanner-1.20st
(clamscan: 0.65. spamassassin: 2.60.
Clear:RC:0(69.6.16.125):SA:0(Received: from 25.bluerocketonline.com
(69.6.16.125)/?):.
Processed in 1.421739 secs); 23 Jan 2004 01:28:13 -0000
X-Spam-Status: No, hits=Received: from 25.bluerocketonline.com (69.6.16.125)
required=?
Received: from 25.bluerocketonline.com (69.6.16.125)
by spambox.mydomain.com with SMTP; 22 Jan 2004 20:28:12 -0500
Received: (from [EMAIL PROTECTED])
by 25.bluerocketonline.com (8.8.8/8.8.8) id QAA41643;
Thu, 22 Jan 2004 16:22:34 -0800 (PST)
Date: Thu, 22 Jan 2004 17:24:27 -0800 (PST)
Message-Id: <[EMAIL PROTECTED]>
From: Tail Wagging Offers News Letter
<[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject:
=?iso-8859-1?B?My44NzUlIEZpeGVkIE1vcnRnYWdlIGZvciBKdW1ibyBMb2Fuc5I=?=
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
----------------------------------------------------------------------------
---
Return-Path:
<[EMAIL PROTECTED]
m>
Received: from spambox.mydomain.com (205.189.158.134) by mydomain.com with
SMTP
(Eudora Internet Mail Server 3.2.1) for <[EMAIL PROTECTED]>;
Fri, 23 Jan 2004 03:27:04 -0500
Received: (qmail 16880 invoked by uid 104); 23 Jan 2004 03:27:03 -0500
Received: from
[EMAIL PROTECTED]
by spambox.mydomain.com by uid 100 with qmail-scanner-1.20st
(clamscan: 0.65. spamassassin: 2.60. Clear:RC:0(69.6.39.11):SA:0(Received:
from 41.postnote.com (69.6.39.11)/?):.
Processed in 2.038251 secs); 23 Jan 2004 08:27:03 -0000
X-Spam-Status: No, hits=Received: from 41.postnote.com (69.6.39.11)
required=?
Received: from 41.postnote.com (69.6.39.11)
by spambox.mydomain.com with SMTP; 23 Jan 2004 03:27:01 -0500
Received: (from [EMAIL PROTECTED])
by 41.postnote.com (8.8.8/8.8.8) id SAA18495;
Thu, 22 Jan 2004 18:21:52 -0800 (PST)
Date: Thu, 22 Jan 2004 18:26:44 -0800 (PST)
Message-Id: <[EMAIL PROTECTED]>
From: Your New Car <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-info: Please report complaints to [EMAIL PROTECTED]
X-info: All e-mails sent through this system contains full working
unsubscription info.
Subject: Car Loans
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="MIME_BOUNDARY-24539-0-1074840363"
Here is a normal spam that was tagged by our system:
----------------------------------------------------------------------------
-----------
Return-Path: <[EMAIL PROTECTED]>
Received: from spambox.mydomain.com (205.189.158.134) by mydomain.com with
SMTP
(Eudora Internet Mail Server 3.2.1) for <[EMAIL PROTECTED]>;
Fri, 23 Jan 2004 13:00:05 -0500
Received: (qmail 31075 invoked by uid 104); 23 Jan 2004 13:00:04 -0500
Received: from [EMAIL PROTECTED] by spambox.mydomain.com by uid 100 with
qmail-scanner-1.20st
(clamscan: 0.65. spamassassin: 2.60.
Clear:RC:0(166.114.5.50):SA:1(32.7/5.0):.
Processed in 15.885335 secs); 23 Jan 2004 18:00:04 -0000
Received: from unknown (HELO 205.189.158.134) (166.114.5.50)
by spambox.mydomain.com with SMTP; 23 Jan 2004 12:59:48 -0500
Received: from 249.229.63.112 by 166.114.5.50; Fri, 23 Jan 2004
03:52:00 -0200
Message-ID: <[EMAIL PROTECTED]>
X-Habeas-SWE-1: winter into spring
X-Habeas-SWE-2: brightly anticipated
X-Habeas-SWE-3: like Habeas SWE (tm)
X-Habeas-SWE-4: Copyright 2002 Habeas (tm)
X-Habeas-SWE-5: Sender Warranted Email (SWE) (tm). The sender of this
X-Habeas-SWE-6: email in exchange for a license for this Habeas
X-Habeas-SWE-7: warrant mark warrants that this is a Habeas Compliant
X-Habeas-SWE-8: Message (HCM) and not spam. Please report use of this
X-Habeas-SWE-9: mark in spam to <http://www.habeas.com/report/>.
From: "Josie Zavala" <[EMAIL PROTECTED]>
Reply-To: "Josie Zavala" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: [QSPAM] Real buy # X+A+Nax ; :P:ntermin > V1agr@ ~ So:m:a &
Val:i:um Lots on stocks. oirkcqBm
Date: Fri, 23 Jan 2004 00:00:00 -0600
X-Mailer: Endymion MailMan Professional Edition v3.0.14 ISU Version mp6.15
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="--86720013983828190760"
X-Priority: 5
X-Spam-Flag: YES
X-Spam-Report:
* 1.5 RCVD_NUMERIC_HELO Received: contains a numeric HELO
* 0.1 HTML_MESSAGE BODY: HTML included in message
* 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.0000]
* 0.1 HTML_70_80 BODY: Message is 70% to 80% HTML
* 0.1 HTML_FONTCOLOR_UNSAFE BODY: HTML font color not in safe 6x6x6
palette
* 0.3 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* 0.1 BIZ_TLD URI: Contains a URL in the BIZ top-level domain
* 4.1 FORGED_RCVD_NET_HELO Host HELO'd using the wrong IP network
* 1.6 NO_DNS_FOR_FROM Domain in From header has no MX or A DNS
records
* 0.7 RCVD_IN_DSBL RBL: Received via a relay in list.dsbl.org
* [<http://dsbl.org/listing?ip=166.114.5.50>]
* 1.5 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in
bl.spamcop.net
* [Blocked - see
<http://www.spamcop.net/bl.shtml?166.114.5.50>]
* 16 HABEAS_VIOLATOR RBL: Has Habeas warrant mark and on Infringer
List
* [166.114.5.50 listed in sa-hil.habeas.com]
* 1.1 MIME_HTML_ONLY_MULTI Multipart message only has text/html
MIME parts
X-Spam-Status: Yes, hits=32.7 required=5.0 tests=BAYES_99,BIZ_TLD,
FORGED_RCVD_NET_HELO,HABEAS_VIOLATOR,HTML_70_80,HTML_FONTCOLOR_UNSAFE,
HTML_MESSAGE,MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,NO_DNS_FOR_FROM,
RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_DSBL,RCVD_NUMERIC_HELO autolearn=spam
version=2.61
X-Spam-Level: ********************************
X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on
spambox.mydomain.com
Thanks for your input - it's much appreciated!
James
-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
