Hi,
> >> doesn't amavisd by any chance use old SA installation/libraries? > > On 30.05.22 15:12, Alex wrote: > >I don't think so - the current paths it uses are: > > > >/usr/share/spamassassin > >/var/lib/spamassassin/4.000000/updates_spamassassin_org > >/var/lib/spamassassin/4.000000/kam_sa-channels_mcgrail_com > >/etc/mail/spamassassin/ > > these are rules, not libraries. > Yes, I was responding to the "installation" part of your question. there is a possibility that you have multiple versions of SA installed and > amavis uses the old one. > > try running: > > % locate SpamAssassin.pm DMARC.pm > # locate SpamAssassin.pm DMARC.pm /usr/share/perl5/vendor_perl/Mail/DMARC.pm /usr/share/perl5/vendor_perl/Mail/SpamAssassin.pm /usr/share/perl5/vendor_perl/Mail/SpamAssassin/Plugin/DMARC.pm # ls -l /usr/share/perl5/vendor_perl/Mail/DMARC.pm /usr/share/perl5/vendor_perl/Mail/SpamAssassin.pm /usr/share/perl5/vendor_perl/Mail/SpamAssassin/Plugin/ DMARC.pm -rw-r--r-- 1 root root 18600 Dec 8 23:01 /usr/share/perl5/vendor_perl/Mail/DMARC.pm -r--r--r-- 1 root root 9752 May 29 11:14 /usr/share/perl5/vendor_perl/Mail/SpamAssassin/Plugin/DMARC.pm -r--r--r-- 1 root root 77572 May 29 11:14 /usr/share/perl5/vendor_perl/Mail/SpamAssassin.pm # rpm -qf /usr/share/perl5/vendor_perl/Mail/DMARC.pm perl-Mail-Dmarc-PurePerl-1.20211209-3.fc35.noarch # rpm -qf /usr/share/perl5/vendor_perl/Mail/SpamAssassin/Plugin/DMARC.pm spamassassin-4.0.0-85.fc35.x86_64 Those are both packages I've created and built for fedora and are based on existing fedora packages. >If I understand Kevin's comments correctly, we know there are still DMARC > >problems. I think maybe this is related? > > > >$ spamassassin -t -D DMARC < dmarc-reject1 2>&1|grep -i dmarc > >May 30 14:59:14.894 [1250699] dbg: DMARC: using Mail::DMARC::PurePerl for > >DMARC checks > >May 30 14:59:15.034 [1250699] dbg: DMARC: result: pass, disposition: none, > >dkim: pass, spf: fail (spf: pass, spf_helo: fail) > > DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DMARC_PASS, > > it hit DMARC_PASS, which is the opposite of DMARC_REJECT or > KAM_DMARC_REJECT. > I was referring to the "spf: fail" component of that, which appears to conflict with the "spf: pass" within the parentheses. Perhaps the first is result of the combination of the two checks (HELO and envelope)?
