We're running SpamAssassin 2.63 with amavisd-new-20030616-p5 and postfix as
a frontend to our Exchange server (yes, it all needs to be updated, but
still working damn well). SA/amavisd-new tags all mail with scores (dropping
stuff with scores over 20), and it's up to Exchange rules to filter to Spam
folders for the end users.
A few months ago I started to see an occasional email come through to the
client with the X-Spam headers showing up in the body of the email rather
than the header (and since the rules trigger on the header, not getting
filtered as spam by the client rules).
Attached is an example of one of these emails. It appears that there is a
space between the original header and the X-Spam headers, which I think is
what is causing the client to consider the space to mark the beginning of
the body.
Anyone seen this? The email shows up in the Outlook client with this at the
top, followed by the pharmeceutical spam pitch:
X-Spam-Status: Yes, hits=12.6 tagged_above=-999.0 required=5.0 tests=AWL,
BANG_GUARANTEE, BAYES_99, DATE_IN_FUTURE_03_06, J_CHICKENPOX_28,
RCVD_IN_SBL,
SARE_OBFUMONEY2, TW_NW
X-Spam-Level: ************
X-Spam-Flag: YES
The strange thing is when I copy this deformed email back to the Exchange
server (using IMAP), that Outlook then seems to decide that the X-Spam stuff
*is* part of the header after all and the Outlook client doesn't show the
X-Spam stuff in the body of the email... even though on initial delivery it
was in the body.... so not sure if this is a problem in SA, amavsd-new, or
Exchange/Outlook.
Pretty annoying to have SA properly tag something, but have it come through
anyway... I'm hoping someone else has seen this (I was unable to turn up
anything in the archives).
thanks!
johnS
>From [EMAIL PROTECTED] Thu Apr 21 23:16:10 2005
Return-Path: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
Received: from localhost (localhost.heurikon.com [127.0.0.1])
by spaminator.heurikon.com (Postfix) with ESMTP id 90DB218386
for <[EMAIL PROTECTED]>; Thu, 21 Apr 2005 23:16:09 -0500 (CDT)
Received: from spaminator.heurikon.com ([127.0.0.1])
by localhost (spaminator.heurikon.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 10967-10 for <[EMAIL PROTECTED]>;
Thu, 21 Apr 2005 23:16:05 -0500 (CDT)
Received: from bratwurst.heurikon.com (frankfurterINT.heurikon.com [10.64.49.2])
by spaminator.heurikon.com (Postfix) with ESMTP id C9BCF18327
for <[EMAIL PROTECTED]>; Thu, 21 Apr 2005 23:16:04 -0500 (CDT)
Received: by bratwurst.heurikon.com (Postfix)
id 78E7C15057; Thu, 21 Apr 2005 23:16:04 -0500 (CDT)
Delivered-To: [EMAIL PROTECTED]
Received: from 66.63.172.147 (unknown [66.63.172.147])
by bratwurst.heurikon.com (Postfix) with SMTP id E424F15015
for <[EMAIL PROTECTED]>; Thu, 21 Apr 2005 23:16:03 -0500 (CDT)
Date: Fri, 22 Apr 2005 03:16:51 -0500
From: "Bradley" <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Message-ID: <[EMAIL PROTECTED]@svcaffil.com>
To: [EMAIL PROTECTED]
Subject: Total CH0LESTEROL and TRIGLYCERIDES Slashed up to 35% in Clinical
Trial!
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit
X-Spam-Status: Yes, hits=12.6 tagged_above=-999.0 required=5.0 tests=AWL,
BANG_GUARANTEE, BAYES_99, DATE_IN_FUTURE_03_06, J_CHICKENPOX_28, RCVD_IN_SBL,
SARE_OBFUMONEY2, TW_NW
X-Spam-Level: ************
X-Spam-Flag: YES
RESPECTED MD DISCOVERS NATURE'S WAY TO LOWER CHOLESTEROL!
Clinically Tested - Mone[y] Back Guarantee!!
"Cholesterol down 172 points."
"Cholesterol down 31 points in one month."
"100 point reduction on total cholesterol!"
"35% reduction on total cholesterol and Triglycerides. 43% reduction on LDL."
" 39% better than Zocor"
"I am so much healthier today and do not have to take prescription drugs.
- Thank you". Bern M Delray Indio, CA
Get the facts here -
http://www.svcaffil.com/ch1/index.htm
This is an adver[t]isement.
To be eliminated from any future special offers about Cholesterol Balance,
please copy and paste this link into your browser -
secure1.m57media.com/clients/p2c/admin/Unsubscribe.aspx?stID=16
and enter your email address.
You can also mail us at:
Nutraceuticals LLC
378 Main Street
East Greenwich, RI 02818
To be erased from the sender's list do not reply to this email.
Copy and paste this link into your browser - infodele.com/nrmm.htm
Computer Technologies
848 N.Rainbow Blvd.#316
Las Vegas, NV 89107GkElfhhbBehqtdbwxCjwyUi .
grease greed greenbriar greatcoat greenery greene greenberg.
greenfield greenhouse greene greene greedy greatcoat greenbriar.
greedy greenbelt green greenberg greenblatt greenberg greenfield.
greek great grayish GkErlnnhBknwzjhdeCpdfUi greenblatt greenbriar.
greedy greengrocer great greater greengrocer greenberg grecian.
graze greek grease greatcoat graywacke greasy grayish.
greater graze graywacke greenblatt greedy grecian greenbelt.
greasy graze greed greatcoat green great greed.
