Hi,
I've been having problems with a specific spammer lately. He's sending me about 300 mails a day and they're all passing right through my filtering. Part of the problem is this:
* -2.8 ALL_TRUSTED Did not pass through any untrusted hosts
SpamAssassin thinks the mail comes directly from my host's mailserver, but it's overlooking a Received header. I think it's because of the X-Virus-Scan header in between. However I have no control over than particular header.
Is the order of headers a RFC violation in some way, or is this a SA problem? A full example email is attached.
Return-path: <[EMAIL PROTECTED]>
Envelope-to: [EMAIL PROTECTED]
Delivery-date: Sun, 15 May 2005 23:10:18 +0200
Received: from localhost ([127.0.0.1] ident=root)
by hellfire.egelantier.subbot.net with esmtp (Exim 4.50)
id 1DXQNO-0005rW-55
for [EMAIL PROTECTED]; Sun, 15 May 2005 23:10:18 +0200
Delivered-To: [EMAIL PROTECTED]
Received: from 63.209.158.6 [63.209.158.6]
by localhost with POP3 (fetchmail-6.2.5)
for [EMAIL PROTECTED] (single-drop); Sun, 15 May 2005 23:10:18 +0200
(CEST)
Received: (qmail 5490 invoked by uid 399); 15 May 2005 21:06:00 -0000
X-Virus-Scan: Scanned by clamdmail 0.15 (no viruses);
Sun, 15 May 2005 17:06:00 -0400
Received: from unknown (HELO pkaffe.de) (71.34.15.142)
by mail.myhsphere.biz with SMTP; 15 May 2005 21:06:01 -0000
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Date: Sun, 15 May 2005 21:04:24 GMT
Subject: Vorbildliche Aktion
Importance: Normal
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
MIME-Version: 1.0
Message-ID: <[EMAIL PROTECTED]>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"
X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on
hellfire.egelantier.subbot.net
X-Spam-Level: *
X-Spam-Status: No, score=1.3 required=5.0 tests=ALL_TRUSTED,AWL,
MISSING_MIMEOLE,NO_DNS_FOR_FROM,NO_REAL_NAME,PRIORITY_NO_NAME,
RAZOR2_CF_RANGE_51_100 autolearn=disabled version=3.0.2
X-Spam-Report:
* 0.2 NO_REAL_NAME From: does not include a real name
* -2.8 ALL_TRUSTED Did not pass through any untrusted hosts
* 1.5 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence level above
50%
* [cf: 100]
* 1.1 NO_DNS_FOR_FROM DNS: Envelope sender has no MX or A DNS records
* 0.0 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE
* 1.2 PRIORITY_NO_NAME Message has priority, but no
X-Mailer/User-Agent
* 0.1 AWL AWL: From: address is in the auto white-list
Status: Lese selbst: http://www.npd.de/npd_info/deutschland/2004/d1204-24.html
