Are you sure that the subject rewriting is occurring at your server? I've seen similar problems when the sending mail server marked it as spam on the way out. Your amavis hits clearly show a different score.
Rgds, Magnus -----Original Message----- From: Paul Ryan [mailto:[EMAIL PROTECTED] Sent: Wednesday, 28 June, 2006 20:27 To: users@spamassassin.apache.org Subject: Whitelisted, but still marked spam?! List - I did quite a bit of searching, but didn't find anything relevant. Basically I have a user on a mailing list that is getting an email which they do receive but it's marked as spam in the subject. I've placed the sender in the manual whitelist (local.cf), but it doesn't work, it still rewrites the subject. Below I've included relevant info, but have change the names and locations to protect the innocent. You can see it gets a score of 5.1/5.0 despite the hits being -98.509. The user is still getting the email, so functionally it's not a 'problem', but I don't understand why it's doing this and where it's catching it. TIA for taking a look. System: SpamAssassin version 3.0.4 running on Perl version 5.8.6 Linux 2.6.8.1-24mdksmp #1 SMP Thu Jan 13 23:11:43 MST 2005 i686 Pentium III (Coppermine) unknown GNU/Linux - actually Mandriva Email Header: Return-Path: <[EMAIL PROTECTED]> Received: from localhost (trident.my-domain.com [xxx.yyy.zzz.4]) by mail.my-domain.com (Postfix) with ESMTP id 8AB5C4FB30 for <[EMAIL PROTECTED]>; Tue, 27 Jun 2006 05:33:49 -0500 (CDT) Received: from mail.my-domain.com ([xxx.yyy.zzz.1]) by localhost (trident.my-domain.com [xxx.yyy.zzz.4]) (amavisd-new, port 10025) with LMTP id 19482-02-9 for <[EMAIL PROTECTED]>; Tue, 27 Jun 2006 05:33:47 -0500 (CDT) Received: from rydia.2square.com (unknown [###.###.###.###]) by mail.my-domain.com (Postfix) with ESMTP id D6D894FB19 for <[EMAIL PROTECTED]>; Tue, 27 Jun 2006 05:33:43 -0500 (CDT) Authentication-Results: rydia.2square.com [EMAIL PROTECTED]; ip-match=fail Authentication-Results: rydia.2square.com [EMAIL PROTECTED]; domainkeys= (no key) Received: from mail.abc.net (mail.abc.de [###.###.###.###]) by rydia.2square.com (rydia.2square.com) (MDaemon.PRO.v8.1.3.R) with ESMTP id md50000011711.msg for <[EMAIL PROTECTED]>; Tue, 27 Jun 2006 05:34:01 -0500 Received: (qmail 16011 invoked by alias); 27 Jun 2006 10:33:31 -0000 Delivered-To: GMX delivery to [EMAIL PROTECTED] Received: (qmail 15662 invoked by uid 0); 27 Jun 2006 10:33:29 -0000 Received: from 80.135.191.239 by www086.abc.net with HTTP; Tue, 27 Jun 2006 12:33:30 +0200 (CEST) Content-Type: text/plain; charset="utf-8" Date: Tue, 27 Jun 2006 12:33:30 +0200 From: [EMAIL PROTECTED] Message-ID: <[EMAIL PROTECTED]> MIME-Version: 1.0 Subject: [***SPAM*** Score/Req: 05.1/5.0] GN'R 452 / AXL STILL UNDER ARREST To: [EMAIL PROTECTED] X-Authenticated: #6748436 X-Mailer: WWW-Mail 6100 (Global Message Exchange) X-Priority: 3 Content-Transfer-Encoding: 8bit X-Lookup-Warning: MAIL lookup on [EMAIL PROTECTED] does not match ###.###.###.### X-MDRcpt-To: [EMAIL PROTECTED] X-Rcpt-To: [EMAIL PROTECTED] X-MDRemoteIP: 213.165.64.21 X-Return-Path: [EMAIL PROTECTED] X-Spam-Prev-Subject: GN'R 452 / AXL STILL UNDER ARREST X-Spam-Processed: rydia.2square.com, Tue, 27 Jun 2006 05:34:03 -0500 X-MDAV-Processed: rydia.2square.com, Tue, 27 Jun 2006 05:34:04 -0500 X-MDRedirect: 1 X-MDaemon-Deliver-To: [EMAIL PROTECTED] X-Virus-Scanned: amavisd-new at my-domain.com Mail Log: Jun 27 05:33:53 trident amavis[19482]: (19482-02-9) Passed CLEAN , [###.###.###.###] <[EMAIL PROTECTED]> -> <[EMAIL PROTECTED]> , Message-ID: <[EMAIL PROTECTED]> , Hits: -98.509 , tests=AWL,BAYES_20,BIZ_TLD,NO_REAL_NAME,USER_IN_WHITELIST
