On 7/2/06, QQQQ <[EMAIL PROTECTED]> wrote:
I'm not 100% positive this is even a SA issue but it is driving me up the wall.
Some mailings are having this added right after the
SA report. It usually isn't an issue except that some user fetch their mail
from Exchange and these mailings are showing up munged.
Did you recently change from SA 3.0 or earlier to 3.1? In 3.1 SA
began inserting its headers at the TOP of the filtered message header,
rather than at the end. This is more closely conformant to the IETF
mail standards and helps reduce breakage of message signature schemes
such as DKIM.
The point is that you may have had a problem with mail processing for
a while, and the behavior of earlier versions of SA simply masked it.
X-Spam-Report:
* 1.5 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
* 1.8 FUZZY_AFFORDABLE BODY: Attempt to obfuscate words in spam
*ALL rules removed for simplicity*
>From userid Sun Jul 2 23:47:35 2006
Return-Path: [EMAIL PROTECTED]
Received: from k5u5r1
See the >From header?
In all likelyhood this was a "From " line (with no leading ">") at the
time SA was handed the message, and was rewritten as a ">From " line
by the local delivery processing after SA was already finished with
the message. The latter part is correct if the mail is going to be
placed in a unix-style flat-file mailbox, but the former is wrong:
The "From " line, if any, should not be added until final delivery of
the message to the mailbox file.
Look at the processing that's upstream of spamassassin or spamc. In
particular check whether the message is ever written to a file and
then read back in to the processing stream. The culprit is likely to
be whatever does that write.
