Loren Wilton wrote: >> So it doesn't happen that often. I did try writing an SA header rule >> for these first, but it appears that SA strips out 'X-Spam-Flag' >> headers out before the rules are run. > > SA Strips out X-Spam-* on the assumption that it previously added > them. Previous to 3.0 it did this before the rules ran on the text. > Now I think you can still get to them with full rules, but I think > they are still stripped from normal header rules. > > If you have something like procmail in the chain before SA you can > change incoming X-Spam-* to something like X-PreviousSpam-* and end up > with them present to scan.
and if using postfix, a header_checks like this: /^(X-Spam-.*)/ REPLACE X-$1 will rename them to X-X-Spam-* which can then be used in SA rules (or other rules).
