more logs
Oct 1 13:22:20 mail amavis[17226]: (17226-02) LMTP< RCPT
TO:<u...@example.com> ORCPT=rfc822;u...@example.com\r\n
Oct 1 13:22:20 mail amavis[17226]: (17226-02) LMTP> 250 2.1.5 Recipient
u...@example.com OK
Oct 1 13:22:20 mail amavis[17226]: (17226-02) LMTP::10024
/var/lib/amavis/tmp/amavis-20091001T131825-17226:
<mohsinaliz...@hotmail.com> -> <moh...@example.com>,<u...@example.com>
SIZE=1911 Received: from mail.example.com ([127.0.0.1]) by localhost
(mail.example.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP; Thu, 1
Oct 2009 13:22:20 +0600 (PKST)
Oct 1 13:22:20 mail amavis[17226]: (17226-02) Checking: k-6-c3dQQGNL
<mohsinaliz...@hotmail.com> -> <moh...@example.com>,<u...@example.com>
Oct 1 13:22:20 mail amavis[17226]: (17226-02) query_keys: u...@example.com,
user@, example.com, .example.com, .com.pk, .pk, .
Oct 1 13:22:20 mail amavis[17226]: (17226-02)
lookup_hash(u...@example.com), no matches
Oct 1 13:22:20 mail amavis[17226]: (17226-02) lookup (bypass_virus_checks)
=> undef, "u...@example.com" does not match
Oct 1 13:22:20 mail amavis[17226]: (17226-02) lookup (bypass_header_checks)
=> true, "u...@example.com" matches, result="1",
matching_key="(constant:1)"
Oct 1 13:22:20 mail amavis[17226]: (17226-02) query_keys: u...@example.com,
user@, example.com, .example.com, .com.pk, .pk, .
Oct 1 13:22:20 mail amavis[17226]: (17226-02)
lookup_hash(u...@example.com), no matches
Oct 1 13:22:20 mail amavis[17226]: (17226-02) lookup (bypass_banned_checks)
=> undef, "u...@example.com" does not match
Oct 1 13:22:20 mail amavis[17226]: (17226-02) lookup (banned_filename), 1
matches for "u...@example.com", results: "(constant:DEFAULT)"=>"DEFAULT"
Oct 1 13:22:20 mail amavis[17226]: (17226-02) collect banned table[0]:
u...@example.com, tables: DEFAULT=>Amavis::Lookup::RE=ARRAY(0x8c680e8)
Oct 1 13:22:20 mail amavis[17226]: (17226-02) skip banned check for
u...@example.com, same tables as previous, result =>
Oct 1 13:22:20 mail amavis[17226]: (17226-02) p.path u...@example.com:
"P=p003,L=1,M=multipart/alternative | P=p001,L=1/1,M=text/plain,T=txt"
Oct 1 13:22:20 mail amavis[17226]: (17226-02) skip banned check for
u...@example.com, same tables as previous, result =>
Oct 1 13:22:20 mail amavis[17226]: (17226-02) p.path u...@example.com:
"P=p003,L=1,M=multipart/alternative | P=p002,L=1/2,M=text/html,T=html"
Oct 1 13:22:31 mail amavis[17226]: (17226-02) query_keys: u...@example.com,
user@, example.com, .example.com, .com.pk, .pk, .
Oct 1 13:22:31 mail amavis[17226]: (17226-02)
lookup_hash(u...@example.com), no matches
Oct 1 13:22:31 mail amavis[17226]: (17226-02) lookup (bypass_virus_checks)
=> undef, "u...@example.com" does not match
Oct 1 13:22:31 mail amavis[17226]: (17226-02) lookup (spam_tag2_level) =>
true, "u...@example.com" matches, result="4.31",
matching_key="(constant:4.31)"
Oct 1 13:22:31 mail amavis[17226]: (17226-02) lookup (spam_tag3_level) =>
undef, "u...@example.com" does not match
Oct 1 13:22:31 mail amavis[17226]: (17226-02) lookup (spam_kill_level) =>
true, "u...@example.com" matches, result="4.31",
matching_key="(constant:4.31)"
Oct 1 13:22:31 mail amavis[17226]: (17226-02) lookup (bypass_spam_checks)
=> true, "u...@example.com" matches, result="1",
matching_key="(constant:1)"
Oct 1 13:22:31 mail amavis[17226]: (17226-02) final_destiny PASS, recip
u...@example.com
Oct 1 13:22:31 mail amavis[17226]: (17226-02) lookup (clean_quarantine_to)
=> true, "u...@example.com" matches, result="clean-quarantine",
matching_key="(constant:clean-quarantine)"
Oct 1 13:22:31 mail amavis[17226]: (17226-02) lookup => undef,
"u...@example.com", no lookup tables
Oct 1 13:22:31 mail amavis[17226]: (17226-02) query_keys: u...@example.com,
user@, example.com, .example.com, .com.pk, .pk, .
Oct 1 13:22:31 mail amavis[17226]: (17226-02)
lookup_hash(u...@example.com), no matches
Oct 1 13:22:31 mail amavis[17226]: (17226-02) lookup_acl(u...@example.com)
matches key "example.com", result=1
Oct 1 13:22:31 mail amavis[17226]: (17226-02) lookup (local_domains) =>
true, "u...@example.com" matches, result="1", matching_key="example.com"
Oct 1 13:22:31 mail amavis[17226]: (17226-02) headers CLUSTERING:
<u...@example.com> joining cluster
Oct 1 13:22:31 mail amavis[17226]: (17226-02) (about to connect to
[127.0.0.1]:10025) FWD via SMTP: <mohsinaliz...@hotmail.com> ->
<moh...@example.com>,<u...@example.com>
Oct 1 13:22:31 mail amavis[17226]: (17226-02) sending RCPT
TO:<u...@example.com>
Oct 1 13:22:31 mail amavis[17226]: (17226-02) response to RCPT TO for
<u...@example.com>: "250 2.1.5 Ok"
Oct 1 13:22:32 mail amavis[17226]: (17226-02) FWD via SMTP:
<mohsinaliz...@hotmail.com> -> <moh...@example.com>,<u...@example.com>, 250
2.6.0 Ok, id=17226-02, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as
E0EAD19B349
Oct 1 13:22:32 mail amavis[17226]: (17226-02) dsn: from MTA 250 Clean
<mohsinaliz...@hotmail.com> -> <u...@example.com>: on_succ=0, on_dly=1,
on_fail=1, never=0, warn_sender=, DSN_passed_on=1
Oct 1 13:22:32 mail amavis[17226]: (17226-02) DSN: SUCC from MTA 250 Clean,
no DSN requested: <mohsinaliz...@hotmail.com> -> <u...@example.com>
Oct 1 13:22:32 mail amavis[17226]: (17226-02) Passed CLEAN, [65.55.90.7]
<mohsinaliz...@hotmail.com> -> <moh...@example.com>,<u...@example.com>,
Message-ID: <snt106-w525a474a4a29d5ec709bcbf6...@phx.gbl>, mail_id:
k-6-c3dQQGNL, Hits: -, queued_as: E0EAD19B349, 11559 ms
Oct 1 13:22:32 mail amavis[17226]: (17226-02) sending LMTP response for
<u...@example.com>: "250 2.6.0 Ok, id=17226-02, from MTA([127.0.0.1]:10025):
250 2.0.0 Ok: queued as E0EAD19B349"
Oct 1 13:22:32 mail postfix/lmtp[17620]: C364719B337:
to=<u...@example.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=15,
delays=3.7/0/0/12, dsn=2.6.0, status=sent (250 2.6.0 Ok, id=17226-02, from
MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as E0EAD19B349)
Oct 1 13:22:39 mail postfix/smtp[17579]: E0EAD19B349:
to=<u...@example.com>, relay=mail.example.com[10.65.200.72]:25, delay=7.1,
delays=0.09/0/0.01/7, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as
3DD1212B701)
empiric wrote:
>
> Guys
> I am getting all my external domain emails tagged as SpamSpam
>
> logs are attached.
> mail headers
>
> Return-Path: <u...@gmail.com>
> Delivered-To: u...@domain.com
> Received: from localhost (localhost [127.0.0.1])
> by mail1.domain.com (Postfix) with ESMTP id 39B3C12B71D
> for <u...@domain.com>; Tue, 29 Sep 2009 10:19:57 +0600 (PKST)
> X-Quarantine-ID: <asR-LhZoxUsQ>
> X-Amavis-Alert: BAD HEADER Improper folded header field made up entirely
> of
> whitespace (char 20 hex): Subject: ...?Q?Spam?=\n
> =?utf-8?Q?Spam=0D=0A=20helo123?=\n \n
> Received: from mail1.domain.com ([127.0.0.1])
> by localhost (mail2.domain.com [127.0.0.1]) (amavisd-new, port 10024)
> with LMTP id asR-LhZoxUsQ for <u...@domain.com>;
> Tue, 29 Sep 2009 10:19:56 +0600 (PKST)
> Received: from mail.domain.com (unknown [203.101.170.27])
> by mail1.domain.com (Postfix) with ESMTP id C6CF512B701
> for <u...@domain.com>; Tue, 29 Sep 2009 10:19:54 +0600 (PKST)
> Received: from localhost (localhost [127.0.0.1])
> by muses.domain.com (Postfix) with ESMTP id 6982319B322
> for <u...@domain.com>; Tue, 29 Sep 2009 10:19:53 +0600 (PKST)
> X-Virus-Scanned: Debian amavisd-new at domain.com
> Received: from mail.domain.com ([127.0.0.1])
> by localhost (mail.domain.com [127.0.0.1]) (amavisd-new, port 10024)
> with LMTP id A1fSGV+XdA-K for <u...@domain.com>;
> Tue, 29 Sep 2009 10:19:49 +0600 (PKST)
> Received: from mail-qy0-f191.google.com (mail-qy0-f191.google.com
> [209.85.221.191])
> by mail.domain.com (Postfix) with ESMTP id B3AB03BE38
> for <u...@domain.com>; Tue, 29 Sep 2009 10:19:44 +0600 (PKST)
> Received: by qyk29 with SMTP id 29so3777375qyk.32
> for <u...@domain.com>; Mon, 28 Sep 2009 21:19:40 -0700 (PDT)
> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
> d=gmail.com; s=gamma;
> h=domainkey-signature:mime-version:received:date:message-id:subject
> :from:to:content-type;
> bh=WoV7lT+YT3JKxromudz0thKd6Y5aCdlJ7QFXjsxBCvc=;
>
> b=suj1zJ/bZjwhfYDIy4YWp9YGpL4TFSKVOPm0R8ps0+kIV4SlldvI8A23Vtd2eXAzhd
>
> /pdlqvr7uGT4MR777LO27yKPEaNjqT2dPEVlFXAtc+vQq0Ib2WPPQMR70+77h7Bcfkir
> IIELi+qXFfqj4/IpAcTlP3YtSFfwj42KT+MJs=
> DomainKey-Signature: a=rsa-sha1; c=nofws;
> d=gmail.com; s=gamma;
> h=mime-version:date:message-id:subject:from:to:content-type;
>
> b=mHuhtzREpgetfc3a2kwtOBZZ47s0NR/Qje/GDeE5ZzNUMxOdvU9TtLZqZUM1KVDv6u
>
> dTs/wcIM133W1aDhZJzp4YTFIfmzCz1M/YJeo7+lDNcHERQ0Y6ilLjzoZ7NRf69H3bKn
> RGQxQ9yCAjwLI3FbAgyDtZtW7CYFyKBWNP7M8=
> MIME-Version: 1.0
> Received: by 10.229.1.65 with SMTP id 1mr1690588qce.20.1254197980062; Mon,
> 28
> Sep 2009 21:19:40 -0700 (PDT)
> Date: Tue, 29 Sep 2009 10:19:40 +0600
> Message-ID: <a2649fac0909282119l2140bf18odaf14d74bab76...@mail.gmail.com>
> Subject: =?utf-8?Q?Spam?=
> =?utf-8?Q?Spam=0D=0A=20helo123?=
>
>
>
> spamassassin debug logs
> #spamassassin -t -D
> X-Spam-Checker-Version: SpamAssassin 3.1.7-deb (2006-10-05) on
> mail.domaon.com
> X-Spam-Level: ****
> X-Spam-Status: No, score=4.8 required=5.0
> tests=DCC_CHECK,DNS_FROM_RFC_ABUSE,
> DNS_FROM_RFC_POST,HTML_MESSAGE,SUBJECT_ENCODED_TWICE,
> SUBJECT_EXCESS_QP autolearn=no version=3.1.7-deb
> Delivered-To: u...@domaon.com
> Received: from localhost (localhost [127.0.0.1])
> by mail1.domaon.com (Postfix) with ESMTP id C13911B32DB
> for <u...@domaon.com>; Wed, 30 Sep 2009 17:03:54 +0600 (PKST)
> Received: from mail1.domaon.com ([127.0.0.1])
> by localhost (mail1.domaon.com [127.0.0.1]) (amavisd-new, port 10024)
> with LMTP id p23bnIio88SC for <u...@domaon.com>;
> Wed, 30 Sep 2009 17:03:54 +0600 (PKST)
> Received: from mail.domaon.com (unknown [203.101.170.27])
> by mail1.domaon.com (Postfix) with ESMTP id 22F7D1B32D7
> for <u...@domaon.com>; Wed, 30 Sep 2009 17:03:53 +0600 (PKST)
> Received: from localhost (localhost [127.0.0.1])
> by mail.domaon.com (Postfix) with ESMTP id 976D319B330
> for <u...@domaon.com>; Wed, 30 Sep 2009 17:03:53 +0600 (PKST)
> X-Virus-Scanned: Debian amavisd-new at domaon.com
> Received: from mail.domaon.com ([127.0.0.1])
> by localhost (mail.domaon.com [127.0.0.1]) (amavisd-new, port 10024)
> with LMTP id el+R1y6R6iaa for <u...@domaon.com>;
> Wed, 30 Sep 2009 17:03:53 +0600 (PKST)
> Received: from snt0-omc1-s35.snt0.hotmail.com
> (snt0-omc1-s35.snt0.hotmail.com [65.55.90.46])
> by mail.domaon.com (Postfix) with ESMTP id D14C419B32D
> for <u...@domaon.com>; Wed, 30 Sep 2009 17:03:52 +0600 (PKST)
> Received: from SNT106-W54 ([65.55.90.7]) by snt0-omc1-s35.snt0.hotmail.com
> with Microsoft SMTPSVC(6.0.3790.3959);
> Wed, 30 Sep 2009 04:03:47 -0700
> Message-ID: <snt106-w548ae03faf450123dbc928f6...@phx.gbl>
> Content-Type: multipart/alternative;
> boundary="_4abea601-ec42-4378-af03-83675013aef6_"
> X-Originating-IP: [125.209.118.102]
> From: mohsin alizai <mohsinaliz...@hotmail.com>
> To: <u...@domaon.com>
> Subject: =?utf-8?Q?Spam?=
> =?utf-8?Q?Spam=0D=0A=20test?=
> Date: Wed, 30 Sep 2009 11:03:47 +0000
> Importance: Normal
> MIME-Version: 1.0
> X-OriginalArrivalTime: 30 Sep 2009 11:03:47.0973 (UTC)
> FILETIME=[AF55A350:01CA41BD]
> X-SpamInfo: return-email, failed to obtain DNS record for domain
> hotmail.com
> X-SpamInfo: return-email, failed to obtain DNS record for domain
> hotmail.com
>
> --_4abea601-ec42-4378-af03-83675013aef6_
> Content-Type: text/plain; charset="Windows-1252"
> Content-Transfer-Encoding: quoted-printable
>
>
> test =0A=
>
>
--
View this message in context:
http://www.nabble.com/I-am-getting-all-external-domain-emails-subject-tagged-as-SpamSpam-tp25685055p25693451.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
