Hi 2010/1/14 John Hardin <jhar...@impsec.org>:
> Take a look at the Received header that your MTA inserts for an > authenticated session. It will look something like this: Thanks for the hint.. I had a try with adding a hydrix.cf file containing: header AUTH_SMTP Received =~ /\(authenticated bits=[0-9]+\) by (mail|www)\.domain\.com/ describe AUTH_SMTP Come from authenticated mail server score AUTH_SMTP -10.0 restarted spamassassin , but not having much luck I then simplified the rule with just: header AUTH_SMTP Received =~ /\(authenticated bits=[0-9]+\) and still no luck Received: from minime.private.domain.com (authenticated bits=0) by mail.domain.com (8.14.4/8.14.4) with ESMTP id o0E4sbxh042310 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT) for <jyaven...@gmail.com>; Thu, 14 Jan 2010 15:54:38 +1100 (EST) (envelope-from jean-yves.aven...@domain.com) From: Jean-Yves Avenard <jean-yves.aven...@domain.com> Content-Type: multipart/alternative; boundary=Apple-Mail-47--477649399 Subject: test #2 Date: Thu, 14 Jan 2010 15:54:35 +1100 Message-Id: <779545a2-1d20-4373-81dd-b12f7bdc8...@hydrix.com> To: Jean-Yves Avenard <jyaven...@gmail.com> Mime-Version: 1.0 (Apple Message framework v1077) X-Mailer: Apple Mail (2.1077) X-Spam-Status: No, score=-3.4 required=5.5 tests=BAYES_00,HTML_MESSAGE autolearn=no version=3.2.5 X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on server2.private.domain.com So it didn't even register with that rule ...