Looking at my mail streams I see evidence that spammers sometimes add faked "SpamAssassin" headers to their messages (I assume to try to trick recipients into thinking that the message has already been given a clean bill-of-health).
I wrote a few test rules to look for these pre-existing "X-Spam-" headers to test to see if it could be used as a spam detector. However I got no hits on these rules even on hand crafted test messages that contained such stuff. Checking the SA source I found in PerMsgStatus.pm a line of code: $self->{msg}->delete_header('X-Spam-.*'); that ran before any tests. So looking for SA headers inside of SA is pointless. So does anybody have any ideas how to test for evidence of a prior SA pass? -- Dave Funk University of Iowa <dbfunk (at) engineering.uiowa.edu> College of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527 #include <std_disclaimer.h> Better is not better, 'standard' is better. B{