Kevin Golding-2 wrote
> Given the PBL listing is only the last external IP the fact that SA is
> testing headers in your internal network explains why it's not testing an
> IP one hop further out. Essentially it seems as if your internal_networks
> is incorrectly set. Or, as your pasted config shows, not set at all. You
> set that correctly in your MTA but SA won't pick up on that so you need to
> add:
>
>
> internal_networks 195.26.90.
>
>
> You may also want to try the following in your local.cf:
>
> add_header all Relays-Untrusted _RELAYSUNTRUSTED_
> add_header all Relays-External _RELAYSEXTERNAL_
Thanks for your reply Kevin.
You explanation of why the most recent relay is ignored makes sense, thanks
for that.
I did try adding the "internal_networks 195.26.90. " option to my LOCAL.CF
before, and in fact I have just tried it again based on your advice, but it
doesnt make any difference. Here are the headers with
* internal_networks 195.26.90.*
and
*add_header all Relays-Untrusted _RELAYSUNTRUSTED_
add_header all Relays-External _RELAYSEXTERNAL_ *
in place my local.cf:
Return-Path: char...@xxxxxxxxxxidlan.net
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on mailserver
X-Spam-Level:
X-Spam-Status: No, score=-1.3 required=3.0 tests=HTML_MESSAGE,
KHOP_RCVD_UNTRUST,RCVD_IN_DNSWL_LOW,RCVD_IN_HOSTKARMA_W,RCVD_IN_HOSTKARMA_WL,
RCVD_IN_MSPIKE_H2 autolearn=unavailable autolearn_force=no version=3.4.0
X-Spam-Report:
* -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/,
low
* trust
* [195.26.90.72 listed in list.dnswl.org]
* -0.1 RCVD_IN_HOSTKARMA_W RBL: HostKarma: relay in white list (first
pass)
* [195.26.90.72 listed in hostkarma.junkemailfilter.net]
* -0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
* [195.26.90.72 listed in wl.mailspike.co]
* 0.0 HTML_MESSAGE BODY: HTML included in message
* -1.0 RCVD_IN_HOSTKARMA_WL RBL: HostKarma: unique whitelisted
* 0.5 KHOP_RCVD_UNTRUST DNS-whitelisted sender is not verified
*
X-Spam-Relays-Untrusted: [ ip=195.26.90.72 rdns=mailsub2.myhost.net
helo=mailsub2.myhost.net by=mailin3.myhost.net ident=
envfrom=char...@xxxxxxxxxxidlan.net intl=0 id=1bAG9w-0001Sw-2s auth=
msa=0
] [
ip=2.25.50.35 rdns= helo=!192.168.1.249! by=mailsub2.myhost.net ident=
envfrom=char...@xxxxxxxxxxidlan.net intl=0 id=1bAG9r-0002wq-Oo
auth=esmtpsa
msa=0 ]
X-Spam-Relays-External: [ ip=195.26.90.72 rdns=mailsub2.myhost.net
helo=mailsub2.myhost.net by=mailin3.myhost.net ident=
envfrom=char...@xxxxxxxxxxidlan.net intl=0 id=1bAG9w-0001Sw-2s auth=
msa=0
] [
ip=2.25.50.35 rdns= helo=!192.168.1.249! by=mailsub2.myhost.net ident=
envfrom=char...@xxxxxxxxxxidlan.net intl=0 id=1bAG9r-0002wq-Oo
auth=esmtpsa
msa=0 ]
X-hMailServer-ExternalAccount: POPdaily
Return-Path: <char...@xxxxxxxxxxidlan.net>
Received: from mailin3.myhost.net (mailin3.myhost.net [195.26.90.113])
(authenticated
user=sylves...@mydomain.net bits=0) by ms7.myhost.net (Cyrus
v2.4.16-Kolab-2.4.16-1.el6)
with LMTPSA (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384
bits=256/256
verify=YES); Tue, 07 Jun 2016 13:31:04 +0100
X-Sieve: CMU Sieve 2.4
Received: from mailsub2.myhost.net ([195.26.90.72]) by mailin3.myhost.net
with
esmtps (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256) (Exim 4.85) (envelope-from
<char...@xxxxxxxxxxidlan.net>)
id 1bAG9w-0001Sw-2s for sylves...@mydomain.net; Tue, 07 Jun 2016 13:31:04
+0100
Received: from [2.25.50.35] (helo=[192.168.1.249]) by mailsub2.myhost.net
with
esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.85) (envelope-from
<char...@xxxxxxxxxxidlan.net>)
id 1bAG9r-0002wq-Oo; Tue, 07 Jun 2016 13:31:03 +0100
From: Charlie Cridlan <char...@xxxxxxxxxxidlan.net>
Mime-Version: 1.0 (Apple Message framework v1085)
Content-Type: multipart/alternative; boundary=Apple-Mail-32--483328467
Subject: [SPAM] from charlie re white matt vinyl
Date: Tue, 7 Jun 2016 13:30:59 +0100
References: <57554b88.1040...@mydomain.net>
Cc: sylves...@mydomain.net
To: Liz <liz.@net>
Message-Id: <b4193a46-b100-4a01-97ca-b85ef2ee7...@xxxxxxxxxxidlan.net>
X-Mailer: Apple Mail (2.1085)
X-hMailServer-Spam: YES
X-hMailServer-Reason-1: Rejected by Spamhaus. - (Score: 5)
X-hMailServer-Reason-Score: 5
You can see that it is still evaluating 195.26.90.72 and considers it
untrusted/external despite it being within the 'internal network' subnet.
Am I missing something? Could you advise please.
Many thanks
--
View this message in context:
http://spamassassin.1065346.n5.nabble.com/Advice-why-one-relay-evaluated-and-not-the-other-tp121145p121176.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
