Hi Kevin I have entered the internal_network address as
internal_networks 195.26.90/24 and even internal_networks 195.26.90.72 and it never made a difference. Very strange. X-Spam-Status: No, score=-1.3 required=3.0 tests=HTML_MESSAGE, KHOP_RCVD_UNTRUST,RCVD_IN_DNSWL_LOW,RCVD_IN_HOSTKARMA_W,RCVD_IN_HOSTKARMA_WL, RCVD_IN_MSPIKE_H2 autolearn=unavailable autolearn_force=no version=3.4.0 X-Spam-Report: * -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low * trust * [195.26.90.72 listed in list.dnswl.org] * -0.1 RCVD_IN_HOSTKARMA_W RBL: HostKarma: relay in white list (first pass) * [195.26.90.72 listed in hostkarma.junkemailfilter.net] * -0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) * [195.26.90.72 listed in wl.mailspike.co] * 0.0 HTML_MESSAGE BODY: HTML included in message * -1.0 RCVD_IN_HOSTKARMA_WL RBL: HostKarma: unique whitelisted * 0.5 KHOP_RCVD_UNTRUST DNS-whitelisted sender is not verified * X-Spam-Relays-Untrusted: [ ip=195.26.90.72 rdns=mailsub2.myhost.net helo=mailsub2.myhost.net by=mailin3.myhost.net ident= envfrom=char...@xxxxxxxxxxidlan.net intl=0 id=1bAG9w-0001Sw-2s auth= msa=0 ] [ ip=2.25.50.35 rdns= helo=!192.168.1.249! by=mailsub2.myhost.net ident= envfrom=char...@xxxxxxxxxxidlan.net intl=0 id=1bAG9r-0002wq-Oo auth=esmtpsa msa=0 ] X-Spam-Relays-External: [ ip=195.26.90.72 rdns=mailsub2.myhost.net helo=mailsub2.myhost.net by=mailin3.myhost.net ident= envfrom=char...@xxxxxxxxxxidlan.net intl=0 id=1bAG9w-0001Sw-2s auth= msa=0 ] [ ip=2.25.50.35 rdns= helo=!192.168.1.249! by=mailsub2.myhost.net ident= envfrom=char...@xxxxxxxxxxidlan.net intl=0 id=1bAG9r-0002wq-Oo auth=esmtpsa msa=0 ] Regarding the range: the range belongs to our mail host provider who receive the emails then pass them amongst their own servers (doing their own teats no doubt). Plus they dont have just the one address - an incoming emial can land at any of several servers (load balancing). I dont know the EXACT range of addresses they use but I know they are all within 195.26.90.x range (hence the cross-the-board approach to cover all eventualities). So, still scratching my head. All help appreciated. On 08/06/2016 14:22, Kevin Golding-2 [via SpamAssassin] wrote: > On Wed, 08 Jun 2016 13:07:14 +0100, jimimaseye > > That syntax is wrong, it's the same as trusted_networks so you don't use > the wildcard. You can use CIDR too if you want, but not * > > In fact they may be better as trusted_networks anyway - it all depends > what role they play in your setup > > That said, do you really need the whole block? > > You could just use 195.26.90.72 and 195.26.90.113 by the look of it. Even > if you control the whole block presumably only a limited number of hosts > should be relaying? > -- View this message in context: http://spamassassin.1065346.n5.nabble.com/Advice-why-one-relay-evaluated-and-not-the-other-tp121145p121180.html Sent from the SpamAssassin - Users mailing list archive at Nabble.com.