At 03:45 PM 5/7/2017, you wrote:
Hi,
Would someone help me confirm this is an FP for FORGED_YAHOO_RCVD? It
does indeed go through yahoo, but his then passed through spamcow.com
before passing through interwrx.com, then through ours (example.com):
https://pastebin.com/5WgWLBiB
Looks like it is to me. The email has the header that cause
problems with the stock SA rules:
X-Mailer: WebService/1.1.9539 YahooMailNeo Mozilla/5.0 (Windows NT
6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/57.0.2987.133 Safari/537.36
giving 1.6 points
1.6 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers
but given your total from all rules X-Spam-Score: 6.812
it would have still been considered spam without the
1.6 points from FORGED_YAHOO_RCVD
Lyle Evans
---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus
