[prev in list] [next in list] [prev in thread] [next in thread] 

List:       spamassassin-users
Subject:    local.cf rules are executed just "arbitrarily"?
From:       khaosis <es () delta-xi ! net>
Date:       2011-09-13 11:15:46
Message-ID: 32454825.post () talk ! nabble ! com
[Download RAW message or body]


Hello,

at first, I tried to search for similar problems here but did not find a
solution to this.

I'm maintaining a commercial product, which uses
 * Postfix as MTA,
 * a commercial checksum-based spam-detection online service (Expurgate),
where
   communication is done through MILTER (postfix before-queue) - this
service
   finally adds an X-header to the message (spam/ham)
 * latest Amavisd-new + Spamassassin through Postfix content_filter


In the local.cf file, I have:

header EXPURGATE_SPAM X-purgate =~ /spam/
score EXPURGATE_SPAM 5.0

This works well *most* of the time. However, dozens of times a day, spams
are
actually relayed which contain the positive spam-signature of the commercial
spam detector service, as well as all Spamassassin related headers - but
seemingly, the EXPURGATE_SPAM rule is not triggered/evaluated for some
reason.


Example mail:

Received: from ds9.xxx.xx ([10.70.70.xx])
         by domino1.xxx.xx (Lotus Domino Release 7.0.2FP2)
         with ESMTP id 2011091217412647-138634 ;
         Mon, 12 Sep 2011 17:41:26 +0200
Received: from localhost (localhost [127.0.0.1])
                by ds9.xx.xx (Postfix) with ESMTP id 4D1953F4044;
                Mon, 12 Sep 2011 17:41:27 +0200 (CEST)
X-Virus-Scanned: Communication Gateway at xxx.xx
X-Spam-Flag: NO
X-Spam-Score: 3.032
X-Spam-Level: ***
X-Spam-Status: No, score=3.032 tagged_above=-1000 required=4
                tests=[HTML_MESSAGE=0.001, RCVD_IN_XBL=3.033,
SPF_HELO_PASS=-0.001,
                SPF_PASS=-0.001] autolearn=no
Received: from ds9.xxx.xx ([127.0.0.1])
                by localhost (ds9.xxx.xx [127.0.0.1]) (amavisd-new, port
10024)
                with ESMTP id ANPR2XszYFLf; Mon, 12 Sep 2011 17:41:22 +0200
(CEST)
Received: from etisbew.com (lan104-968.elekta.lt [91.187.168.104])
                by ds9.xxx.xx (Postfix) with ESMTP id 0360B43A590;
                Mon, 12 Sep 2011 17:41:07 +0200 (CEST)
Received: from (192.168.1.5) by etisbew.com (91.187.168.104) with Microsoft
SMTP Server id 8.0.685.24; Mon, 12 Sep 2011 17:41:24 +0200
Message-ID: <4E6E26E6.208070@etisbew.com>
Date: Mon, 12 Sep 2011 17:41:24 +0200
From: "Lynda Webber" <knopfjlc6@etisbew.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.12)
Gecko/20101103 Thunderbird/3.1.6
MIME-Version: 1.0
To: <luthy@xxx.xx>
Subject: Wir schenken Ihnen gute Traeume - schlafen Sie gut.
X-purgate-type: spam
X-purgate-Ad: Categorized by eleven eXpurgate (R) http://www.eleven.de
X-purgate: spam
X-purgate-size: 3201
X-purgate-ID: 153459::1315842082-00001584-8BC4FBD5/0-0/12547-17



Did I overlook something?

Thank you in advance,
Erik
-- 
View this message in context: \
http://old.nabble.com/local.cf-rules-are-executed-just-%22arbitrarily%22--tp32454825p32454825.html
 Sent from the SpamAssassin - Users mailing list archive at Nabble.com.


[prev in list] [next in list] [prev in thread] [next in thread]