------=_Part_9783_11327285.1205335468366
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Well here is the actual headers:

Mar 11 13:48:20 x1mail spamd[6116]: spamd: result: Y 22 -
DATE_IN_FUTURE_12_24,
FORGED_MUA_OUTLOOK,HTML_MESSAGE,URIBL_AB_SURBL,URI BL_JP_SURBL,URIBL_OB_SURBL,
URIBL_SC_SURBL scantime=17.6,size=3023,user=root,uid=501,required _score=3.0,
rhost=localhost,raddr=127.0.0.1,rport=34757,
mid=<31c3ff01c883a2$bb044920$be727ddd@jacky3b8126d7b>,autolearn=disabled

Thanks for any help. And believe it or not, that was a LEGITIMATE
message....I need to do a little digging to see where this guy was sending
from, but it was a proposal to reorder some forms we use!

Thanks again!


On Wed, Mar 12, 2008 at 10:14 AM, Matt Kettler
wrote:

> dougp23 wrote:
> > Hi. Running SA 3.1.8
> >
> > Would like to move to a newer version for a few reasons...
> >
> > Anyways the 3.2.3 version looks compelling, but I use a mailserver

> called
> > Scalix. It uses Sendmail as its engine. But each X-Spam header shows

> this:
> >
> > rhost=localhost,raddr=127.0.0.1,rport=34757,
> >

> Erm.. What's that generated by? That's not SpamAssassin...
> > Which makes me think that for my mailserver, ALL email appears to

> originate
> > from the localhost. In fact, under 3.1.8, I once tried to set the

> network
> > ignore option to 127.0.0.1, and all spam immediately was let through.
> >

> Well, even if SpamAssassin trusts a host, and all the hosts involved in
> handling a message, it will still scan it. You'll just see the
> ALL_TRUSTED rule fire off. That reduces the score a little, but not
> enough that you'd be missing all spam..
>
> Your problem is more compressive, as it sounds like email isn't even
> being scanned by SA.
>
> Is there a spamassassin generated X-Spam-Status with a list of rule hits
> on those spam emails?
>
>
>
> > Just wondering if I am missing something or do I just utilize a flaky
> > mailserver, lol!
> >
> >
> >

>
>


------=_Part_9783_11327285.1205335468366
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Well here is the actual headers:

Mar 11 13:48:20 x1mail spamd[6116]: spamd: result: Y 22 - DATE_IN_FUTURE_12_24,
FORGED_MUA_OUTLOOK,HTML_MESSAGE,URIBL_AB_SURBL,URI BL_JP_SURBL,URIBL_OB_SURBL,
URIBL_SC_SURBL scantime=17.6,size=3023,user=root,uid=501,required _score=3.0,

rhost=localhost,raddr=127.0.0.1,rport=34757,
mid=<31c3ff01c883a2$bb044920$be727ddd@jacky3b8126d 7b>,autolearn=disabled

Thanks for any help.  And believe it or not, that was a LEGITIMATE message....I need to do a little digging to see where this guy was sending from, but it was  a proposal to reorder some forms we use! 


Thanks again!


On Wed, Mar 12, 2008 at 10:14 AM, Matt Kettler <mkettler_sa@verizon.net> wrote:

dougp23 wrote:

> Hi.  Running SA 3.1.8

>

> Would like to move to a newer version for a few reasons...

>

> Anyways the 3.2.3 version looks compelling, but I use a mailserver called

> Scalix.  It uses Sendmail as its engine.  But each X-Spam header shows this:

>

> rhost=localhost,raddr=127.0.0.1,rport=34757,

>

Erm.. What's that generated by? That's not SpamAssassin...

> Which makes me think that for my mailserver, ALL email appears to originate

> from the localhost.  In fact, under 3.1.8, I once tried to set the network

> ignore option to 127.0.0.1, and all spam immediately was let through.

>

Well, even if SpamAssassin trusts a host, and all the hosts involved in

handling a message, it will still scan it. You'll just see the

ALL_TRUSTED rule fire off. That reduces the score a little, but not

enough that you'd be missing all spam..



Your problem is more compressive, as it sounds like email isn't even

being scanned by SA.



Is there a spamassassin generated X-Spam-Status with a list of rule hits

on those spam emails?







> Just wondering if I am missing something or do I just utilize a flaky

> mailserver, lol!

>

>

>






------=_Part_9783_11327285.1205335468366--