Hi! This is the ezmlm program. I'm managing the
users@spamassassin.apache.org mailing list.


Messages to you from the users mailing list seem to
have been bouncing. I've attached a copy of the first bounce
message I received.

If this message bounces too, I will send you a probe. If the probe bounces,
I will remove your address from the users mailing list,
without further notice.


I've kept a list of which messages from the users mailing list have
bounced from your address.

Copies of these messages may be in the archive.
To retrieve a set of messages 123-145 (a maximum of 100 per request),
send a short message to:


To receive a subject and author list for the last 100 or so messages,
send a short message to:


Here are the message numbers:

69783

--- Enclosed is a copy of the bounce message I received.

Return-Path: <>
Received: (qmail 57229 invoked by uid 99); 10 May 2008 15:13:57 -0000
Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136)
by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 10 May 2008 08:13:57 -0700
X-ASF-Spam-Status: No, hits=0.0 required=10.0
tests=
X-Spam-Check-By: apache.org
Received: from [140.113.17.209] (HELO FreeBSD.csie.nctu.edu.tw) (140.113.17.209)
by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 10 May 2008 15:13:10 +0000
Received: by FreeBSD.csie.nctu.edu.tw (Postfix)
id 3FF6A7E909; Sat, 10 May 2008 23:14:21 +0800 (CST)
Date: Sat, 10 May 2008 23:14:21 +0800 (CST)
From: MAILER-DAEMON@FreeBSD.csie.nctu.edu.tw (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
To: users-return-69783-sa-talk=freebsd.csie.nctu.edu.tw@spamassassin.apache. org
Auto-Submitted: auto-replied
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="A07747E8E7.1210432461/FreeBSD.csie.nctu.edu.tw"
Content-Transfer-Encoding: 7bit
Message-Id: <20080510151422.3FF6A7E909@FreeBSD.csie.nctu.edu.tw>
X-Virus-Checked: Checked by ClamAV on apache.org

This is a MIME-encapsulated message.

--A07747E8E7.1210432461/FreeBSD.csie.nctu.edu.tw
Content-Description: Notification
Content-Type: text/plain; charset=us-ascii

This is the mail system at host FreeBSD.csie.nctu.edu.tw.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The mail system

: Command time limit exceeded:
"/usr/local/news/bin/mail-post.pl mailing.unix.spamassassin-talk"

--A07747E8E7.1210432461/FreeBSD.csie.nctu.edu.tw
Content-Description: Delivery report
Content-Type: message/delivery-status

Reporting-MTA: dns; FreeBSD.csie.nctu.edu.tw
X-Postfix-Queue-ID: A07747E8E7
X-Postfix-Sender: rfc822; users-return-69783-sa-talk=freebsd.csie.nctu.edu.tw@spamassassin.apache. org
Arrival-Date: Sat, 10 May 2008 22:49:05 +0800 (CST)

Final-Recipient: rfc822; sa-talk@freebsd.csie.nctu.edu.tw
Original-Recipient: rfc822;sa-talk@freebsd.csie.nctu.edu.tw
Action: failed
Status: 5.3.0
Diagnostic-Code: x-unix; internal software error

--A07747E8E7.1210432461/FreeBSD.csie.nctu.edu.tw
Content-Description: Undelivered Message
Content-Type: message/rfc822
Content-Transfer-Encoding: 7bit

Received: from localhost (unknown [127.0.0.1])
by FreeBSD.csie.nctu.edu.tw (Postfix) with ESMTP id A07747E8E7
for ; Sat, 10 May 2008 22:49:05 +0800 (CST)
Received: from FreeBSD.csie.nctu.edu.tw ([127.0.0.1])
by localhost (FreeBSD.csie.nctu.edu.tw [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id xtQWjY62wPwS for ;
Sat, 10 May 2008 22:48:47 +0800 (CST)
Received: from mail.apache.org (hermes.apache.org [140.211.11.2])
by FreeBSD.csie.nctu.edu.tw (Postfix) with SMTP id 842FC7E8F8
for ; Sat, 10 May 2008 22:48:30 +0800 (CST)
Received: (qmail 29835 invoked by uid 500); 10 May 2008 14:20:50 -0000
Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm
Precedence: bulk
list-help:
list-unsubscribe:
List-Post:
List-Id:
Delivered-To: mailing list users@spamassassin.apache.org
Received: (qmail 29824 invoked by uid 99); 10 May 2008 14:20:50 -0000
Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136)
by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 10 May 2008 07:20:50 -0700
X-ASF-Spam-Status: No, hits=-0.0 required=10.0
tests=SPF_HELO_PASS,SPF_PASS
X-Spam-Check-By: apache.org
Received-SPF: pass (athena.apache.org: domain of jeffkoch@intersessions.com designates 64.68.144.12 as permitted sender)
Received: from [64.68.144.12] (HELO pegasus.avspamfilter.com) (64.68.144.12)
by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 10 May 2008 14:20:03 +0000
Received: (qmail 3867 invoked by uid 89); 10 May 2008 14:20:17 -0000
Received: by simscan 1.3.1 ppid: 3768, pid: 3841, t: 1.8711s
scanners: clamav: 0.92/m:
Received: from unknown (HELO Lattitude.intersessions.com) (jeffkoch@intersessions.com@67.44.141.93)
by 0 with ESMTPA; 10 May 2008 14:20:15 -0000
Message-Id: <5.2.1.1.2.20080510101747.03af6de8@mail.intersessio ns.com>
X-Sender: jeffkoch@intersessions.com@mail.intersessions.com
X-Mailer: QUALCOMM Windows Eudora Version 5.2.1
Date: Sat, 10 May 2008 10:20:06 -0400
To: mouss
From: Jeff Koch
Subject: Re: False positive on forged_mua_outlook
Cc: users@spamassassin.apache.org
In-Reply-To: <48255936.4040207@netoyen.net>
References: <4824C0A8.1010900@livedatagroup.com>
<5.2.1.1.2.20080509155340.05a59ce8@mail.intersessio ns.com>
<5.2.1.1.2.20080509120307.057541d8@mail.intersessio ns.com>
<5.2.1.1.2.20080509120307.057541d8@mail.intersessio ns.com>
<5.2.1.1.2.20080509155340.05a59ce8@mail.intersessio ns.com>
<5.2.1.1.2.20080509164853.01f121f8@mail.intersessio ns.com>
<4824BFBF.70902@livedatagroup.com>
<4824C0A8.1010900@livedatagroup.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
X-Virus-Checked: Checked by ClamAV on apache.org


That part (i.e. the top part of the header) was generated by qmail. Please
look at the bottom part of the header after the spam scoring which shows
the header from the user's email which was mistakenly scored as a
forged_mua_outlook.


At 04:13 AM 5/10/2008, mouss wrote:
>Randy Ramsdell wrote:
>>[snip]
>>Scratch that and reverse it. If it does match, then it will score the
>>message header as fake. oops sorry. Let me check some more things.

>
>Did outlook really generate this message-id:
>
> Message-ID: <74BC081D12754719AD817A909757BB09@server>
>
>?
>
>
>
>


Best Regards,

Jeff Koch, Intersessions


--A07747E8E7.1210432461/FreeBSD.csie.nctu.edu.tw--