Mailing List Archive

----- Original Message -----
From: "John Fleming" <john@wa9als.com>
To: <spamassassin-users@incubator.apache.org>
Sent: Saturday, February 21, 2004 7:46 PM
Subject: Why some don't get scanned?


> I have an occasional mail that doesn't appear to get evaluated by my SA.
> The headers below are from a mail that was forwarded from an off-site
> account to my Linux machine running SA. I get lots of mail this way
> (forwarded from other accts), and almost all get evaluated properly - So
why
> would an occasional mail NOT get an SA eval? Here are the headers of one
> that got through without an eval. It obviously was tagged at the -other-
> server, but again, I have others like this that DO get the ususal eval
> by -MY- SA.
>
> Return-Path: <qcvqeakxxy@yahoo.com>
> X-Original-To: john@wa9als.com
> Delivered-To: john@wa9als.com
> Received: from 1umc.net (elisha.churchquest.com [207.44.194.116])
> by wa9als.com (Postfix) with ESMTP id 4DCC64A45
> for <john@wa9als.com>; Sat, 21 Feb 2004 16:39:17 -0500 (EST)
> Received: from elisha.churchquest.com (root@localhost)
> by 1umc.net (8.11.6/8.11.6) with ESMTP id i1LLdF107151;
> Sat, 21 Feb 2004 15:39:15 -0600
> X-ClientAddr: 81.224.196.209
> Received: from h209n1fls22o918.bredband.comhem.se
> (h209n1fls22o918.bredband.comhem.se [81.224.196.209])
> by elisha.churchquest.com (8.11.6/8.11.6) with SMTP id i1LLd4i07126;
> Sat, 21 Feb 2004 15:39:04 -0600
> Received: from [16.37.191.14] by 81.224.196.209 with HTTP;
> Sat, 21 Feb 2004 16:36:05 -0500
> From: "Willie Hearn" <yryaop@yahoo.com>
> To: fleming.john@1umc.net
> Cc: fleming.phyllis@1umc.net
> Subject: {Spam?} 0--The girls will never let you go with this--sideman
> Mime-Version: 1.0
> X-Mailer: ankara vale some
> Date: Sat, 21 Feb 2004 14:38:05 -0700
> Reply-To: "Willie Hearn" <domajawb@yahoo.com>
> Content-Type: multipart/alternative;
> boundary="4028093727050907701"
> Message-Id: <PNYSNLZ-0008510467325@pater>
> X-yoursite-MailScanner-Information: Please contact the ISP for more
> information
> X-yoursite-MailScanner: Found to be clean
> X-yoursite-MailScanner-SpamCheck: spam, spamcop.net,
> SpamAssassin (score=13.708, required 6, BAYES_99 5.40,
> FORGED_YAHOO_RCVD 0.90, HTML_70_80 0.10, HTML_FONT_INVISIBLE 0.60,
> HTML_MESSAGE 0.10, RCVD_IN_BL_SPAMCOP_NET 1.50, RCVD_IN_DSBL 0.71,
> RCVD_IN_DYNABLOCK 2.60, RCVD_IN_NJABL 0.10, RCVD_IN_NJABL_PROXY 0.50,
> RCVD_IN_SORBS 0.10, RCVD_IN_SORBS_HTTP 1.10)
> X-yoursite-MailScanner-SpamScore: sssssssssssss
> Status:
>

In followup, here are headers from a mail that was tagged at the first
server, but was then also properly tagged at my server. So the question is
still why a few emails that get tagged at the first server don't even appear
to get evaluated at my server (like the one above) , when almost all of them
do (like the one below)? Thanks - John

Return-Path: <LuisAli@tor.co.za>
X-Original-To: john@wa9als.com
Delivered-To: john@wa9als.com
Received: from 1umc.net (elisha.churchquest.com [207.44.194.116])
by wa9als.com (Postfix) with ESMTP id 4C7BB49B2
for <john@wa9als.com>; Sat, 21 Feb 2004 15:51:50 -0500 (EST)
Received: from elisha.churchquest.com (root@localhost)
by 1umc.net (8.11.6/8.11.6) with ESMTP id i1LKpmv03635;
Sat, 21 Feb 2004 14:51:48 -0600
X-ClientAddr: 24.2.208.12
Received: from c-24-2-208-12.client.comcast.net
(c-24-2-208-12.client.comcast.net [24.2.208.12])
by elisha.churchquest.com (8.11.6/8.11.6) with SMTP id i1LKpZi03603;
Sat, 21 Feb 2004 14:51:38 -0600
Message-ID: <0baJdmncDSr9qTUOkeWHiSd7gl7a@emil>
From: Betty <LuisAli@tor.co.za>
To: fleming.john@1umc.net, fleming.phyllis@1umc.net
Date: Sat, 21 Feb 2004 19:46:28 -0100
Content-Type: text/html; charset=ascii-us
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0
X-Mailer: wvxxm davies
X-yoursite-MailScanner-Information: Please contact the ISP for more
information
X-yoursite-MailScanner: Found to be clean
X-yoursite-MailScanner-SpamCheck: spam, spamcop.net,
SpamAssassin (score=10.019, required 6, BAYES_99 5.40,
HTML_MESSAGE 0.10, MIME_HTML_ONLY 0.32, RCVD_IN_BL_SPAMCOP_NET 1.50,
RCVD_IN_DYNABLOCK 2.60, RCVD_IN_SORBS 0.10)
X-yoursite-MailScanner-SpamScore: ssssssssss
Subject: [SPAM] {Spam?} enhance ur s-exual performance up to 24-36 ...
X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on
wa9als.com
X-Spam-Report:
* 0.0 RM_hc_HTML Email is text/html format
* 1.0 J_CHICKENPOX_23 BODY: {2}Letter - punctuation - {3}Letter
* 0.1 OACYS_SINGLE BODY: A single consonant surrounded by whitespace,
minus some of the obvious FP's
* 1.0 J_CHICKENPOX_32 BODY: {3}Letter - punctuation - {2}Letter
* 1.0 J_CHICKENPOX_26 BODY: {2}Letter - punctuation - {6}Letter
* 1.0 J_CHICKENPOX_22 BODY: {2}Letter - punctuation - {2}Letter
* 1.0 J_CHICKENPOX_44 BODY: {4}Letter - punctuation - {4}Letter
* 1.0 J_CHICKENPOX_33 BODY: {3}Letter - punctuation - {3}Letter
* 1.0 J_CHICKENPOX_24 BODY: {2}Letter - punctuation - {4}Letter
* 1.0 J_CHICKENPOX_17 BODY: {1}Letter - punctuation - {7}Letter
* 1.0 J_CHICKENPOX_27 BODY: {2}Letter - punctuation - {7}Letter
* 1.0 J_CHICKENPOX_57 BODY: {5}Letter - punctuation - {7}Letter
* 1.0 J_CHICKENPOX_51 BODY: {5}Letter - punctuation - {1}Letter
* 1.0 J_CHICKENPOX_42 BODY: {4}Letter - punctuation - {2}Letter
* 0.1 HTML_MESSAGE BODY: HTML included in message
* 0.3 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
* 5.4 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
* [score: 1.0000]
* 0.0 RM_rb_BREAK BODY: Testing for HTML Break in emails
* 0.0 RM_rb_ANCHOR BODY: Testing for HTML end of anchor in emails
* 0.0 RM_rb_HTML BODY: Testing for HTML tag in emails
* 0.0 RM_rb_FONT BODY: Testing for HTML Font tag in emails
* 0.0 RM_rb_BODY BODY: Testing for HTML BODY in emails
* 0.0 T_NUM_IN_DOMAIN_4 URI: T_NUM_IN_DOMAIN_4
* 2.0 FVGT_rtbl_CBL RBL: Received via a relay in cbl.abuseat.org
* [Blocked - see <http://cbl.abuseat.org/lookup.cgi?ip=24.2.208.12>]
* 0.1 RCVD_IN_SORBS RBL: SORBS: sender is listed in SORBS
* [24.2.208.12 listed in dnsbl.sorbs.net]
* 1.5 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
* [Blocked - see <http://www.spamcop.net/bl.shtml?24.2.208.12>]
X-Spam-Status: Yes, hits=21.5 required=5.0 tests=BAYES_99,FVGT_rtbl_CBL,
HTML_MESSAGE,J_CHICKENPOX_17,J_CHICKENPOX_22,J_CHICKENPOX_23,
J_CHICKENPOX_24,J_CHICKENPOX_26,J_CHICKENPOX_27,J_CHICKENPOX_32,
J_CHICKENPOX_33,J_CHICKENPOX_42,J_CHICKENPOX_44,J_CHICKENPOX_51,
J_CHICKENPOX_57,MIME_HTML_ONLY,OACYS_SINGLE,RCVD_IN_BL_SPAMCOP_NET,
RCVD_IN_SORBS,RM_hc_HTML,RM_rb_ANCHOR,RM_rb_BODY,RM_rb_BREAK,
RM_rb_FONT,RM_rb_HTML,T_NUM_IN_DOMAIN_4 autolearn=no version=2.60
X-Spam-Level: *********************
X-Spam-Flag: YES
Status:

----- Original Message -----
From: "Raquel Rice" <raquel@thericehouse.net>
To: <spamassassin-users@incubator.apache.org>
Sent: Saturday, February 21, 2004 7:57 PM
Subject: Re: Why some don't get scanned?


> On Sat, 21 Feb 2004 19:51:55 -0500
> "John Fleming" <john@wa9als.com> wrote:
>
> >
> > ----- Original Message -----
> > From: "John Fleming" <john@wa9als.com>
> > To: <spamassassin-users@incubator.apache.org>
> > Sent: Saturday, February 21, 2004 7:46 PM
> > Subject: Why some don't get scanned?
> >
> >
> > > I have an occasional mail that doesn't appear to get evaluated
> > > by my SA. The headers below are from a mail that was forwarded
> > > from an off-site account to my Linux machine running SA. I get
> > > lots of mail this way(forwarded from other accts), and almost
> > > all get evaluated properly - So
> > why
> > > would an occasional mail NOT get an SA eval? Here are the
> > > headers of one that got through without an eval. It obviously
> > > was tagged at the -other- server, but again, I have others like
> > > this that DO get the ususal eval by -MY- SA.
> > >
> > > SpamAssassin (score=13.708, required 6
> > SpamAssassin (score=10.019, required 6
> > X-Spam-Status: Yes, hits=21.5 required=5.0
>
> Given the results, above, I'm not sure how you can say that it's not
> being evaluated.

I was afraid someone would say that. It's because it -is- being evaluated
by SA at the first server, but not again at my server. Others get eval by
the first server AND my server. I posted another example of one that gets
evaluated by BOTH servers - My SA adds a different tag ([SPAM] instead of
{Spam?}) and doesn't have the "X-yoursite-MailScanner" part etc etc (See my
followup post with TWO examples.) Tnx