On 08/15/2010 09:15 PM, Kevin J. Cummings wrote:
My 11:00 email got marked as [SPAM], here are the email headers:
...
> X-Spam-Status: No, score=0.3 required=4.0
tests=ALL_TRUSTED,BAYES_00,
> FRT_ADOBE2,NORMAL_HTTP_TO_IP,NUMERIC_HTTP_ADDR,SPF_PASS,URI_HEX autolearn=no
> version=3.3.1
> Received: from kjc386.framingham.ma.us (localhost [127.0.0.1])
> by kjc386.framingham.ma.us (8.14.4/8.14.4) with ESMTP id o7G312re009755
> (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
> for<root(a)kjc386.framingham.ma.us>; Sun, 15 Aug 2010 23:01:02 -0400
> Received: (from root@localhost)
> by kjc386.framingham.ma.us (8.14.4/8.14.4/Submit) id o7G312a1009752
> for root; Sun, 15 Aug 2010 23:01:02 -0400
...
[I'm wondering *why* it says [SPAM] if the X-Spam-Status score is
0.3?]
We can see that the ALL_TRUSTED rule matched and the spam-status is
"no", so I think what's happening is that the milter is being run twice.
The first run isn't hitting ALL_TRUSTED and is setting the standard
SpamAssassin headers and modifying Subject: while the second run
replaces the previous SpamAssassin headers with new results.
We can also see that you've got to Received lines. The second indicates
ESMTP transport and assigns a new queue ID.
Do I need to use localhost or kjc386.framingham.ma.us as the
hostname
for the whitelist_from_rcvd line?
I think you want localhost. If I'm reading it correctly, you're hitting
the trusted_networks setting, but not the whitelist_from_rcvd that
you've set.
BTW, I get all of root's emails sent to me through a sendmail
alias. If
that matters....
Out of curiosity, what does the alias look like? Re-sending the message
by SMTP and running the milter twice is pretty inefficient. I wonder if
that's done by the milter in order to allow per-user configuration
settings? I don't know enough about the implementation of the SA milter
to say...