You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by Michael Monnerie <mi...@it-management.at> on 2006/04/07 12:05:27 UTC

Mail via MDAEMON and OE gets marked as FORGED_MUA_OUTLOOK

Hi, I received such a legitimate mail:

Received: from GTEW2KPR07 by marketing.grouppoint.at
	(MDaemon.Standard.v7.2.2.R)
	with ESMTP id pd50000008044.msg
	for <gr...@zmi.at>; Fri, 07 Apr 2006 11:26:25 +0200
Message-ID: 
<MD...@marketing.grouppoint.at>
From: "GROUP POINT News" <ne...@marketing.grouppoint.at>
To: "GROUP POINT News" <ne...@marketing.grouppoint.at>
Subject: Server Angebot April 2006
Date: Fri, 7 Apr 2006 11:25:16 +0200
MIME-Version: 1.0
Content-Type: multipart/related;
  type="multipart/alternative";
  boundary="----=_NextPart_000_0045_01C65A35.F1EF82D0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1506
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1506
X-Authenticated-Sender: news@marketing.grouppoint.at
X-MDRemoteIP: 10.1.1.101
Sender: news@marketing.grouppoint.at
X-Return-Path: news@marketing.grouppoint.at
X-MDMailing-List: newsletter@marketing.grouppoint.at
X-MDSend-Notifications-To: news@marketing.grouppoint.at
Reply-To: news@marketing.grouppoint.at
X-MDaemon-Deliver-To: grouppoint@zmi.at
X-Virus-Scanned: amavisd-new at goelsen.net
X-Virus-Scanned: amavisd-new at zmi.at
X-Spam-Status: Yes, hits=5.724 tagged_above=-999 required=5 
tests=AWL=-0.275,
 DNS_FROM_RFC_POST=1.44, EXTRA_MPART_TYPE=0.815, 
FORGED_MUA_OUTLOOK=3.36,
 HTML_FONT_BIG=0.256, HTML_MESSAGE=0.001, HTML_TAG_EXIST_TBODY=0.126,
 UNPARSEABLE_RELAY=0.001
X-Spam-Level: *****
X-Spam-Flag: YES

I believe it hits FORGED_MUA_OUTLOOK because MDAEMON modifies the 
Message-ID. So there should be a rule allowing MDAEMON like

header __OE_MSGID_4     MESSAGEID =~ /^<MDAEMON-.*\@.*>$/m

Any other ideas?

mfg zmi
-- 
// Michael Monnerie, Ing.BSc    -----      http://it-management.at
// Tel: 0660/4156531                          .network.your.ideas.
// PGP Key:   "lynx -source http://zmi.at/zmi3.asc | gpg --import"
// Fingerprint: 44A3 C1EC B71E C71A B4C2  9AA6 C818 847C 55CB A4EE
// Keyserver: www.keyserver.net                 Key-ID: 0x55CBA4EE