You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by empiric <na...@gmail.com> on 2009/10/01 09:28:31 UTC
Re: I am getting all external domain emails subject tagged as
SpamSpam
more logs
Oct 1 13:22:20 mail amavis[17226]: (17226-02) LMTP< RCPT
TO:<us...@example.com> ORCPT=rfc822;user@example.com\r\n
Oct 1 13:22:20 mail amavis[17226]: (17226-02) LMTP> 250 2.1.5 Recipient
user@example.com OK
Oct 1 13:22:20 mail amavis[17226]: (17226-02) LMTP::10024
/var/lib/amavis/tmp/amavis-20091001T131825-17226:
<mo...@hotmail.com> -> <mo...@example.com>
SIZE=1911 Received: from mail.example.com ([127.0.0.1]) by localhost
(mail.example.com [127.0.0.1]) (amavisd-new, port 10024) with LMTP; Thu, 1
Oct 2009 13:22:20 +0600 (PKST)
Oct 1 13:22:20 mail amavis[17226]: (17226-02) Checking: k-6-c3dQQGNL
<mo...@hotmail.com> -> <mo...@example.com>
Oct 1 13:22:20 mail amavis[17226]: (17226-02) query_keys: user@example.com,
user@, example.com, .example.com, .com.pk, .pk, .
Oct 1 13:22:20 mail amavis[17226]: (17226-02)
lookup_hash(user@example.com), no matches
Oct 1 13:22:20 mail amavis[17226]: (17226-02) lookup (bypass_virus_checks)
=> undef, "user@example.com" does not match
Oct 1 13:22:20 mail amavis[17226]: (17226-02) lookup (bypass_header_checks)
=> true, "user@example.com" matches, result="1",
matching_key="(constant:1)"
Oct 1 13:22:20 mail amavis[17226]: (17226-02) query_keys: user@example.com,
user@, example.com, .example.com, .com.pk, .pk, .
Oct 1 13:22:20 mail amavis[17226]: (17226-02)
lookup_hash(user@example.com), no matches
Oct 1 13:22:20 mail amavis[17226]: (17226-02) lookup (bypass_banned_checks)
=> undef, "user@example.com" does not match
Oct 1 13:22:20 mail amavis[17226]: (17226-02) lookup (banned_filename), 1
matches for "user@example.com", results: "(constant:DEFAULT)"=>"DEFAULT"
Oct 1 13:22:20 mail amavis[17226]: (17226-02) collect banned table[0]:
user@example.com, tables: DEFAULT=>Amavis::Lookup::RE=ARRAY(0x8c680e8)
Oct 1 13:22:20 mail amavis[17226]: (17226-02) skip banned check for
user@example.com, same tables as previous, result =>
Oct 1 13:22:20 mail amavis[17226]: (17226-02) p.path user@example.com:
"P=p003,L=1,M=multipart/alternative | P=p001,L=1/1,M=text/plain,T=txt"
Oct 1 13:22:20 mail amavis[17226]: (17226-02) skip banned check for
user@example.com, same tables as previous, result =>
Oct 1 13:22:20 mail amavis[17226]: (17226-02) p.path user@example.com:
"P=p003,L=1,M=multipart/alternative | P=p002,L=1/2,M=text/html,T=html"
Oct 1 13:22:31 mail amavis[17226]: (17226-02) query_keys: user@example.com,
user@, example.com, .example.com, .com.pk, .pk, .
Oct 1 13:22:31 mail amavis[17226]: (17226-02)
lookup_hash(user@example.com), no matches
Oct 1 13:22:31 mail amavis[17226]: (17226-02) lookup (bypass_virus_checks)
=> undef, "user@example.com" does not match
Oct 1 13:22:31 mail amavis[17226]: (17226-02) lookup (spam_tag2_level) =>
true, "user@example.com" matches, result="4.31",
matching_key="(constant:4.31)"
Oct 1 13:22:31 mail amavis[17226]: (17226-02) lookup (spam_tag3_level) =>
undef, "user@example.com" does not match
Oct 1 13:22:31 mail amavis[17226]: (17226-02) lookup (spam_kill_level) =>
true, "user@example.com" matches, result="4.31",
matching_key="(constant:4.31)"
Oct 1 13:22:31 mail amavis[17226]: (17226-02) lookup (bypass_spam_checks)
=> true, "user@example.com" matches, result="1",
matching_key="(constant:1)"
Oct 1 13:22:31 mail amavis[17226]: (17226-02) final_destiny PASS, recip
user@example.com
Oct 1 13:22:31 mail amavis[17226]: (17226-02) lookup (clean_quarantine_to)
=> true, "user@example.com" matches, result="clean-quarantine",
matching_key="(constant:clean-quarantine)"
Oct 1 13:22:31 mail amavis[17226]: (17226-02) lookup => undef,
"user@example.com", no lookup tables
Oct 1 13:22:31 mail amavis[17226]: (17226-02) query_keys: user@example.com,
user@, example.com, .example.com, .com.pk, .pk, .
Oct 1 13:22:31 mail amavis[17226]: (17226-02)
lookup_hash(user@example.com), no matches
Oct 1 13:22:31 mail amavis[17226]: (17226-02) lookup_acl(user@example.com)
matches key "example.com", result=1
Oct 1 13:22:31 mail amavis[17226]: (17226-02) lookup (local_domains) =>
true, "user@example.com" matches, result="1", matching_key="example.com"
Oct 1 13:22:31 mail amavis[17226]: (17226-02) headers CLUSTERING:
<us...@example.com> joining cluster
Oct 1 13:22:31 mail amavis[17226]: (17226-02) (about to connect to
[127.0.0.1]:10025) FWD via SMTP: <mo...@hotmail.com> ->
<mo...@example.com>
Oct 1 13:22:31 mail amavis[17226]: (17226-02) sending RCPT
TO:<us...@example.com>
Oct 1 13:22:31 mail amavis[17226]: (17226-02) response to RCPT TO for
<us...@example.com>: "250 2.1.5 Ok"
Oct 1 13:22:32 mail amavis[17226]: (17226-02) FWD via SMTP:
<mo...@hotmail.com> -> <mo...@example.com>, 250
2.6.0 Ok, id=17226-02, from MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as
E0EAD19B349
Oct 1 13:22:32 mail amavis[17226]: (17226-02) dsn: from MTA 250 Clean
<mo...@hotmail.com> -> <us...@example.com>: on_succ=0, on_dly=1,
on_fail=1, never=0, warn_sender=, DSN_passed_on=1
Oct 1 13:22:32 mail amavis[17226]: (17226-02) DSN: SUCC from MTA 250 Clean,
no DSN requested: <mo...@hotmail.com> -> <us...@example.com>
Oct 1 13:22:32 mail amavis[17226]: (17226-02) Passed CLEAN, [65.55.90.7]
<mo...@hotmail.com> -> <mo...@example.com>,
Message-ID: <SN...@phx.gbl>, mail_id:
k-6-c3dQQGNL, Hits: -, queued_as: E0EAD19B349, 11559 ms
Oct 1 13:22:32 mail amavis[17226]: (17226-02) sending LMTP response for
<us...@example.com>: "250 2.6.0 Ok, id=17226-02, from MTA([127.0.0.1]:10025):
250 2.0.0 Ok: queued as E0EAD19B349"
Oct 1 13:22:32 mail postfix/lmtp[17620]: C364719B337:
to=<us...@example.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=15,
delays=3.7/0/0/12, dsn=2.6.0, status=sent (250 2.6.0 Ok, id=17226-02, from
MTA([127.0.0.1]:10025): 250 2.0.0 Ok: queued as E0EAD19B349)
Oct 1 13:22:39 mail postfix/smtp[17579]: E0EAD19B349:
to=<us...@example.com>, relay=mail.example.com[10.65.200.72]:25, delay=7.1,
delays=0.09/0/0.01/7, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as
3DD1212B701)
empiric wrote:
>
> Guys
> I am getting all my external domain emails tagged as SpamSpam
>
> logs are attached.
> mail headers
>
> Return-Path: <us...@gmail.com>
> Delivered-To: user@domain.com
> Received: from localhost (localhost [127.0.0.1])
> by mail1.domain.com (Postfix) with ESMTP id 39B3C12B71D
> for <us...@domain.com>; Tue, 29 Sep 2009 10:19:57 +0600 (PKST)
> X-Quarantine-ID: <asR-LhZoxUsQ>
> X-Amavis-Alert: BAD HEADER Improper folded header field made up entirely
> of
> whitespace (char 20 hex): Subject: ...?Q?Spam?=\n
> =?utf-8?Q?Spam=0D=0A=20helo123?=\n \n
> Received: from mail1.domain.com ([127.0.0.1])
> by localhost (mail2.domain.com [127.0.0.1]) (amavisd-new, port 10024)
> with LMTP id asR-LhZoxUsQ for <us...@domain.com>;
> Tue, 29 Sep 2009 10:19:56 +0600 (PKST)
> Received: from mail.domain.com (unknown [203.101.170.27])
> by mail1.domain.com (Postfix) with ESMTP id C6CF512B701
> for <us...@domain.com>; Tue, 29 Sep 2009 10:19:54 +0600 (PKST)
> Received: from localhost (localhost [127.0.0.1])
> by muses.domain.com (Postfix) with ESMTP id 6982319B322
> for <us...@domain.com>; Tue, 29 Sep 2009 10:19:53 +0600 (PKST)
> X-Virus-Scanned: Debian amavisd-new at domain.com
> Received: from mail.domain.com ([127.0.0.1])
> by localhost (mail.domain.com [127.0.0.1]) (amavisd-new, port 10024)
> with LMTP id A1fSGV+XdA-K for <us...@domain.com>;
> Tue, 29 Sep 2009 10:19:49 +0600 (PKST)
> Received: from mail-qy0-f191.google.com (mail-qy0-f191.google.com
> [209.85.221.191])
> by mail.domain.com (Postfix) with ESMTP id B3AB03BE38
> for <us...@domain.com>; Tue, 29 Sep 2009 10:19:44 +0600 (PKST)
> Received: by qyk29 with SMTP id 29so3777375qyk.32
> for <us...@domain.com>; Mon, 28 Sep 2009 21:19:40 -0700 (PDT)
> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
> d=gmail.com; s=gamma;
> h=domainkey-signature:mime-version:received:date:message-id:subject
> :from:to:content-type;
> bh=WoV7lT+YT3JKxromudz0thKd6Y5aCdlJ7QFXjsxBCvc=;
>
> b=suj1zJ/bZjwhfYDIy4YWp9YGpL4TFSKVOPm0R8ps0+kIV4SlldvI8A23Vtd2eXAzhd
>
> /pdlqvr7uGT4MR777LO27yKPEaNjqT2dPEVlFXAtc+vQq0Ib2WPPQMR70+77h7Bcfkir
> IIELi+qXFfqj4/IpAcTlP3YtSFfwj42KT+MJs=
> DomainKey-Signature: a=rsa-sha1; c=nofws;
> d=gmail.com; s=gamma;
> h=mime-version:date:message-id:subject:from:to:content-type;
>
> b=mHuhtzREpgetfc3a2kwtOBZZ47s0NR/Qje/GDeE5ZzNUMxOdvU9TtLZqZUM1KVDv6u
>
> dTs/wcIM133W1aDhZJzp4YTFIfmzCz1M/YJeo7+lDNcHERQ0Y6ilLjzoZ7NRf69H3bKn
> RGQxQ9yCAjwLI3FbAgyDtZtW7CYFyKBWNP7M8=
> MIME-Version: 1.0
> Received: by 10.229.1.65 with SMTP id 1mr1690588qce.20.1254197980062; Mon,
> 28
> Sep 2009 21:19:40 -0700 (PDT)
> Date: Tue, 29 Sep 2009 10:19:40 +0600
> Message-ID: <a2...@mail.gmail.com>
> Subject: =?utf-8?Q?Spam?=
> =?utf-8?Q?Spam=0D=0A=20helo123?=
>
>
>
> spamassassin debug logs
> #spamassassin -t -D
> X-Spam-Checker-Version: SpamAssassin 3.1.7-deb (2006-10-05) on
> mail.domaon.com
> X-Spam-Level: ****
> X-Spam-Status: No, score=4.8 required=5.0
> tests=DCC_CHECK,DNS_FROM_RFC_ABUSE,
> DNS_FROM_RFC_POST,HTML_MESSAGE,SUBJECT_ENCODED_TWICE,
> SUBJECT_EXCESS_QP autolearn=no version=3.1.7-deb
> Delivered-To: user@domaon.com
> Received: from localhost (localhost [127.0.0.1])
> by mail1.domaon.com (Postfix) with ESMTP id C13911B32DB
> for <us...@domaon.com>; Wed, 30 Sep 2009 17:03:54 +0600 (PKST)
> Received: from mail1.domaon.com ([127.0.0.1])
> by localhost (mail1.domaon.com [127.0.0.1]) (amavisd-new, port 10024)
> with LMTP id p23bnIio88SC for <us...@domaon.com>;
> Wed, 30 Sep 2009 17:03:54 +0600 (PKST)
> Received: from mail.domaon.com (unknown [203.101.170.27])
> by mail1.domaon.com (Postfix) with ESMTP id 22F7D1B32D7
> for <us...@domaon.com>; Wed, 30 Sep 2009 17:03:53 +0600 (PKST)
> Received: from localhost (localhost [127.0.0.1])
> by mail.domaon.com (Postfix) with ESMTP id 976D319B330
> for <us...@domaon.com>; Wed, 30 Sep 2009 17:03:53 +0600 (PKST)
> X-Virus-Scanned: Debian amavisd-new at domaon.com
> Received: from mail.domaon.com ([127.0.0.1])
> by localhost (mail.domaon.com [127.0.0.1]) (amavisd-new, port 10024)
> with LMTP id el+R1y6R6iaa for <us...@domaon.com>;
> Wed, 30 Sep 2009 17:03:53 +0600 (PKST)
> Received: from snt0-omc1-s35.snt0.hotmail.com
> (snt0-omc1-s35.snt0.hotmail.com [65.55.90.46])
> by mail.domaon.com (Postfix) with ESMTP id D14C419B32D
> for <us...@domaon.com>; Wed, 30 Sep 2009 17:03:52 +0600 (PKST)
> Received: from SNT106-W54 ([65.55.90.7]) by snt0-omc1-s35.snt0.hotmail.com
> with Microsoft SMTPSVC(6.0.3790.3959);
> Wed, 30 Sep 2009 04:03:47 -0700
> Message-ID: <SN...@phx.gbl>
> Content-Type: multipart/alternative;
> boundary="_4abea601-ec42-4378-af03-83675013aef6_"
> X-Originating-IP: [125.209.118.102]
> From: mohsin alizai <mo...@hotmail.com>
> To: <us...@domaon.com>
> Subject: =?utf-8?Q?Spam?=
> =?utf-8?Q?Spam=0D=0A=20test?=
> Date: Wed, 30 Sep 2009 11:03:47 +0000
> Importance: Normal
> MIME-Version: 1.0
> X-OriginalArrivalTime: 30 Sep 2009 11:03:47.0973 (UTC)
> FILETIME=[AF55A350:01CA41BD]
> X-SpamInfo: return-email, failed to obtain DNS record for domain
> hotmail.com
> X-SpamInfo: return-email, failed to obtain DNS record for domain
> hotmail.com
>
> --_4abea601-ec42-4378-af03-83675013aef6_
> Content-Type: text/plain; charset="Windows-1252"
> Content-Transfer-Encoding: quoted-printable
>
>
> test =0A=
>
>
--
View this message in context: http://www.nabble.com/I-am-getting-all-external-domain-emails-subject-tagged-as-SpamSpam-tp25685055p25693451.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.
Re: I am getting all external domain emails subject tagged as SpamSpam
Posted by John Hardin <jh...@impsec.org>.
On Thu, 1 Oct 2009, empiric wrote:
> Oct 1 13:22:39 mail postfix/smtp[17579]: E0EAD19B349:
> to=<us...@example.com>, relay=mail.example.com[10.65.200.72]:25, delay=7.1,
> delays=0.09/0/0.01/7, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as
> 3DD1212B701)
None of that really logs useful information to troubleshoot this problem.
You should try to see what the Subject: header is at each step of
processing, including how it's coming into your MTA from outside.
Can you set up a sniffer on port 25 and send in a message from the
Internet and see what the Subject: header says in the packet capture?
What programs is Amavis calling to process the message prior to SA?
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
You cannot bring about prosperity by discouraging thrift. You
cannot help small men by tearing down big men. You cannot
strengthen the weak by weakening the strong. You cannot lift the
wage-earner by pulling down the wage-payer. You cannot help the
poor man by destroying the rich. You cannot keep out of trouble by
spending more than your income. You cannot further the brotherhood
of man by inciting class hatred. You cannot establish security on
borrowed money. You cannot build character and courage by taking
away men's initiative and independence. You cannot help men
permanently by doing for them what they could and should do for
themselves. -- William J. H. Boetcker
-----------------------------------------------------------------------
Approximately 9081780 firearms legally purchased in the U.S. this year