Re: [sa] Re: I am getting all external domain emails subject tagged as SpamSpam

[Charles Gregory <cg...@hwcn.org>]

On Wed, 30 Sep 2009, Nauman Yousuf wrote:
> Guys I am getting all my external domain emails tagged as SpamSpam
> mail headers
> X-Amavis-Alert: BAD HEADER Improper folded header field made up entirely of
>    whitespace (char 20 hex): Subject: ...?Q?Spam?=\n
>    =?utf-8?Q?Spam=0D=0A=20helo123?=\n \n

Well, according to this, amavis doesn't like the fact that the 'Subject' 
header is made up of many spaces. Looks like the original subject was 
'heloo123' plus a BUNCH of spaces. An MTA has 'folded' them properly, but 
AMAVIS considers this suspicious. Question would be, how did all those 
spaces get in there in the first place? Are you running the message 
through some sort of pre-process before sending it to SA?

There are also some clues in the SA rule match "SUBJECT_ENCODED_TWICE".
This suggests again, something is trying to encapsulate your subject
before it gets to spamassassin. If this is happening on ALL your mail,
then it is something in your front end.

- C

Re: [sa] Re: I am getting all external domain emails subject tagged as SpamSpam

[Mark Martinec <Ma...@ijs.si>]

On Wednesday 30 September 2009 19:25:52 Charles Gregory wrote:
>  On Wed, 30 Sep 2009, Nauman Yousuf wrote:
>  > Guys I am getting all my external domain emails tagged as SpamSpam
>  > mail headers
>  > X-Amavis-Alert: BAD HEADER Improper folded header field made up entirely
>  > of whitespace (char 20 hex): Subject: ...?Q?Spam?=\n
>  >    =?utf-8?Q?Spam=0D=0A=20helo123?=\n \n
>  
>  Well, according to this, amavis doesn't like the fact that the 'Subject'
>  header is made up of many spaces. Looks like the original subject was
>  'heloo123' plus a BUNCH of spaces. An MTA has 'folded' them properly, but
>  AMAVIS considers this suspicious. Question would be, how did all those
>  spaces get in there in the first place? Are you running the message
>  through some sort of pre-process before sending it to SA?
>  
>  There are also some clues in the SA rule match "SUBJECT_ENCODED_TWICE".
>  This suggests again, something is trying to encapsulate your subject
>  before it gets to spamassassin. If this is happening on ALL your mail,
>  then it is something in your front end.

You missed the point, it's not about 'many spaces' or 'trailing spaces',
but there was an illegal all-whitespace line in the header section,
just following the Subject, as reported:

Subject: ...?Q?Spam?=\n =?utf-8?Q?Spam=0D=0A=20h\
elo123?=\n \n
        ^^^^^

  Mark

Re: I am getting all external domain emails subject tagged as SpamSpam

[Charles Gregory <cg...@hwcn.org>]

Firstly, PLEASE DIRECT ALL REPLIES TO LIST, not my personal email.

On Wed, 30 Sep 2009, Nauman Yousuf wrote:
> i dont know , how subject is filled with spaces , what i need to check 
> am clue less this is happening from last 3 days

First question of troubleshooting: What changed?

If it worked 4 days ago, and didn't work 3 days ago, something changed
between 3 and 4 days to make it stop working. Isolate the time it stopped 
working, and check for ALL changes to the server at that time. Files, 
permissions, disk full, anything.....

- C