What is triggering BAD_X_HEADERS?

[Mat Bowen <M....@lboro.ac.uk>]

Hello,

Can anyone tell me what is causing the BAD_X_HEADERS hit on these 
headers? Is it the X-URL?

X-URL: http://www.pocomail.com
X-Scanned-By: MIMEDefang 2.36
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) (SAProxy Pro 
2.5) on
        mat-hkdnjivb2sj
X-Spam-Level: ******
X-Spam-Status: Yes, hits=6.5 required=5.0 
tests=BAD_X_HEADERS,PRETERNATURALLY
        autolearn=spam version=2.63
X-Spam-Report:
        *  3.0 BAD_X_HEADERS Message uses spammy X- header
        *  3.5 PRETERNATURALLY BODY: full body contains 
PRETERNATURALLY
X-From-Domain: pocomail.com
X-Poco-UID: 99596811
X-Poco-Status: RW
X-Account: NTL

I've removed the other headers for privacy but if they're needed i'll 
post them. The X-From-Domain is added after download (i think all of 
the last four must be) so it isn't that but this is from an authentic 
email so i don't want it to trigger the BAD_X_HEADERS test.

Any info is much appreciated!

Thanks,
Mat

Re: What is triggering BAD_X_HEADERS?

[Mat Bowen <M....@lboro.ac.uk>]

On Wed, 25 Feb 2004 15:40:42 -0800, Kelson Vibber wrote:
> At 02:39 PM 2/25/2004, Mat Bowen wrote:
>> Can anyone tell me what is causing the BAD_X_HEADERS hit on these
>> headers? Is it the X-URL?
>
> Assuming you're using the rule from
> http://www.merchantsoverseas.com/wwwroot/gorilla/nov2rules.cf it
> looks like
> X-URL would trip it.
>
> A brief Google search for BAD_X_HEADERS turns up the following
> report of
> false positives with the same cause:
> http://www.mail-archive.com/spamassassin-
> talk@lists.sourceforge.net/msg25144.html
>
>
> Kelson Vibber
> SpeedGate Communications <www.speed.net>;

Thanks i see it now in nov2rules.cf and have removed it. I hope the
URL test gets removed from future updates, or at least the score
decreased.

Thanks again,
Mat

PS: My apologies to Kelson in sending my first reply directly to him 
and not to the list.

Re: What is triggering BAD_X_HEADERS?

[Kelson Vibber <ke...@speed.net>]

At 02:39 PM 2/25/2004, Mat Bowen wrote:
>Can anyone tell me what is causing the BAD_X_HEADERS hit on these
>headers? Is it the X-URL?

Assuming you're using the rule from 
http://www.merchantsoverseas.com/wwwroot/gorilla/nov2rules.cf it looks like 
X-URL would trip it.

A brief Google search for BAD_X_HEADERS turns up the following report of 
false positives with the same cause:
http://www.mail-archive.com/spamassassin-talk@lists.sourceforge.net/msg25144.html


Kelson Vibber
SpeedGate Communications <www.speed.net>