X-Originating and X-Apparently-From

[Andrew Doughety <an...@queso.onshore.com>]

Hi,
 	We are trying to perform DNSBL checks on incoming mail and we are 
not seeing any actual DNS queries.  When looking at the code it seems that 
the information on which IP(s) to check is obtained from X-Originating and 
X-Apparently-From headers.  Grepping through the code I do not see these 
headers anywhere else.  We are using Postfix as our MTA, perhaps that 
is the problem?  We could either write a postfix rule or edit the SA code to 
check the Received header.

Thanks,
Andrew

Re: X-Originating and X-Apparently-From

[Andrew Doughety <an...@queso.onshore.com>]

> Andrew Doughety wrote:
>> Hi,
>>     We are trying to perform DNSBL checks on incoming mail and we are
>> not seeing any actual DNS queries.  When looking at the code it seems
>> that the information on which IP(s) to check is obtained from
>> X-Originating and X-Apparently-From headers.
>
> No, SA should be checking the IPs from the Received: headers.
>
> However, make sure your trust path is working correctly. If you ever see spam
> matching ALL_TRUSTED, then that email is going to be exempt from DNSBL tests.
>
> 9 times out of 10, this is the trust-path guesser being confused by a NAT
> config. See the wiki on how to fix this:
>
> http://wiki.apache.org/spamassassin/TrustPath

Restricting the trusted path fixed the problem.  Thanks!

Re: X-Originating and X-Apparently-From

[Matt Kettler <mk...@evi-inc.com>]

Andrew Doughety wrote:
> Hi,
>     We are trying to perform DNSBL checks on incoming mail and we are
> not seeing any actual DNS queries.  When looking at the code it seems
> that the information on which IP(s) to check is obtained from
> X-Originating and X-Apparently-From headers.

No, SA should be checking the IPs from the Received: headers.

However, make sure your trust path is working correctly. If you ever see spam
matching ALL_TRUSTED, then that email is going to be exempt from DNSBL tests.

9 times out of 10, this is the trust-path guesser being confused by a NAT
config. See the wiki on how to fix this:

http://wiki.apache.org/spamassassin/TrustPath

Re: X-Originating and X-Apparently-From

["Daryl C. W. O'Shea" <sp...@dostech.ca>]

Andrew Doughety wrote:
> Hi,
>     We are trying to perform DNSBL checks on incoming mail and we are 
> not seeing any actual DNS queries.  When looking at the code it seems 
> that the information on which IP(s) to check is obtained from 
> X-Originating and X-Apparently-From headers.  Grepping through the code 
> I do not see these headers anywhere else.  We are using Postfix as our 
> MTA, perhaps that is the problem?  We could either write a postfix rule 
> or edit the SA code to check the Received header.

No need to edit any code.  SpamAssassin already checks every appropriate IP.

Since you didn't provide any info about your SpamAssassin setup, I'll 
just guess...

You're using spamd or some other daemonized version of SpamAssassin and 
you don't have network tests enabled.

For spamd, remove the "-L" from your startup options.  On RedHat based 
systems you'll find this in /etc/sysconfig/spamassassin.

For other daemonized versions of SpamAssassin, there's a variable you'll 
need to enable by setting it to 1 to enable network tests.


Daryl

Re: X-Originating and X-Apparently-From

[mouss <us...@free.fr>]

Andrew Doughety wrote:
> Hi,
>     We are trying to perform DNSBL checks on incoming mail and we are 
> not seeing any actual DNS queries.  When looking at the code it seems 
> that the information on which IP(s) to check is obtained from 
> X-Originating and X-Apparently-From headers.
my understanding is that SA parses received headers. if SA "believes" in 
X-originating or "X-apparently' thing, then it would be a huge bug for me.

> Grepping through the code I do not see these headers anywhere else.  
> We are using Postfix as our MTA, perhaps that is the problem?  We 
> could either write a postfix rule or edit the SA code to check the 
> Received header.
>
> Thanks,
> Andrew
>
>