NOTSAME__REPLY_TO

[SA <sp...@linkcheck.co.uk>]

I'm getting false positives on this one...

NOTSAME__REPLY_TO   From yahoo but reply to yandex
score 1.0

... where reply-to and from are both yahoo.co.uk. There is no sign of 
yandex anywhere.

I've looked for this rule but cannot find it. Could someone please a) 
tell me where it is and b) fix it? If it persists I will drop the score 
to zero but be nice if it worked.

-- 
Dave Stiles

Re: NOTSAME__REPLY_TO

[SA <sp...@linkcheck.co.uk>]

 > If you still can't find it, try doing
 >     spamassassin --lint -Dconfig

Ok, John, that pointed me in the right direction. Thanks.

It was in whitelist_dkim.cf of all places! I can't recall specifically 
adding that rule to the whitelist but then: I have a poor memory for 
such things; but the rule is built on a set of meta rules that I DO 
recall adding, so it was probably me that added the NOTSAME rule. :(

And after examining the rule I found a ! negating the yandex part where 
it should not have. Why it's only just started firing I have no idea; 
it's been there for some time.

Many thanks for the help. :)

-- 
Dave Stiles

Re: NOTSAME__REPLY_TO

[John Wilcock <jo...@tradoc.fr>]

Le 28/09/2016 � 16:56, SA a �crit :
>> what .cf file includes that rule on your system?
>
> That was the point: I can't find it. I've done a grep for NOTSAME on
> usr/share/spamassassin/*.cf but got nothing. Is there another place I
> should be looking?

/etc/mail/spamassassin is another likely place, but it all depends on 
how SA was built on your system.

If you still can't find it, try doing
	spamassassin --lint -Dconfig
to find where it is looking for files and which .cf files it is reading.

Re: NOTSAME__REPLY_TO

[SA <sp...@linkcheck.co.uk>]

 > what .cf file includes that rule on your system?

That was the point: I can't find it. I've done a grep for NOTSAME on 
usr/share/spamassassin/*.cf but got nothing. Is there another place I 
should be looking?

Forgot to mention:

SA version: 3.3.2
Perl version: 5.14.2

-- 
Dave Stiles

Re: NOTSAME__REPLY_TO

[Axb <ax...@gmail.com>]

On 09/28/2016 04:21 PM, SA wrote:
> I'm getting false positives on this one...
>
> NOTSAME__REPLY_TO   From yahoo but reply to yandex
> score 1.0
>
> ... where reply-to and from are both yahoo.co.uk. There is no sign of
> yandex anywhere.
>
> I've looked for this rule but cannot find it. Could someone please a)
> tell me where it is and b) fix it? If it persists I will drop the score
> to zero but be nice if it worked.
>

what .cf file includes that rule on your system?