>From header being added..???

[QQQQ <qq...@usermail.com>]

All,

I'm not 100% positive this is even a SA issue but it is driving me up the wall.  Some mailings are having this added right after the 
SA report.  It usually isn't an issue except that some user fetch their mail from Exchange and these mailings are showing up munged. 
Here is an example:

X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on DOMAIN
X-Spam-Level: ***********************
X-Spam-Status: Yes, score=24.0 required=5.2 tests=DATE_IN_FUTURE_06_12,
        DCC_CHECK,DIGEST_MULTIPLE,FUZZY_AFFORDABLE,FUZZY_MEDICATION,
        FUZZY_PRICES,HTML_IMAGE_ONLY_24,HTML_MESSAGE,RAZOR2_CF_RANGE_51_100,
        RAZOR2_CF_RANGE_E8_51_100,RAZOR2_CHECK,RCVD_IN_SORBS_DUL,
        SARE_SPEC_LEO_MEDS,UPPERCASE_25_50,URIBL_BLACK,URIBL_SBL
        autolearn=disabled version=3.1.0
X-Spam-Report:
        *  1.5 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
        *  1.8 FUZZY_AFFORDABLE BODY: Attempt to obfuscate words in spam
        *ALL rules removed for simplicity*
>>From userid  Sun Jul  2 23:47:35 2006
Return-Path: userid@domain.com
Received: from k5u5r1

See the >From header?


Any thoughts?

TIA 

Re: >From header being added..???

[qqqq <qq...@usermail.com>]

>>The latter part is correct if the mail is going to be
| placed in a unix-style flat-file mailbox, but the former is wrong:
| The "From " line, if any, should not be added until final delivery of
| the message to the mailbox file.
|

Interesting....

I am using Procmail to deliver via Maildir format.  I didn't want to use Maildrop due to all the
custom procmail rules I have.  What's strange is it doesn't happen on all emailings.  From what I
can tell, only mailings sent from outlook but I'm not 100% sure about that.

QQQQ

Re: >From header being added..???

[Bart Schaefer <ba...@gmail.com>]

On 7/2/06, QQQQ <qq...@usermail.com> wrote:
>
> I'm not 100% positive this is even a SA issue but it is driving me up the wall.  Some mailings are having this added right after the
> SA report.  It usually isn't an issue except that some user fetch their mail from Exchange and these mailings are showing up munged.

Did you recently change from SA 3.0 or earlier to 3.1?  In 3.1 SA
began inserting its headers at the TOP of the filtered message header,
rather than at the end.  This is more closely conformant to the IETF
mail standards and helps reduce breakage of message signature schemes
such as DKIM.

The point is that you may have had a problem with mail processing for
a while, and the behavior of earlier versions of SA simply masked it.

> X-Spam-Report:
>         *  1.5 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date
>         *  1.8 FUZZY_AFFORDABLE BODY: Attempt to obfuscate words in spam
>         *ALL rules removed for simplicity*
> >From userid  Sun Jul  2 23:47:35 2006
> Return-Path: userid@domain.com
> Received: from k5u5r1
>
> See the >From header?

In all likelyhood this was a "From " line (with no leading ">") at the
time SA was handed the message, and was rewritten as a ">From " line
by the local delivery processing after SA was already finished with
the message.  The latter part is correct if the mail is going to be
placed in a unix-style flat-file mailbox, but the former is wrong:
The "From " line, if any, should not be added until final delivery of
the message to the mailbox file.

Look at the processing that's upstream of spamassassin or spamc.  In
particular check whether the message is ever written to a file and
then read back in to the processing stream. The culprit is likely to
be whatever does that write.