You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Ray Anderson <rs...@rb-com.com> on 2004/12/22 16:42:23 UTC
Spamassassin help
Second attempt:
Greetings, I've been using spamassassin 2.55 for a while now on Mandrake 9.2.
I have a list of URL's that are grouped to form a pretty big meta tag, and this has worked great for years now. Recently, one
dirtbag message has found a way through the defenses and I can't figure out where it's breaking. The interesting thing is that if I
forward this message to myself it works fine, and uses my custom body checks.
I have verified that womenhavebeen.com *IS* in my body_checks list (in my local.cf), but it seems that spamassassin just ignores the
body_checks on the original message.
Does anyone have any clue as to why this is happening?
Many thanks in advance,
Original message
====================================================
<original message removed as it got flagged as spam!>
====================================================
Original message spamassassin headers:
====================================================
X-Spam-Status: No, hits=0.1 required=3.0
tests=HTML_MESSAGE
version=2.55
X-Spam-Level:
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
====================================================
And when I forward the message to myself, I get the following headers:
====================================================
X-Spam-Status: Yes, hits=75.1 required=3.0
tests=FORGED_MUA_OUTLOOK,MISSING_OUTLOOK_NAME,
rays_body_checks
version=2.55
X-Spam-Level:
X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
====================================================
-=Ray
------------------------------------------------
Ray Anderson
System Development Manager
916.788.2444 (Office)
916.798.9439 (Mobile)
PRIDE Industries
rsa@prideindustries.com
http://www.prideindustries.com
------------------------------------------------
One of the secrets of air fighting was to see the other man first. Seeing airplanes from great distances was a question of
experience and training, of knowing where to look and what to look for. Experienced pilots always saw more than the newcomers,
because the latter were more concerned with flying than fighting....The novice had little idea of the situation, because his brain
was bewildered by the shock and ferocity of the fight.
Air Vice-Marshal J.E. "Johnnie" Johnson, RAF
Re: Spamassassin help
Posted by Jeff Chan <je...@surbl.org>.
On Wednesday, December 22, 2004, 8:38:04 AM, Matt Kettler wrote:
> At 10:42 AM 12/22/2004, Ray Anderson wrote:
>>Greetings, I've been using spamassassin 2.55 for a while now on Mandrake 9.2.
>>
>>I have a list of URL's that are grouped to form a pretty big meta tag, and
>>this has worked great for years now. Recently, one
>>dirtbag message has found a way through the defenses and I can't figure
>>out where it's breaking. The interesting thing is that if I
>>forward this message to myself it works fine, and uses my custom body checks.
>>
>>I have verified that womenhavebeen.com *IS* in my body_checks list (in my
>>local.cf), but it seems that spamassassin just ignores the
>>body_checks on the original message.
>>
>>Does anyone have any clue as to why this is happening?
> Well.. Can you give us some more clues as to what you're doing?
> What does your rule look like? is it a body rule? a rawbody rule, or a uri
> rule?
> If it is a body rule, then it won't match any urls that are inside a HTML
> tag. HTML tags are stripped prior to running body rules. Use rawbody, or
> uri rules instead.
Or upgrade to SA 3.0.2 and use the default URIDNSBL.pm
commands, which will catch most of these spams
automatically based on their contained URIs. (Under
2.64 you could use SpamCopURI similarly.)
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: Spamassassin help
Posted by Matt Kettler <mk...@evi-inc.com>.
At 10:42 AM 12/22/2004, Ray Anderson wrote:
>Greetings, I've been using spamassassin 2.55 for a while now on Mandrake 9.2.
>
>I have a list of URL's that are grouped to form a pretty big meta tag, and
>this has worked great for years now. Recently, one
>dirtbag message has found a way through the defenses and I can't figure
>out where it's breaking. The interesting thing is that if I
>forward this message to myself it works fine, and uses my custom body checks.
>
>I have verified that womenhavebeen.com *IS* in my body_checks list (in my
>local.cf), but it seems that spamassassin just ignores the
>body_checks on the original message.
>
>Does anyone have any clue as to why this is happening?
Well.. Can you give us some more clues as to what you're doing?
What does your rule look like? is it a body rule? a rawbody rule, or a uri
rule?
If it is a body rule, then it won't match any urls that are inside a HTML
tag. HTML tags are stripped prior to running body rules. Use rawbody, or
uri rules instead.