ANNOUNCE: Version 3.20-4 released

Maurizio Matteo Munafo' munafo at PREZZEMOLO.POLITO.IT
Mon Jun 17 23:17:21 IST 2002


Julian Field wrote:
>
> At 19:05 17/06/2002, you wrote:
> >I just installed 3.20-4 (and the latest versions of SpamAssassin and Razor)
> >and I noticed that if Log Spam is enabled, the log message contains the IP
> >address of the last relay (and the internet name of the actual source)
> >
> >For example:
> >
> >Jun 17 19:33:19 prezzemolo mailscanner[8541]: Message g5HHWwt09427 from
> >     130.192.2.16 (surem.co.kr) is spam according to SpamAssassin
> >     (score=16.4, required 5, KOREAN_UCE_SUBJECT, COPYRIGHT_CLAIMED,
> >      MIME_EXCESSIVE_QP, BASE64_ENC_TEXT, SUBJ_ALL_CAPS, SUBJ_FULL_OF_8BITS,
> >      CHARSET_FARAWAY_HEADERS, DATE_IN_PAST_48_96)
> >
> >where 130.192.2.16 (pol88b.polito.it ) is actually our main mail server (the
> >MX for the domain) and its address appears in all the SpamAssassin logs.
> >
> >Shouldn't the two addresses be the same?
>
> No.
> The number is the IP address of the SMTP client that made the connection to
> the mail server.
> The name is the domain name of the sender's address as read from the
> message envelope.

This can be reasonable. My only doubt was having an IP address and am
Internet name side by side with two different meanings.

Perhaps "from 130.192.2.16 (surem.co.kr)" should be
"(apparently) from surem.co.kr via 130.192.2.16" or something similar could
save some people from having to read the documentation :)

Regards,
Maurizio Munafo'

--
Maurizio M. Munafo' / munafo at mail.tlc.polito.it
"Consider Phlebas, who was once handsome and tall as you" (T.S.Eliot)



More information about the MailScanner mailing list