NO_DNS_FOR_FROM

[Matt Kettler]

<x-flowed>
At 02:10 PM 10/14/2004, Alan wrote:
> >Hmm.. question for you.. Can you run a message through spamassassin -D?
> >
> >Specifically I'm looking for "cannot trust envelope-from" debug messages.
> >
> >After doing some digging, SA 3.0 only applies this test to "envelope" type
> >headers... X-Sender,X-Envelope-From, Return-Path, Envelope-Sender.
>
>Yep, I had just read the same thing regarding SA3. I had gone and read the
>change log on that bugzilla entry when I read this:
>"- changes NO_DNS_FOR_FROM to use envelope sender instead of From: header"
>
>That tipped me off right away as to what might have happened.
>
>I have run a spam through spamassassin manually that I know should have a
>hit on NO_DNS_FOR_FROM. I think these are the relavant log entries you are
>looking for:

No, those are definitely not the line's I'm looking for.... That's the
Received: path parsing.. I don't care about the Received: header path and
what servers are trusted, this is something completely different. That's
got to do with trusted_networks, DNSBLs, whitelist_from_rcvd, ALL_TRUSTED,
etc. It has little or nothing to do with the envelope from trust.

I'm explicitly looking for a line that ends with "cannot trust
envelope-from". That text is a verbatim quote from the SA code. Here's the
full lines it might output:

       dbg ("X-Sender and fetchmail signatures found, cannot trust
envelope-from");
       dbg ("X-Envelope-From header found after 1 or more Received lines,
cannot trust envelope-from");
       dbg ("Envelope-Sender header found after 1 or more Received lines,
cannot trust envelope-from");
       dbg ("Return-Path header found after 1 or more Received lines,
cannot trust envelope-from");

> >One thing you might consider changing, providing you don't depend on the
> >header, is in MailScanner.conf:
> >
> >         #Envelope From Header = X-MailScanner-From:
> >         Envelope From Header = X-Envelope-From:
> >

I'm going to re-suggest trying the X-Envelope-From trick.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
</x-flowed>