Forwarded mail lets spam through
Matt Bullock
mbullock at TROIKANETWORKS.COM
Sun Sep 12 08:38:52 IST 2004
Martin Hepworth wrote:
>Always Include SpamAssasin Report = yes
>SpamScore Number Instead Of Stars = yes
>Detailed Spam Report = yes
>Include Scores In SpamAssassin Report =yes
I checked my settings and they all correspond to what you suggested.
Below are headers from 1 email, received from the forwarding server
ns1701.softcom.net, then I simply forwarded that message back through my
mailscanner server to another account. When it was received it scored a
2.1, but when I forwarded it through again it scored 5.1.
Microsoft Mail Internet Headers Version 2.0
Received: from slammer.troikanetworks.com ([12.31.173.45]) by
xchange.venturanetworks.com with Microsoft SMTPSVC(6.0.3790.0);
Sat, 11 Sep 2004 15:15:17 -0700
Received: from ns1701.softcom.net (ns1701.softcom.net [209.142.8.13])
by slammer.troikanetworks.com (8.12.11/8.12.11) with ESMTP id
i8BMF5s5002082
for <matt at solidfunk.com>; Sat, 11 Sep 2004 15:15:06 -0700
Received: from 209.142.8.13 (eZvalaria@[218.18.195.73])
by ns1701.softcom.net (8.12.11/8.12.11) with SMTP id
i8BMF0HL021989
for <roto at clanmcp.com>; Sat, 11 Sep 2004 15:15:03 -0700
X-Message-Info: NWfnfMMM833dWXGvyCBIo605ZNHnn941+ELElfr4htA
Received: from gxnmqdcgndg5.sc83.ko.snet.kharkov.ua ([217.44.253.176])
by px496-mc05.sc83.ko.snet.kharkov.ua with Microsoft SMTPSVC
(5.0.0204.6219); Sat, 11 Sep 2004 18:14:56 -0500 PST
Received: from Roslynxhj77f1udh008rhw ([100.240.86.176]) by
ofykpazcmuxhsly571.sc83.ko.snet.kharkov.ua
(InterMail vM.5.01.06.05 188-929-364-072-251-07411509) with
SMTP
id
<909655133.BC428.hfkhw642.sc83.ko.snet.kharkov.ua at figurater0p4f40ou>
for <roto at clanmcp.com>; Sat, 11 Sep 2004 18:14:56 -0500
From: "Mcmahon-Lamont" <tzroto at clanmcp.com>
To: roto at clanmcp.com
Subject: Clark Simone
Date: Sat, 11 Sep 2004 18:14:56 -0500
Message-ID:
<309313yi658y38887$952526$hzr209ia83 at Roslyne727gsl394rjh71nc>
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--jkso798660083rvbMNT"
X-TroikaNetworks-MailScanner-OpenProtect-Information: Please contact the
Troika Networks, Inc. IT Department
X-TroikaNetworks-MailScanner-OpenProtect: Found to be clean
X-MailScanner-OpenProtect-MCPCheck:
X-TroikaNetworks-MailScanner-OpenProtect-SpamCheck: not spam,
SpamAssassin (score=2.1, required 5, OB_URI_RBL 2.10)
X-TroikaNetworks-MailScanner-OpenProtect-SpamScore: 2
X-MailScanner-OpenProtect-From: tzroto at clanmcp.com
Return-Path: tzroto at clanmcp.com
X-OriginalArrivalTime: 11 Sep 2004 22:15:17.0510 (UTC)
FILETIME=[D1A05A60:01C4984C]
----jkso798660083rvbMNT
Content-Type: text/html; Charset=windows-1252
Content-Transfer-Encoding: 7Bit
----jkso798660083rvbMNT--
Microsoft Mail Internet Headers Version 2.0
Received: from communicator.troikanetworks.com ([12.31.172.15]) by
loadstar.troikanetworks.com with Microsoft SMTPSVC(6.0.3790.0);
Sat, 11 Sep 2004 20:49:43 -0700
Received: from slammer.troikanetworks.com ([12.31.173.45]) by
communicator.troikanetworks.com with Microsoft SMTPSVC(5.0.2195.6713);
Sat, 11 Sep 2004 20:49:43 -0700
Received: from xchange.venturanetworks.com (xchange.venturanetworks.com
[12.42.120.163])
by slammer.troikanetworks.com (8.12.11/8.12.11) with ESMTP id
i8C3nXvn016878
for <mbullock at troikanetworks.com>; Sat, 11 Sep 2004 20:49:33
-0700
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Subject: *Spam* FW: Clark Simone
X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0
Date: Sat, 11 Sep 2004 20:49:40 -0700
Message-ID:
<A8F190A47A2C9B4CB1925CE039D29C192D68 at xchange.venturanetworks.com>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: Clark Simone
Thread-Index: AcSYTNGxrxpfPjEgTDiCccGxZXzjmgALrIEg
From: "Matt Bullock" <mbullock at venturanetworks.com>
To: <mbullock at troikanetworks.com>
X-TroikaNetworks-MailScanner-OpenProtect-Information: Please contact the
Troika Networks, Inc. IT Department
X-TroikaNetworks-MailScanner-OpenProtect: Found to be clean
X-MailScanner-OpenProtect-MCPCheck:
X-TroikaNetworks-MailScanner-OpenProtect-SpamCheck: spam,
SpamAssassin (score=5.1, required 5, OB_URI_RBL 2.10,
SPAMCOP_URI_RBL 3.00)
X-TroikaNetworks-MailScanner-OpenProtect-SpamScore: 5
X-MailScanner-OpenProtect-From: mbullock at venturanetworks.com
Return-Path: mbullock at venturanetworks.com
X-OriginalArrivalTime: 12 Sep 2004 03:49:43.0220 (UTC)
FILETIME=[89B8B740:01C4987B]
Matt Bullock
-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
Behalf Of Martin Hepworth
Sent: Friday, September 10, 2004 1:25 AM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: Forwarded mail lets spam through
Matt
OK - I think I get the issue.
2 options..
Get MS to archive all email (you'll prob have to do this for the S-OX
bill soon anyway!). You can then run SA on the message by hand to get
info about rules hit/or not..
OR can then get MS to make sure you include ALL scores in the
mail-header info even if it's not spam, again you'll see which rules get
triggered and their score.
Make sure the followinng values are set in MailScanner.conf.
Always Include SpamAssasin Report = yes
SpamScore Number Instead Of Stars = yes
Detailed Spam Report = yes
Include Scores In SpamAssassin Report =yes
Hopefully you'll be able to start norrowing down the issue by getting
this instrumentation into the email.
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
More information about the MailScanner
mailing list