first message spam, next spam gets whitelisted?

[Fractal IT Dept.]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Matt Kettler wrote:

>Looking at your "problem" it appears the second message is actually the
>first message.
>
> However, the second one looks like it's already been tagged by a
>version of SpamAssassin that's set to encapsulate spam messages. When
>spamassassin encapsulates, it replaces all the headers, so MailScanner
>will see the message as coming from the machine that tagged it as spam,
>not as coming from the spammer.
>
>You might want to dig around and check your headers for the spam message
>in question VERY closely.
>
>You might be double-scanning your messages sent to localdomain1.com. In
>particular, check if if localdomain0.com is set up as a forward to
>localdomain1 in such a way that it will get sent back through the
>MailScanner a second time.
>
>
Hi Matt,

Sorry, the order of the messages was backwards because MailWatch
displays them in reverse chronological order. When I refer to the first
message, I mean the one that arrived earlier in time, which was the
second one as displayed. :-)

In this case your guess was bang on. Upon further investigation, it
turns out that the first email address forwards to the second. So how do
we get around this? If it's checked for spam the first time through and
tagged, we want it to stay tagged as spam when it gets forwarded.
Alternatively, I suppose I could turn off spam checking on the address
that's simply a forward alias. What do you suggest?

Thanks,
Chris

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!