Message tagged as spam even if sender is whitelisted

[Luca Palazzo]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,
today i'm experiencing a really strange problem. A customer sends a
mail, spamassassin is confugured to whitelist the sender (and does it)
but the message is tagged as spam.
When I look at log files the line seems to be truncated:

Oct 21 18:29:34 spamflt1 MailScanner[26731]: Message 72803152107.6D15A
from 82.53.230.146 (omniagricolae at omniagricolae.it) to maltanet.net is

The output of mailscanner (configured in debug,foreground and
spamassassin debug) seem to be right.

Any idea

Luca

In Debugging mode, not forking...
[26731] dbg: logger: adding facilities: all
[26731] dbg: logger: logging level is DBG
[26731] dbg: generic: SpamAssassin version 3.1.0
[26731] dbg: config: score set 0 chosen.
[26731] dbg: util: running in taint mode? no
[26731] dbg: dns: is Net::DNS::Resolver available? yes
[26731] dbg: dns: Net::DNS version: 0.48
[26731] dbg: dns: name server: 212.210.251.2, family: 2, ipv6: 0
SA bayes lock is /tmp/.spamassassin/bayes.lock
Bayes lock is at /tmp/.spamassassin/bayes.lock
[26731] dbg: ignore: test message to precompile patterns and load modules
[26731] dbg: config: using "/etc/mail/spamassassin" for site rules pre files
[26731] dbg: config: read file /etc/mail/spamassassin/init.pre
[26731] dbg: config: read file /etc/mail/spamassassin/v310.pre
[26731] dbg: config: using "/usr/share/spamassassin" for sys rules pre files
[26731] dbg: config: using "/usr/share/spamassassin" for default rules dir
[26731] dbg: config: read file /usr/share/spamassassin/10_misc.cf
[26731] dbg: config: read file /usr/share/spamassassin/20_advance_fee.cf
[26731] dbg: config: read file /usr/share/spamassassin/20_anti_ratware.cf
[26731] dbg: config: read file /usr/share/spamassassin/20_body_tests.cf
[26731] dbg: config: read file /usr/share/spamassassin/20_compensate.cf
[26731] dbg: config: read file /usr/share/spamassassin/20_dnsbl_tests.cf
[26731] dbg: config: read file /usr/share/spamassassin/20_drugs.cf
[26731] dbg: config: read file /usr/share/spamassassin/20_fake_helo_tests.cf
[26731] dbg: config: read file /usr/share/spamassassin/20_head_tests.cf
[26731] dbg: config: read file /usr/share/spamassassin/20_html_tests.cf
[26731] dbg: config: read file /usr/share/spamassassin/20_meta_tests.cf
[26731] dbg: config: read file /usr/share/spamassassin/20_net_tests.cf
[26731] dbg: config: read file /usr/share/spamassassin/20_phrases.cf
[26731] dbg: config: read file /usr/share/spamassassin/20_porn.cf
[26731] dbg: config: read file /usr/share/spamassassin/20_ratware.cf
[26731] dbg: config: read file /usr/share/spamassassin/20_uri_tests.cf
[26731] dbg: config: read file /usr/share/spamassassin/23_bayes.cf
[26731] dbg: config: read file /usr/share/spamassassin/25_accessdb.cf
[26731] dbg: config: read file /usr/share/spamassassin/25_antivirus.cf
[26731] dbg: config: read file /usr/share/spamassassin/25_body_tests_es.cf
[26731] dbg: config: read file /usr/share/spamassassin/25_body_tests_pl.cf
[26731] dbg: config: read file /usr/share/spamassassin/25_dcc.cf
[26731] dbg: config: read file /usr/share/spamassassin/25_domainkeys.cf
[26731] dbg: config: read file /usr/share/spamassassin/25_hashcash.cf
[26731] dbg: config: read file /usr/share/spamassassin/25_pyzor.cf
[26731] dbg: config: read file /usr/share/spamassassin/25_razor2.cf
[26731] dbg: config: read file /usr/share/spamassassin/25_replace.cf
[26731] dbg: config: read file /usr/share/spamassassin/25_spf.cf
[26731] dbg: config: read file /usr/share/spamassassin/25_textcat.cf
[26731] dbg: config: read file /usr/share/spamassassin/25_uribl.cf
[26731] dbg: config: read file /usr/share/spamassassin/30_text_de.cf
[26731] dbg: config: read file /usr/share/spamassassin/30_text_fr.cf
[26731] dbg: config: read file /usr/share/spamassassin/30_text_it.cf
[26731] dbg: config: read file /usr/share/spamassassin/30_text_nl.cf
[26731] dbg: config: read file /usr/share/spamassassin/30_text_pl.cf
[26731] dbg: config: read file /usr/share/spamassassin/30_text_pt_br.cf
[26731] dbg: config: read file /usr/share/spamassassin/50_scores.cf
[26731] dbg: config: read file /usr/share/spamassassin/60_awl.cf
[26731] dbg: config: read file /usr/share/spamassassin/60_whitelist.cf
[26731] dbg: config: read file /usr/share/spamassassin/60_whitelist_spf.cf
[26731] dbg: config: read file
/usr/share/spamassassin/60_whitelist_subject.cf
[26731] dbg: config: using "/etc/mail/spamassassin" for site rules dir
[26731] dbg: config: read file /etc/mail/spamassassin/local.cf
[26731] dbg: config: read file /etc/mail/spamassassin/mailscanner.cf
[26731] dbg: config: using "/etc/MailScanner/spam.assassin.prefs.conf"
for user prefs file
[26731] dbg: config: read file /etc/MailScanner/spam.assassin.prefs.conf
[26731] dbg: plugin: loading Mail::SpamAssassin::Plugin::URIDNSBL from @INC
[26731] dbg: plugin: registered
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x9409a94)
[26731] dbg: plugin: loading Mail::SpamAssassin::Plugin::Hashcash from @INC
[26731] dbg: plugin: registered
Mail::SpamAssassin::Plugin::Hashcash=HASH(0x9428ff4)
[26731] dbg: plugin: loading Mail::SpamAssassin::Plugin::SPF from @INC
[26731] dbg: plugin: registered
Mail::SpamAssassin::Plugin::SPF=HASH(0x943e08c)
[26731] dbg: plugin: loading Mail::SpamAssassin::Plugin::Pyzor from @INC
[26731] dbg: pyzor: network tests on, attempting Pyzor
[26731] dbg: plugin: registered
Mail::SpamAssassin::Plugin::Pyzor=HASH(0x944bf1c)
[26731] dbg: plugin: loading Mail::SpamAssassin::Plugin::SpamCop from @INC
[26731] dbg: reporter: network tests on, attempting SpamCop
[26731] dbg: plugin: registered
Mail::SpamAssassin::Plugin::SpamCop=HASH(0x94b096c)
[26731] dbg: plugin: loading Mail::SpamAssassin::Plugin::AWL from @INC
[26731] dbg: plugin: registered
Mail::SpamAssassin::Plugin::AWL=HASH(0x94b80bc)
[26731] dbg: plugin: loading
Mail::SpamAssassin::Plugin::AutoLearnThreshold from @INC
[26731] dbg: plugin: registered
Mail::SpamAssassin::Plugin::AutoLearnThreshold=HASH(0x945786c)
[26731] dbg: plugin: loading
Mail::SpamAssassin::Plugin::WhiteListSubject from @INC
[26731] dbg: plugin: registered
Mail::SpamAssassin::Plugin::WhiteListSubject=HASH(0x9458274)
[26731] dbg: plugin: loading Mail::SpamAssassin::Plugin::MIMEHeader from
@INC
[26731] dbg: plugin: registered
Mail::SpamAssassin::Plugin::MIMEHeader=HASH(0x960ce5c)
[26731] dbg: plugin: loading Mail::SpamAssassin::Plugin::ReplaceTags
from @INC
[26731] dbg: plugin: registered
Mail::SpamAssassin::Plugin::ReplaceTags=HASH(0x96175ac)
[26731] dbg: config: adding redirector regex:
/^http:\/\/chkpt\.zdnet\.com\/chkpt\/\w+\/(.*)$/i
[26731] dbg: config: adding redirector regex:
/^http:\/\/www(?:\d+)?\.nate\.com\/r\/\w+\/(.*)$/i
[26731] dbg: config: adding redirector regex:
/^http:\/\/.+\.gov\/(?:.*\/)?externalLink\.jhtml\?.*url=(.*?)(?:&.*)?$/i
[26731] dbg: config: adding redirector regex:
/^http:\/\/redir\.internet\.com\/.+?\/.+?\/(.*)$/i
[26731] dbg: config: adding redirector regex:
/^http:\/\/(?:.*?\.)?adtech\.de\/.*(?:;|\|)link=(.*?)(?:;|$)/i
[26731] dbg: config: adding redirector regex:
m'^http.*?/redirect\.php\?.*(?<=[?&])goto=(.*?)(?:$|[&\#])'i
[26731] dbg: config: adding redirector regex:
m'^https?:/*(?:[^/]+\.)?emf\d\.com/r\.cfm.*?&r=(.*)'i
[26731] info: config: failed to parse line, skipping: dcc_path
/usr/local/bin/dccproc
[26731] info: config: failed to parse line, skipping: razor_timeout 10
[26731] info: config: failed to parse line, skipping: dcc_path
/usr/local/bin/dccproc
[26731] info: config: failed to parse line, skipping: razor_timeout 10
[26731] dbg: plugin:
Mail::SpamAssassin::Plugin::ReplaceTags=HASH(0x96175ac) implements
'finish_parsing_end'
[26731] dbg: replacetags: replacing tags
[26731] dbg: replacetags: done replacing tags
[26731] dbg: bayes: using username: root
[26731] dbg: config: score set 1 chosen.
[26731] dbg: message: ---- MIME PARSER START ----
[26731] dbg: message: main message type: text/plain
[26731] dbg: message: parsing normal part
[26731] dbg: message: added part, type: text/plain
[26731] dbg: message: ---- MIME PARSER END ----
[26731] dbg: dns: dns_available set to yes in config file, skipping test
[26731] dbg: metadata: X-Spam-Relays-Trusted:
[26731] dbg: metadata: X-Spam-Relays-Untrusted:
[26731] dbg: message: no encoding detected
[26731] dbg: plugin:
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x9409a94) implements
'parsed_metadata'
[26731] dbg: uridnsbl: domains to query:
[26731] dbg: dns: checking RBL sbl-xbl.spamhaus.org., set sblxbl-notfirsthop
[26731] dbg: dns: checking RBL sa-accredit.habeas.com., set
habeas-firsttrusted
[26731] dbg: dns: checking RBL sbl-xbl.spamhaus.org., set sblxbl
[26731] dbg: dns: checking RBL sa-other.bondedsender.org., set bsp-untrusted
[26731] dbg: dns: checking RBL combined.njabl.org., set njabl-notfirsthop
[26731] dbg: dns: checking RBL combined.njabl.org., set njabl
[26731] dbg: dns: checking RBL
combined-HIB.dnsiplists.completewhois.com., set whois
[26731] dbg: dns: checking RBL list.dsbl.org., set dsbl-notfirsthop
[26731] dbg: dns: checking RBL bl.spamcop.net., set spamcop
[26731] dbg: dns: checking RBL sa-trusted.bondedsender.org., set
bsp-firsttrusted
[26731] dbg: dns: checking RBL
combined-HIB.dnsiplists.completewhois.com., set whois-notfirsthop
[26731] dbg: dns: checking RBL dnsbl.sorbs.net., set sorbs-notfirsthop
[26731] dbg: dns: checking RBL dnsbl.sorbs.net., set sorbs
[26731] dbg: dns: checking RBL iadb.isipp.com., set iadb-firsttrusted
[26731] dbg: check: running tests for priority: 0
[26731] dbg: rules: running header regexp tests; score so far=0
[26731] dbg: rules: ran header rule __HAS_MSGID ======> got hit: "<"
[26731] dbg: rules: ran header rule __SANE_MSGID ======> got hit:
"<1129912170.27313 at spamassassin_spamd_init>
[26731] dbg: rules: "
[26731] dbg: rules: ran header rule NO_REAL_NAME ======> got hit:
"ignore at compiling.spamassassin.taint.org
[26731] dbg: rules: "
[26731] dbg: rules: ran header rule __MSGID_OK_HOST ======> got hit:
"@spamassassin_spamd_init>"
[26731] dbg: rules: ran header rule __MSGID_OK_DIGITS ======> got hit:
"1129912170"
[26731] dbg: plugin: registering glue method for
check_hashcash_double_spend
(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x9428ff4))
[26731] dbg: plugin: registering glue method for check_for_spf_helo_pass
(Mail::SpamAssassin::Plugin::SPF=HASH(0x943e08c))
[26731] dbg: spf: message was delivered entirely via trusted relays, not
required
[26731] dbg: eval: all '*From' addrs:
ignore at compiling.spamassassin.taint.org
[26731] dbg: plugin: registering glue method for
check_subject_in_blacklist
(Mail::SpamAssassin::Plugin::WhiteListSubject=HASH(0x9458274))
[26731] dbg: plugin: registering glue method for check_hashcash_value
(Mail::SpamAssassin::Plugin::Hashcash=HASH(0x9428ff4))
[26731] dbg: eval: all '*To' addrs:
[26731] dbg: plugin: registering glue method for check_for_spf_neutral
(Mail::SpamAssassin::Plugin::SPF=HASH(0x943e08c))
[26731] dbg: spf: message was delivered entirely via trusted relays, not
required
[26731] dbg: plugin: registering glue method for check_for_spf_softfail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x943e08c))
[26731] dbg: rules: ran eval rule NO_RELAYS ======> got hit
[26731] dbg: plugin: registering glue method for check_for_spf_pass
(Mail::SpamAssassin::Plugin::SPF=HASH(0x943e08c))
[26731] dbg: plugin: registering glue method for
check_for_spf_helo_softfail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x943e08c))
[26731] dbg: plugin: registering glue method for
check_for_def_spf_whitelist_from
(Mail::SpamAssassin::Plugin::SPF=HASH(0x943e08c))
[26731] dbg: spf: cannot get Envelope-From, cannot use SPF
[26731] dbg: spf: def_spf_whitelist_from: could not find useable
envelope sender
[26731] dbg: plugin: registering glue method for check_for_spf_fail
(Mail::SpamAssassin::Plugin::SPF=HASH(0x943e08c))
[26731] dbg: rules: ran eval rule __UNUSABLE_MSGID ======> got hit
[26731] dbg: plugin: registering glue method for
check_subject_in_whitelist
(Mail::SpamAssassin::Plugin::WhiteListSubject=HASH(0x9458274))
[26731] dbg: rules: ran eval rule MISSING_HEADERS ======> got hit
[26731] dbg: plugin: registering glue method for
check_for_spf_whitelist_from
(Mail::SpamAssassin::Plugin::SPF=HASH(0x943e08c))
[26731] dbg: spf: spf_whitelist_from: could not find useable envelope sender
[26731] dbg: rules: running body-text per-line regexp tests; score so
far=0.738
[26731] dbg: rules: ran body rule __NONEMPTY_BODY ======> got hit: "I"
[26731] dbg: uri: running uri tests; score so far=0.738
[26731] dbg: plugin: registering glue method for check_uridnsbl
(Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x9409a94))
[26731] dbg: rules: running raw-body-text per-line regexp tests; score
so far=0.738
[26731] dbg: rules: running full-text regexp tests; score so far=0.738
[26731] dbg: plugin: registering glue method for check_pyzor
(Mail::SpamAssassin::Plugin::Pyzor=HASH(0x944bf1c))
[26731] dbg: pyzor: pyzor is not available: no pyzor executable found
[26731] dbg: pyzor: no pyzor found, disabling Pyzor
[26731] dbg: plugin:
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x9409a94) implements 'check_tick'
[26731] dbg: check: running tests for priority: 500
[26731] dbg: plugin:
Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x9409a94) implements
'check_post_dnsbl'
[26731] dbg: rules: running meta tests; score so far=0.738
[26731] dbg: rules: running header regexp tests; score so far=2.216
[26731] dbg: rules: running body-text per-line regexp tests; score so
far=2.216
[26731] dbg: uri: running uri tests; score so far=2.216
[26731] dbg: rules: running raw-body-text per-line regexp tests; score
so far=2.216
[26731] dbg: rules: running full-text regexp tests; score so far=2.216
[26731] dbg: check: running tests for priority: 1000
[26731] dbg: rules: running meta tests; score so far=2.216
[26731] dbg: rules: running header regexp tests; score so far=2.216
[26731] dbg: plugin: registering glue method for
check_from_in_auto_whitelist
(Mail::SpamAssassin::Plugin::AWL=HASH(0x94b80bc))
[26731] dbg: rules: running body-text per-line regexp tests; score so
far=2.216
[26731] dbg: uri: running uri tests; score so far=2.216
[26731] dbg: rules: running raw-body-text per-line regexp tests; score
so far=2.216
[26731] dbg: rules: running full-text regexp tests; score so far=2.216
[26731] dbg: check: is spam? score=2.216 required=5
[26731] dbg: check:
tests=MISSING_HEADERS,MISSING_SUBJECT,NO_REAL_NAME,NO_RECEIVED,NO_RELAYS,TO_CC_NONE
[26731] dbg: check:
subtests=__HAS_MSGID,__MSGID_OK_DIGITS,__MSGID_OK_HOST,__NONEMPTY_BODY,__SANE_MSGID,__UNUSABLE_MSGID
[26733] dbg: message: ---- MIME PARSER START ----
[26733] dbg: message: main message type: multipart/alternative
[26733] dbg: message: parsing multipart, got boundary:
- ----=_NextPart_000_0007_01C5D657.42F5A1E0
[26733] dbg: message: found part of type text/plain, boundary:
- ----=_NextPart_000_0007_01C5D657.42F5A1E0
[26733] dbg: message: parsing normal part
[26733] dbg: message: added part, type: text/plain
[26733] dbg: message: found part of type text/html, boundary:
- ----=_NextPart_000_0007_01C5D657.42F5A1E0
[26733] dbg: message: parsing normal part
[26733] dbg: message: added part, type: text/html
[26733] dbg: message: ---- MIME PARSER END ----
[26733] dbg: dns: name server: 212.210.251.2, family: 2, ipv6: 0
[26733] dbg: received-header: parsed as [ ip=82.53.230.146
rdns=host146-230.pool8253.interbusiness.it helo=portatile
by=mailgw1.videobank.it ident= envfrom= intl=0 id=72803152107 auth= ]
[26733] dbg: received-header: relay 82.53.230.146 trusted? no internal? no
[26733] dbg: metadata: X-Spam-Relays-Trusted:
[26733] dbg: metadata: X-Spam-Relays-Untrusted: [ ip=82.53.230.146
rdns=host146-230.pool8253.interbusiness.it helo=portatile
by=mailgw1.videobank.it ident= envfrom= intl=0 id=72803152107 auth= ]
[26733] dbg: message: decoding quoted-printable
[26733] dbg: message: decoding quoted-printable
[26733] dbg: uri: html uri found, cid:editdata.mso
[26733] dbg: uri: cleaned html uri, cid:editdata.mso
[26733] dbg: uri: html uri found, cid:filelist.xml at 01C5D657.426F33D0
[26733] dbg: uri: cleaned html uri, cid:filelist.xml at 01C5D657.426F33D0
[26733] dbg: uri: parsed uri found, mailto:omniagricolae at omniagricolae.it
[26733] dbg: uri: cleaned parsed uri, mailto:omniagricolae at omniagricolae.it
[26733] dbg: uri: parsed domain, omniagricolae.it
[26733] dbg: uri: parsed uri found, mailto:omniagricolae at omniagricolae.it
[26733] dbg: uri: parsed domain, omniagricolae.it
[26733] dbg: uri: parsed uri found, mailto:'jardin at maltanet.ne
[26733] dbg: uri: cleaned parsed uri, mailto:'jardin at maltanet.ne
[26733] dbg: uri: parsed domain, maltanet.ne
[26733] dbg: uri: parsed uri found, mailto:omniagricolae at omniagricolae.it
[26733] dbg: uri: parsed domain, omniagricolae.it
[26733] dbg: uri: parsed uri found, mailto:omniagricolae at omniagricolae.it
[26733] dbg: uri: parsed domain, omniagricolae.it
[26733] dbg: uri: parsed uri found, mailto:'jardin at maltanet.ne
[26733] dbg: uri: parsed domain, maltanet.ne
[26733] dbg: uridnsbl: domains to query:
[26733] dbg: dns: checking RBL sbl-xbl.spamhaus.org., set sblxbl-notfirsthop
[26733] dbg: dns: IPs found: full-external: 82.53.230.146 untrusted:
82.53.230.146 originating:
[26733] dbg: dns: only inspecting the following IPs: 82.53.230.146
[26733] dbg: dns: launching DNS A query for
146.230.53.82.sbl-xbl.spamhaus.org. in background
[26733] dbg: dns: checking RBL sa-accredit.habeas.com., set
habeas-firsttrusted
[26733] dbg: dns: IPs found: full-external: 82.53.230.146 untrusted:
82.53.230.146 originating:
[26733] dbg: dns: only inspecting the following IPs: 82.53.230.146
[26733] dbg: dns: launching DNS A query for
146.230.53.82.sa-accredit.habeas.com. in background
[26733] dbg: dns: checking RBL sbl-xbl.spamhaus.org., set sblxbl
[26733] dbg: dns: IPs found: full-external: 82.53.230.146 untrusted:
82.53.230.146 originating:
[26733] dbg: dns: only inspecting the following IPs: 82.53.230.146
[26733] dbg: dns: checking RBL sa-other.bondedsender.org., set bsp-untrusted
[26733] dbg: dns: IPs found: full-external: 82.53.230.146 untrusted:
82.53.230.146 originating:
[26733] dbg: dns: only inspecting the following IPs:
[26733] dbg: dns: checking RBL combined.njabl.org., set njabl-notfirsthop
[26733] dbg: dns: IPs found: full-external: 82.53.230.146 untrusted:
82.53.230.146 originating:
[26733] dbg: dns: only inspecting the following IPs: 82.53.230.146
[26733] dbg: dns: launching DNS A query for
146.230.53.82.combined.njabl.org. in background
[26733] dbg: dns: checking RBL combined.njabl.org., set njabl
[26733] dbg: dns: IPs found: full-external: 82.53.230.146 untrusted:
82.53.230.146 originating:
[26733] dbg: dns: only inspecting the following IPs: 82.53.230.146
[26733] dbg: dns: checking RBL
combined-HIB.dnsiplists.completewhois.com., set whois
[26733] dbg: dns: IPs found: full-external: 82.53.230.146 untrusted:
82.53.230.146 originating:
[26733] dbg: dns: only inspecting the following IPs: 82.53.230.146
[26733] dbg: dns: launching DNS A query for
146.230.53.82.combined-HIB.dnsiplists.completewhois.com. in background
[26733] dbg: dns: checking RBL list.dsbl.org., set dsbl-notfirsthop
[26733] dbg: dns: IPs found: full-external: 82.53.230.146 untrusted:
82.53.230.146 originating:
[26733] dbg: dns: only inspecting the following IPs: 82.53.230.146
[26733] dbg: dns: launching DNS TXT query for
146.230.53.82.list.dsbl.org. in background
[26733] dbg: dns: checking RBL bl.spamcop.net., set spamcop
[26733] dbg: dns: IPs found: full-external: 82.53.230.146 untrusted:
82.53.230.146 originating:
[26733] dbg: dns: only inspecting the following IPs: 82.53.230.146
[26733] dbg: dns: launching DNS TXT query for
146.230.53.82.bl.spamcop.net. in background
[26733] dbg: dns: _check_rbl_addresses RBL blackhole.securitysage.com.,
set securitysage
[26733] dbg: dns: launching DNS A query for
omniagricolae.it.blackhole.securitysage.com. in background
[26733] dbg: dns: checking RBL sa-trusted.bondedsender.org., set
bsp-firsttrusted
[26733] dbg: dns: IPs found: full-external: 82.53.230.146 untrusted:
82.53.230.146 originating:
[26733] dbg: dns: only inspecting the following IPs: 82.53.230.146
[26733] dbg: dns: launching DNS TXT query for
146.230.53.82.sa-trusted.bondedsender.org. in background
[26733] dbg: dns: checking RBL
combined-HIB.dnsiplists.completewhois.com., set whois-notfirsthop
[26733] dbg: dns: IPs found: full-external: 82.53.230.146 untrusted:
82.53.230.146 originating:
[26733] dbg: dns: only inspecting the following IPs: 82.53.230.146
[26733] dbg: dns: _check_rbl_addresses RBL rhsbl.ahbl.org., set ahbl
[26733] dbg: dns: launching DNS A query for
omniagricolae.it.rhsbl.ahbl.org. in background
[26733] dbg: dns: checking A and MX for host omniagricolae.it
[26733] dbg: dns: launching DNS A query for omniagricolae.it in background
[26733] dbg: dns: launching DNS MX query for omniagricolae.it in background
[26733] dbg: dns: _check_rbl_addresses RBL fulldom.rfc-ignorant.org.,
set rfci_envfrom
[26733] dbg: dns: launching DNS A query for
omniagricolae.it.fulldom.rfc-ignorant.org. in background
[26733] dbg: dns: checking RBL dnsbl.sorbs.net., set sorbs-notfirsthop
[26733] dbg: dns: IPs found: full-external: 82.53.230.146 untrusted:
82.53.230.146 originating:
[26733] dbg: dns: only inspecting the following IPs: 82.53.230.146
[26733] dbg: dns: launching DNS A query for
146.230.53.82.dnsbl.sorbs.net. in background
[26733] dbg: dns: checking RBL dnsbl.sorbs.net., set sorbs
[26733] dbg: dns: IPs found: full-external: 82.53.230.146 untrusted:
82.53.230.146 originating:
[26733] dbg: dns: only inspecting the following IPs: 82.53.230.146
[26733] dbg: dns: checking RBL iadb.isipp.com., set iadb-firsttrusted
[26733] dbg: dns: IPs found: full-external: 82.53.230.146 untrusted:
82.53.230.146 originating:
[26733] dbg: dns: only inspecting the following IPs: 82.53.230.146
[26733] dbg: dns: launching DNS A query for
146.230.53.82.iadb.isipp.com. in background
[26733] dbg: check: running tests for priority: 0
[26733] dbg: rules: running header regexp tests; score so far=0
[26733] dbg: rules: ran header rule __HAS_MSGID ======> got hit: "<"
[26733] dbg: rules: ran header rule __CT ======> got hit: "m"
[26733] dbg: rules: ran header rule __HAS_RCVD ======> got hit: "f"
[26733] dbg: rules: ran header rule __SANE_MSGID ======> got hit:
"<20051021135113.72803152107 at mailgw1.videobank.it>
[26733] dbg: rules: "
[26733] dbg: rules: ran header rule __MIMEOLE_MS ======> got hit:
"Produced By Microsoft MimeOLE"
[26733] dbg: rules: ran header rule __NEXTPART_NORMAL ======> got hit:
"="----=_NextPart_000_0007_01C5D657.42F5A1E0""
[26733] dbg: rules: ran header rule __MIME_VERSION ======> got hit: "1"
[26733] dbg: rules: ran header rule __NEXTPART_ALL ======> got hit:
"NextPart"
[26733] dbg: rules: ran header rule __CTYPE_MULTIPART_ALT ======> got
hit: "multipart/alternative"
[26733] dbg: rules: ran header rule __TOCC_EXISTS ======> got hit: "<"
[26733] dbg: rules: ran header rule __HAS_MIMEOLE ======> got hit: "P"
[26733] dbg: rules: ran header rule __MSGID_OK_DIGITS ======> got hit:
"2005102113"
[26733] dbg: rules: ran header rule __HAS_SUBJECT ======> got hit: "p"
[26733] dbg: rules: ran header rule __HAS_OUTLOOK_IN_MAILER ======> got
hit: "Microsoft Office Outlook"
[26733] dbg: rules: ran header rule __CTYPE_HAS_BOUNDARY ======> got
hit: "boundary"
[26733] dbg: rules: ran header rule __HAS_X_MAILER ======> got hit: "M"
[26733] dbg: spf: checking HELO (helo=portatile, ip=82.53.230.146)
[26733] dbg: spf: cannot check HELO of 'portatile', skipping
[26733] dbg: eval: all '*From' addrs: omniagricolae at omniagricolae.it
[26733] dbg: rules: address omniagricolae at omniagricolae.it matches
whitelist or blacklist regexp: ^.*\@omniagricolae\.it$
[26733] dbg: rules: ran eval rule USER_IN_WHITELIST ======> got hit
[26733] dbg: eval: trying Received header date for real time:  21 Oct
2005 15:51:13 +0200
[26733] dbg: eval: time_t from date=1129902673, rcvd= 21 Oct 2005
15:51:13 +0200
[26733] dbg: eval: all '*To' addrs: jardin at maltanet.net
[26733] dbg: spf: checking EnvelopeFrom (helo=portatile,
ip=82.53.230.146, envfrom=omniagricolae at omniagricolae.it)
[26733] dbg: spf: cannot load or create Mail::SPF::Query module: Can't
locate Mail/SPF/Query.pm in @INC (@INC contains: /opt/MailScanner/bin
/opt/MailScanner/bin/MailScanner /opt/MailScanner/lib
/usr/lib/perl5/5.8.6/i486-linux /usr/lib/perl5/5.8.6
/usr/lib/perl5/site_perl/5.8.6/i486-linux /usr/lib/perl5/site_perl/5.8.6
/usr/lib/perl5/site_perl . /opt/MailScanner/lib) at
/usr/lib/perl5/site_perl/5.8.6/Mail/SpamAssassin/Plugin/SPF.pm line 272.
[26733] dbg: rules: ran eval rule MSGID_FROM_MTA_ID ======> got hit
[26733] dbg: eval: forged-HELO: from=pool8253.interbusiness.it
helo=portatile by=mailgw1.videobank.it
[26733] dbg: rules: ran eval rule __ENV_AND_HDR_FROM_MATCH ======> got hit
[26733] dbg: spf: def_whitelist_from_spf: omniagricolae at omniagricolae.it
is not in DEF_WHITELIST_FROM_SPF
[26733] dbg: eval: date chosen from message: Fri Oct 21 15:51:13 2005
[26733] dbg: spf: whitelist_from_spf: omniagricolae at omniagricolae.it is
not in user's WHITELIST_FROM_SPF
[26733] dbg: rules: running body-text per-line regexp tests; score so
far=-99.073
[26733] dbg: rules: ran body rule __FRAUD_DBI ======> got hit: "euro"
[26733] dbg: rules: ran body rule __NONEMPTY_BODY ======> got hit: "p"
[26733] dbg: uri: running uri tests; score so far=-99.073
[26733] dbg: bayes: not scoring message, returning undef
[26733] dbg: bayes: opportunistic call attempt failed, DB not readable
[26733] dbg: rules: ran eval rule __TAG_EXISTS_BODY ======> got hit
[26733] dbg: rules: ran eval rule __COMMENT_EXISTS ======> got hit
[26733] dbg: rules: ran eval rule __MIME_HTML ======> got hit
[26733] dbg: rules: ran eval rule HTML_MESSAGE ======> got hit
[26733] dbg: rules: ran eval rule __TAG_EXISTS_HTML ======> got hit
[26733] dbg: eval: text words: 46, html words: 45
[26733] dbg: eval: madiff: left: 0, orig: 45, max-difference: 0.00%
[26733] dbg: rules: ran eval rule __TAG_EXISTS_HEAD ======> got hit
[26733] dbg: rules: ran eval rule __TAG_EXISTS_META ======> got hit
[26733] dbg: rules: running raw-body-text per-line regexp tests; score
so far=-99.072
[26733] dbg: rules: ran eval rule __MIME_QP ======> got hit
[26733] dbg: rules: running full-text regexp tests; score so far=-99.072
[26733] dbg: pyzor: pyzor is not available: no pyzor executable found
[26733] dbg: pyzor: no pyzor found, disabling Pyzor
[26733] dbg: check: running tests for priority: 500
[26733] dbg: dns: success for 14 of 14 queries
[26733] dbg: rules: running meta tests; score so far=-90.106
[26733] dbg: rules: running header regexp tests; score so far=-90.106
[26733] dbg: rules: running body-text per-line regexp tests; score so
far=-90.106
[26733] dbg: uri: running uri tests; score so far=-90.106
[26733] dbg: rules: running raw-body-text per-line regexp tests; score
so far=-90.106
[26733] dbg: rules: running full-text regexp tests; score so far=-90.106
[26733] dbg: check: running tests for priority: 1000
[26733] dbg: rules: running meta tests; score so far=-90.106
[26733] dbg: rules: running header regexp tests; score so far=-90.106
[26733] dbg: rules: running body-text per-line regexp tests; score so
far=-90.106
[26733] dbg: uri: running uri tests; score so far=-90.106
[26733] dbg: rules: running raw-body-text per-line regexp tests; score
so far=-90.106
[26733] dbg: rules: running full-text regexp tests; score so far=-90.106
[26733] dbg: check: is spam? score=-90.106 required=5
[26733] dbg: check:
tests=HTML_MESSAGE,MSGID_FROM_MTA_ID,RCVD_IN_NJABL_DUL,RCVD_IN_SORBS_DUL,RCVD_IN_WHOIS_INVALID,RCVD_IN_XBL,USER_IN_WHITELIST
[26733] dbg: check:
subtests=__COMMENT_EXISTS,__CT,__CTYPE_HAS_BOUNDARY,__CTYPE_MULTIPART_ALT,__ENV_AND_HDR_FROM_MATCH,__FRAUD_DBI,__HAS_MIMEOLE,__HAS_MSGID,__HAS_OUTLOOK_IN_MAILER,__HAS_RCVD,__HAS_SUBJECT,__HAS_X_MAILER,__MIMEOLE_MS,__MIME_HTML,__MIME_QP,__MIME_VERSION,__MSGID_OK_DIGITS,__NEXTPART_ALL,__NEXTPART_NORMAL,__NONEMPTY_BODY,__RCVD_IN_NJABL,__RCVD_IN_SBL_XBL,__RCVD_IN_SORBS,__RCVD_IN_WHOIS,__SANE_MSGID,__TAG_EXISTS_BODY,__TAG_EXISTS_HEAD,__TAG_EXISTS_HTML,__TAG_EXISTS_META,__TOCC_EXISTS
Stopping now as you are debugging me.

- --

Luca Palazzo
System Engineer

N.C.E.  Network Consulting Engineering s.r.l.
Via Etnea, 52 - 95028 Valverde (CT) - ITALY
Tel/Fax: +39 095 524190
Mobile: +39 340 4608689
web: www.nce-ict.it
mail: luca.palazzo at nce-ict.it
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFDWRinFU0TB0V8iHsRAmGyAJ4m1KAVKiuIaWXWkDKA+myMUoRMFQCfWkxe
WrLXGuSWpabHgRF7Z0Raa1w=
=Edr1
-----END PGP SIGNATURE-----

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!