MS unable to detect From address from DSN and failure notice emails

[Matt Kettler]

Mike Jakubik wrote:
> The other day i noticed that Always looked up last and the mailwatch
> logging script is not logging the From address on any DSN or failure
> type emails sent by the mailer-daemon@ or postmaster at . The problem is
> bigger than just logging itself, as this influences the scoring with the
> rule NO_REAL_NAME, so a lot of them get marked as spam. Here are two
> example headers:

Most DSN's are sent with a From: HEADER that contains mailer-daemon, or
postmaster. However by RFC requirements the ENVELOPE From is <> (empty or null
address).

This much should explain the logging, as MailScanner is logging the envelope
from, not the content of the body-text From: header. Sendmail MTA's copy the
envelope from to the "Return-Path" header upon delivery. I'm not sure what
postfix does, but you might want to check it. To see what your MTA is using,
this message should have an envelope from of
"mailscanner-bounces at lists.mailscanner.info", not mkettler at evi-inc.com.

The NO_REAL_NAME bit does influence the score, but that alone shouldn't be
causing these to be tagged as spam.. What other SA rules are firing off here?