X-Relay-Countries

[Dimitri Volski]

Hi Martin,

Thanks for your reply. No that wasn't me, I only ran into this problem
yesterday, trying to implement some more spam blocking.

I understand that MailScanner does not put any SpamAssassin headers - I was
actually looking at the SA log when I ran SA manually on the source of the
spam message.

Both snips of log below belong to the same log produced by SA.

I understand that SA produces a Pseudo Header for X-Relay-Countries, which,
even if you ran SA without MailScanner will still not be displayed. What I
was loooking for though is the indication that it picked up the country of
origin based on the rules that I created with SA.

Thanks for your help,

dim

Date: Thu, 08 Feb 2007 09:38:04 +0000
From: "Martin.Hepworth" <martinh at solidstatelogic.com>
Subject: RE: {Disarmed} X-Relay-Countries
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Message-ID: <c85ec94af9280b46a22f1f4087c57793 at solidstatelogic.com>
Content-Type: text/plain;       charset="us-ascii"

Dimitri

Some on the IRC channel was having a similar problem a couple of days
ago - you??

MailScanner will NOT insert SA headers into the email

It will put the info in the MailScanner-SpamScore header if you tell to
be verbose.

Given running SA on its own doesn't insert info either I suggest you
lint check the SA config and fix any issues first..

--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300

> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-
> bounces at lists.mailscanner.info] On Behalf Of Dimitri Volski
> Sent: 08 February 2007 09:10
> To: mailscanner at lists.mailscanner.info
> Subject: {Disarmed} X-Relay-Countries
>
> Hi All,
>
> I am having troubles getting the SpamAssassin scores based on Relay
> Countries.
>
> A snip of the log:
>
> debug: received-header: relay MailScanner warning: numerical links are
> often malicious: 84.56.164.42 <http://84.56.164.42>  trusted? no
internal?
> no
> debug: metadata: X-Spam-Relays-Trusted:
> debug: metadata: X-Spam-Relays-Untrusted: [ ip=MailScanner warning:
> numerical links are often malicious: 84.56.164.42
<http://84.56.164.42>
> rdns=dslb-084-056-164-042.pools.arcor-ip.net helo=callaria.com
> by=mx.google.com ident= envfrom= intl=0
> id=p4si1743305qba.2007.02.05.02.02.53 auth= ]
> debug: plugin:
Mail::SpamAssassin::Plugin::RelayCountry=HASH(0x931059c)
> implements 'extract_metadata'
> debug: metadata: X-Relay-Countries: DE
> debug: plugin: Mail::SpamAssassin::Plugin::URIDNSBL=HASH(0x99dd4c8)
> implements 'parsed_metadata'
>
> Here I can see that the country is detected as Denmark, but when I
insert
>
> header RELAY_DE X-Relay-Countries =~/\bDE\b/
> describe RELAY_DE       Relayed through Germany
> score RELAY_DE 1.0
>
> into /etc/MailScanner/spam.assassin.prefs.conf , I cannot see it in
> theSpamAssassin report (if run manually on source of the message
above) or
> the MailScanner report.
>
> If run manually, SpamAssassin gives this header in the end:
>
> X-Spam-Flag: NO
> X-Spam-Checker-Version: SpamAssassin 3.0.5 (2005-11-28) on exmail
> X-Spam-Level: ****
> X-Spam-Status: No, score=4.4 required= 5.0
> tests=FORGED_RCVD_HELO,RCVD_BY_IP,
>         RCVD_IN_NJABL_DUL,RCVD_IN_SORBS_DUL,RCVD_IN_XBL autolearn=no
>         version=3.0.5
>
> In which I cannot see the RELAY_DE
>
> Please help !  :)
>
> Cheers,
> dim
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20070209/37645ac5/attachment.html