domain not scanned

[Martin Hepworth]

2008/11/11 Simon Jones <simonmjones at gmail.com>:
> 2008/11/11 Simon Jones <simonmjones at gmail.com>:
>> 2008/11/10 Martin Hepworth <maxsec at gmail.com>:
>>> 2008/11/10 Simon Jones <simonmjones at gmail.com>:
>>>> Hi all, fresh pair of eyes could be the solution but i'm struggling at the mo.
>>>>
>>>> i have a domain that seems to be being excluded from the spam scan -
>>>> virus scanning is OK though.  i've check
>>>> /etc/MailScanner/scan.messages.rules and its not listed in there.  the
>>>> recipient and transport tables are good - what else could cause this?
>>>> all other domains are being scanned and everything's working fine.
>>>>
>>>> cheers
>>>>
>>>> Si
>>>> --
>>>> MailScanner mailing list
>>>> mailscanner at lists.mailscanner.info
>>>> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>>
>>>> Before posting, read http://wiki.mailscanner.info/posting
>>>>
>>>> Support MailScanner development - buy the book off the website!
>>>>
>>>
>>> whitelisted in the SA config? Are you putting all SA scores etc in all
>>> emails so can see what's going on?
>>>
>>> --
>>> Martin Hepworth
>>> Oxford, UK
>>> --
>>
> Morning chaps,
>
> a bit more info - this was working OK and domain has been successfully
> scanned for a number of months but it stopped scanning over the
> weekend.  Its a distributed setup (3 servers + db) and it appears that
> all servers are dropping the domain from the scan.  S/A scores are
> zero on all scans, there's nothing whitelisted that I can see, I run
> MailWatch and the messages for this domain are all classed as clean.
> The only time i've seen this before is when the domain is listed in
> the /etc/MailScanner/rules/scan.messages.rules file - it is not listed
> in this case though.
>
> MailScanner --to @tbanda.co.uk or to MailScanner --to
> user at tbanda.co.uk doesn't return anything at all on any of the nodes.
> It seems to be affecting this domain globally but for no apparent
> reason, all others are OK though.
> Domains are stored in a mysql db as are transport maps and users,
> postfix reads from the (seperate) db without any problems.
>
> I can't see anything in maillog of relevance and a spamassassin -D
> --lint doesn't show any problems, anywhere else i can look?
>
> cheers,
>
> Si
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>

Simon

Ok so you're definitely getting MS headers in the emails that aren't
scanned, and you're seeing a zero score in the headers (not just
mailwatch)??

I presume you have these set in MailScanner.conf so you can see what's
happening?

Always Include SpamAssassin Report = yes
Spam Score Number Format = yes
SpamScore Number Instead Of Stars = yes

any timeouts in the logs for these emails?

have you tried running a sample set in debug mode?

-- 
Martin Hepworth
Oxford, UK