[({Spam?})] FH_DATE_PAST_20XX 3.38

[Alex Broens]

On 01/07/10 07:10, dcurtis at sbschools.net wrote:
> I just grabbed a message out of the postfix incoming and ran it and
> (below) this is the output. I am assuming I need a real message that
> breaks the FH_DATE_PAST rule?

A Postfix Q file won't work.

> We just pass all out mail through postfix/mailscanner to Exchange. How
> do I grab a message from Exchange and send it back in?

Save a msg from Outlook, or whatever you use as a MUA.
(not ideal, but better to parse that than a Pfix Q file :-)

save msg as .eml file

run it against spamassassin.

> [root at sbmail downloads]# cat 822C56E6566 |spamassassin
> Received: from localhost by sbmail.sbschools.net
> 	with SpamAssassin (version 3.2.5);
> 	Thu, 07 Jan 2010 13:05:24 -0500
> Subject: [SPAM] 
> X-Spam-Flag: YES
> X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on
> sbmail.sbschools.net
> X-Spam-Level: *******************
> X-Spam-Status: Yes, score=19.3 required=5.0
> tests=HEAD_ILLEGAL_CHARS,HEAD_LONG,
> 	
> MISSING_DATE,MISSING_HB_SEP,MISSING_HEADERS,MISSING_MID,MISSING_SUBJECT,
> 	
> NO_HEADERS_MESSAGE,NO_RECEIVED,NO_RELAYS,NULL_IN_BODY,TVD_SPACE_RATIO,
> 	UNRESOLVED_TEMPLATE autolearn=disabled version=3.2.5
> MIME-Version: 1.0
> Content-Type: multipart/mixed; boundary="----------=_4B462264.B7ED9CC2"
> 
> This is a multi-part message in MIME format.
> 
> ------------=_4B462264.B7ED9CC2
> Content-Type: text/plain; charset=iso-8859-1
> Content-Disposition: inline
> Content-Transfer-Encoding: 8bit
> 
> Spam detection software, running on the system "sbmail.sbschools.net",
> has
> identified this incoming email as possible spam.  The original message
> has been attached to this so you can view it (if it isn't spam) or label
> similar future email.  If you have any questions, see
> the administrator of that system for details.
> 
> Content preview:  .style36 {Nfont-size: 14px;N6font-family: Georgia,
> "Times
>    New Roman", Times, serif;Nfont-weight: bold;N
}N .style58
> {Nfont-size:
>   8pt;N3font-family: Verdana, Arial, Helvetica, sans-serif;Ncolor:
> #CC0000;Nfont-weight:
>    normal;N
}N .bstextlink {N3font-family: Verdana, Arial, Helvetica,
> sans-serif;Nfont-size:
>    14px;Nfont-weight: bold;N
}a:link {Ncolor: #990000;N
}N a:visited
> {Ncolor:
>    #990000;N
}N a:hover {Ncolor: #990000;N
}N a:active {Ncolor:
> #990000;N
}N
>    [...] 
> 
> Content analysis details:   (19.3 points, 5.0 required)
> 
>  pts rule name              description
> ---- ----------------------
> --------------------------------------------------
>  0.0 MISSING_MID            Missing Message-Id: header
>  0.0 MISSING_DATE           Missing Date: header
>  3.3 UNRESOLVED_TEMPLATE    Headers contain an unresolved template
> -0.0 NO_RELAYS              Informational: message was not relayed via
> SMTP
>  2.5 MISSING_HB_SEP         Missing blank line between message header
> and body
>  2.5 HEAD_LONG              Message headers are very long
>  3.7 HEAD_ILLEGAL_CHARS     Headers have too many raw illegal characters
>  1.6 MISSING_HEADERS        Missing To: header
>  2.9 TVD_SPACE_RATIO        BODY: TVD_SPACE_RATIO
>  1.5 NULL_IN_BODY           FULL: Message has NUL (ASCII 0) byte in
> message
>  1.3 MISSING_SUBJECT        Missing Subject: header
> -0.0 NO_RECEIVED            Informational: message has no Received
> headers
>  0.0 NO_HEADERS_MESSAGE     Message appears to be missing most RFC-822
> headers
> 
> 
> 
> ------------=_4B462264.B7ED9CC2
> Content-Type: message/rfc822; x-spam-type=original
> Content-Description: original message before SpamAssassin
> Content-Disposition: inline
> Content-Transfer-Encoding: 8bit
> 
> -----Original Message-----
> From: mailscanner-bounces at lists.mailscanner.info
> [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Alex
> Broens
> Sent: Thursday, January 07, 2010 12:32 PM
> To: MailScanner discussion
> Subject: Re: [({Spam?})] FH_DATE_PAST_20XX 3.38
> 
> On 01/07/10 06:23, dcurtis at sbschools.net wrote:
>> Deleted the cache file and still getting the 3.38 score.
> 
> 2nd time:
> 
> get hold of a msg and pipe it manually thru SA:
> 
> cat msg |spamassassin
> 
> what does that report look like? is the rule still active?
>