Email detected as spam but not tagged

[Mark Sapiro]

On 11:59 AM, Rob Sterenborg wrote:
>>> Below is the email header with relevant Postfix/MailScanner
>> logs.
>>> Using this information, can anyone tell me why these emails
>> weren't
>>> tagged? If more info is needed, please let me know.


I looked at your OP at
<http://lists.mailscanner.info/pipermail/mailscanner/2010-July/096286.html>,
and it seems clear that MailScanner did scan this message.

The first few headers at the top of the message are

X-MimeOLE: Produced By Microsoft Exchange V6.5
Received: from mx1.domain2.local ([ip.addr]) by mx2.domain2.local with
 Microsoft SMTPSVC(6.0.3790.1830); Sat, 17 Jul 2010 23:35:37 +0200
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----_=_NextPart_004_01CB25F7.FEAB9A80"
Received: from mx3.domain1.nl ([ip.addr]) by mx1.domain2.local with
 Microsoft SMTPSVC(6.0.3790.1830); Sat, 17 Jul 2010 23:35:12 +0200
Received: from overscan.fr (web5.overscan.com [91.121.209.115]) by
 mx3.domain1.nl (Postfix) with ESMTP id 1EB923AA63 for
 <user at domain2.nl>; Sat, 17 Jul 2010 23:35:09 +0200 (CEST)

It appears that mx1.domain2.local (or possibly mx2.domain2.local) has
munged the message somehow as evidenced by the MIME-Version: and
Content-Type: headers inserted between the received headers at that
point. Is it possible that this is also responsible for dropping the
MailScanner headers?

Other than that, I have no ideas. It might help to know the MailScanner
version. It appears to be older than 4.78.3 because the logs show spam
scanning before virus scanning

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan