MailScanner causes SpamAssassin rules to firing inconsistently

[Mark Sapiro]

On 11/05/2015 11:05 AM, Wolfgang Baudler wrote:
> 
> no difference in log messages, except the senders domain and address of
> course.
> 
> internal log example:
> Nov  5 13:50:58 io MailScanner[24033]: Message tA5IopES005503 from
> 192.33.116.115 (wbaudler at gb.nrao.edu) to gb.nrao.edu is not spam,
> SpamAssassin (score=-199.008, required 5, autolearn=disabled, TEST_RULE_AA
> 1.00, NRAO_HEADER_PRESENT -100.00, TVD_SPACE_RATIO 0.00, T_RP_MATCHES_RCVD
> -0.01, USER_IN_WHITELIST -100.00)
> 
> external log example:
> Nov  5 13:55:47 io MailScanner[24004]: Message tA5ItQmr006622 from
> 98.138.229.70 (wbaudler at yahoo.com) to gb.nrao.edu is not spam,
>  SpamAssassin (score=0.902, required 5, autolearn=disabled,
> DKIM_ADSP_CUSTOM_MED 0.00, DKIM_SIGNED 0.10, FREEMAIL_FROM 0.00,
> LOCAL_ID_JAVAMAIL 1.00, NML_ADSP_CUSTOM_MED 1.20, RCVD_IN_DNSWL_LOW
> -0.70, RCVD_IN_MSPIKE_H3 -0.70, SPF_PASS -0.00, T_DKIM_INVALID 0.01,
> T_RP_MATCHES_RCVD -0.01)
> 
> The TEST_RULE_AA test result is missing in the external example. The
> message sent was completely identical.


At this point I am at a loss unless your "Max SpamAssassin Size" setting
and your test message size are such that the extra headers from the
remote source push the test string out of range. This seems highly unlikely.

It seems this might be a spamassassin bug triggered by something in the
message headers from the remote servers, but this seems unlikely too.

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan