Spam Actions not honored

Shawn Iverson iversons at rushville.k12.in.us
Wed Nov 14 02:41:29 UTC 2018


Looks like the recipient got injected into the header instead of before it,
oops D:

I'll stand up this code and find out why this is happening.



On Tue, Nov 13, 2018 at 9:01 PM Mark Sapiro <mark at msapiro.net> wrote:

> On 11/13/18 3:37 PM, Shawn Iverson via MailScanner wrote:
> > Mark,
> >
> > Haven't had a chance to test this code since I have a meeting tonight,
> > but feel free to give it a try.  Otherwise, I'll try it out in the
> morning.
>
>
> I tried a couple of very simple tests. I set
>
> Spam Actions = store forward mark+spam at msapiro.net
>
> and then sent a a non-spam message with 2 recipients and it was
> delivered properly to both recipients.
>
> I then sent a spam message with the same two recipients and got this logged
>
> Nov 13 17:12:13 msapiro MailScanner[26356]: New Batch: Scanning 1
> messages, 1059 bytes
> Nov 13 17:12:13 msapiro MailScanner[26356]: Virus and Content Scanning:
> Starting
> Nov 13 17:12:17 msapiro MailScanner[26356]: Spam Checks: Found 1 spam
> messages
> Nov 13 17:12:17 msapiro MailScanner[27277]: Found phishing fraud from
> http://www.badsite.com/junk claiming to be www.goodsite.com in
> 9AE3151F05.AB2E3
> Nov 13 17:12:17 msapiro MailScanner[26356]: Content Checks: Detected and
> have disarmed web bug, phishing tags in HTML message in 9AE3151F05.AB2E3
> from mark at msapiro.net
> Nov 13 17:12:17 msapiro MailScanner[26356]: Requeue: 9AE3151F05.AB2E3 to
> 2B24F34012E
> Nov 13 17:12:17 msapiro MailScanner[26356]: Unable to kick message
> /var/spool/MailScanner/milterout/2B24F34012E, will retry soon...
> Nov 13 17:12:17 msapiro MailScanner[26356]: Uninfected: Delivered 1
> messages
> Nov 13 17:12:17 msapiro MailScanner[26356]: Deleted 1 messages from
> processing-database
>
> The message was stored in quarantine as spam and was still in milterout.
>
> I then sent the non-spam message again, and it was delivered normally
> and both it and the spam message were removed from milterout, but the
> spam message disappeared with no evidence in the mail.log that the
> milter tried to send it at all.
>
> The headers of the message in milterout are:
>
> S<mark at msapiro.net>
> Received: from msapiro.net (msapiro-enet.attlocal.net [10.211.115.100])
>         (no client certificate requested)
>         by msapiro (MailScanner Milter) with SMTP id 76F802AB2F
> To: mark at msapiro.net
> From: mark at msapiro.net
> Subject: {Spam?} {Disarmed} test it
> MIME-Version: 1.0
> Content-Type: Text/html
> Content-Transfer-Encoding: quoted-printable
> Message-Id: <20181114015422.76F95340104 at msapiro.net>
> Date: Tue, 13 Nov 2018 17:54:22 -0800 (PST)
> X-msapiro-MailScanner-ID: 76F802AB2F.AC6F7
> X-msapiro-MailScanner: Found to be clean
> X-msapiro-MailScanner-SpamCheck: spam, SpamAssassin (not cached,
> score=0.741,
>         required 0, ALL_TRUSTED -1.00, HTML_MESSAGE 0.00,
>         HTML_MIME_NO_HTML_TAG 0.64, MIME_HTML_ONLY 1.10)
> O<mark+spam at msapiro.net>
> X-msapiro-MailScanner-From: mark at msapiro.net
>
>
> --
> Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
> San Francisco Bay Area, California    better use your sense - B. Dylan
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>

-- 
Shawn Iverson, CETL
Director of Technology
Rush County Schools
765-932-3901 option 7
iversons at rushville.k12.in.us
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20181113/70dd462e/attachment.html>


More information about the MailScanner mailing list