mails with valid SPF sender don't get marked SPF_PASS

Thom van der Boon thom at vdb.nl
Fri Jul 24 07:02:31 UTC 2020


Mark, 

It is a MailScanner issue (I think) 

When I run the message through SA directly by the following command: 

spamassassin -t -p /etc/MailScanner/spam.assassin.prefs.conf < message.txt 

I get a SPF_PASS 

pts rule name description 
---- ---------------------- -------------------------------------------------- 
0.0 RCVD_IN_MSPIKE_H4 RBL: Very Good reputation (+4) 
[185.201.16.36 listed in wl.mailspike.net] 
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, 
no trust 
[185.201.16.36 listed in list.dnswl.org] 
-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% 
[score: 0.0000] 
0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 
-0.0 SPF_PASS SPF: sender matches SPF record 
0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 
0.0 HTML_MESSAGE BODY: HTML included in message 
0.0 RCVD_IN_MSPIKE_WL Mailspike good senders 
0.0 KAM_DMARC_STATUS Test Rule for DKIM or SPF Failure with Strict 
Alignment 

but as stated before; the "live" message that went through my mailscanner 

X-vdbeu-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
	score=-1.786, required 5, BAYES_00 -1.90, HTML_MESSAGE 0.00,
	KAM_DMARC_STATUS 0.01, MIME_HTML_ONLY 0.10, RCVD_IN_DNSWL_NONE -0.00,
	RCVD_IN_MSPIKE_H4 0.00, RCVD_IN_MSPIKE_WL 0.00, SPF_HELO_NONE 0.00) 

So, I don't get it 

MailScanner --link reports nothing weird 

Met vriendelijke groet, Best regards, 


Thom van der Boon 
E-Mail: thom at vdb.nl 


Van: "Mark Sapiro" <mark at msapiro.net> 
Aan: "MailScanner Discussion" <mailscanner at lists.mailscanner.info> 
Verzonden: Donderdag 23 juli 2020 22:38:17 
Onderwerp: Re: mails with valid SPF sender don't get marked SPF_PASS 

On 7/23/20 1:39 AM, Thom van der Boon wrote: 
> Hi guys, 
> 
> I have something weird. Most mails with valid SPF record are marked 
> correctly (SPF_FAIL or SPF_PASS), but I see some messages which should 
> be marked as SPF_PASS get no SPF_PASS 


Assuming you are talking about the SPF_PASS rule in the SpamAssassin 
report in the X-vdbeu-MailScanner-SpamCheck: header, this is a 
SpamAssassin question, not a MailScanner question per se. You might do 
better on a SpamAssassin list. See 
<https://cwiki.apache.org/confluence/display/SPAMASSASSIN/MailingLists>. 

-- 
Mark Sapiro <mark at msapiro.net> The highway is for gamblers, 
San Francisco Bay Area, California better use your sense - B. Dylan 


-- 
MailScanner mailing list 
mailscanner at lists.mailscanner.info 
http://lists.mailscanner.info/mailman/listinfo/mailscanner 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20200724/4359fc94/attachment.html>


More information about the MailScanner mailing list