"Spam Actions" setting containing attachment and deliver not encapsulating message

[Shawn Iverson]

Interesting, apparently the client is interacting with the way 
MailScanner is encapsulating the message. The raw message is 
encapsulated, but my client (Thunderbird) is ignoring it and parsing 
just the inner MIME tree.


On 9/5/22 15:06, Shawn Iverson via MailScanner wrote:

> Confirmed unexpected behavior, more debugging and testing in progress.
>
> On 8/30/22 08:50, Ricky Boone wrote:
>> Thank you, Shawn, for the quick response.  If there's anything I can 
>> do to help with either the research and/or troubleshooting around 
>> this, please let me know.  I am by no means a competent Perl dev, but 
>> my management is very interested in getting this working properly 
>> (not meaning to add any pressure or assume expectations), and I'm a 
>> bit stuck at the moment.
>>
>> On Tue, Aug 23, 2022 at 4:22 PM Shawn Iverson via MailScanner 
>> <mailscanner at lists.mailscanner.info> wrote:
>>
>>     That doesn't seem desirable. This should be reproduceable,  so
>>     give me some time to lab this up and see what I can find out. It
>>     wouldn't be the first time we've found interesting things lurking
>>     in the perl mines.
>>
>>     On 8/23/22 14:34, Ricky Boone wrote:
>>>
>>>     *Warning: This message originated from outside the organization.
>>>     Use caution when following links or opening attachments.*
>>>
>>>     I'm troubleshooting an issue with a setting change we're trying
>>>     to test in our environment to provide users with notifications
>>>     that a message was flagged as spam, and why, as well as to
>>>     attach the original message to that notification.
>>>
>>>     Based on the configuration docs and previous conversations, this
>>>     should be handled by including 'attachment' in the Spam Actions
>>>     setting (though some references note 'attachment' along with
>>>     'deliver').  What I'm seeing, however, is that it is not
>>>     behaving as described.  When the rule only includes
>>>     'attachment', no message is fully delivered.  When it includes
>>>     'attachment' and 'deliver' (regardless of order, understanding
>>>     that it shouldn't matter), I get the message with the '{Spam?}'
>>>     subject prefix, but otherwise not encapsulated and not including
>>>     a notification message.  When attempting with 'attachment' and
>>>     'notify', I only get the notification, and if 'attachment',
>>>     'deliver', and 'notify' are included, I get both the
>>>     non-encapsulated spam message and the notification without an
>>>     attachment.
>>>
>>>     Prior to opening an issue in the GitHub project, I just want to
>>>     be sure I'm not doing something incorrectly.
>>>
>>>     For reference, I'm currently running MailScanner 5.3.3 (aware
>>>     that there are newer versions, but none that appear to be
>>>     relevant to address this issue based on the changelog) on CentOS
>>>     7 with postfix as the MTA, along with MailWatch 1.2.15.  Spam
>>>     Actions points to a custom rules file with a default (FromOrTo)
>>>     action set to 'store notify header "X-Spam-Status: Yes"', but I
>>>     have a To email address for testing with 'store attachment
>>>     deliver header "X-Spam-Status: Yes"' (though I've tried this
>>>     without deliver, removing store and header, with notify, etc.).
>>>
>>>     The logs seem to reflect my settings, depending on what I've
>>>     saved and reloaded.  For example, if I have attachment and
>>>     deliver set, I see this in the logs:
>>>
>>>     Aug 23 14:03:37 MailScanner[24433]: Delivery of spam: message
>>>     0BD1220625B0.AB434 from [removed] to [removed] with subject Re:
>>>     Test message
>>>     Aug 23 14:03:37 MailScanner[24433]: Spam Actions: message
>>>     0BD1220625B0.AB434 actions are attachment,store,deliver,header
>>>     Aug 23 14:03:39 MailScanner[24433]: Requeue: 0BD1220625B0.AB434
>>>     to E965720625AA
>>>
>>>     And if I have only attachment set:
>>>
>>>     Aug 23 11:57:15 MailScanner[22466]: Non-delivery of spam:
>>>     message 8225F206258E.AB9CA from [removed] to [removed] with
>>>     subject Test message
>>>     Aug 23 11:57:15 MailScanner[22466]: Spam Actions: message
>>>     8225F206258E.AB9CA actions are attachment,store,header
>>>
>>>
>>
>>
>>     -- 
>>     MailScanner mailing list
>>     mailscanner at lists.mailscanner.info
>>     http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20220905/63bed89c/attachment.html>