"Spam Actions" setting containing attachment and deliver not encapsulating message

[Shawn Iverson]

Ahh, the header still has the old boundary. That is a problem.

On 9/5/22 15:23, Shawn Iverson via MailScanner wrote:
>
> Interesting, apparently the client is interacting with the way 
> MailScanner is encapsulating the message. The raw message is 
> encapsulated, but my client (Thunderbird) is ignoring it and parsing 
> just the inner MIME tree.
>
>
> On 9/5/22 15:06, Shawn Iverson via MailScanner wrote:
>
>> Confirmed unexpected behavior, more debugging and testing in progress.
>>
>> On 8/30/22 08:50, Ricky Boone wrote:
>>> Thank you, Shawn, for the quick response.  If there's anything I can 
>>> do to help with either the research and/or troubleshooting around 
>>> this, please let me know.  I am by no means a competent Perl dev, 
>>> but my management is very interested in getting this working 
>>> properly (not meaning to add any pressure or assume expectations), 
>>> and I'm a bit stuck at the moment.
>>>
>>> On Tue, Aug 23, 2022 at 4:22 PM Shawn Iverson via MailScanner 
>>> <mailscanner at lists.mailscanner.info> wrote:
>>>
>>>     That doesn't seem desirable. This should be reproduceable,  so
>>>     give me some time to lab this up and see what I can find out. It
>>>     wouldn't be the first time we've found interesting things
>>>     lurking in the perl mines.
>>>
>>>     On 8/23/22 14:34, Ricky Boone wrote:
>>>>
>>>>     *Warning: This message originated from outside the
>>>>     organization. Use caution when following links or opening
>>>>     attachments.*
>>>>
>>>>     I'm troubleshooting an issue with a setting change we're trying
>>>>     to test in our environment to provide users with notifications
>>>>     that a message was flagged as spam, and why, as well as to
>>>>     attach the original message to that notification.
>>>>
>>>>     Based on the configuration docs and previous conversations,
>>>>     this should be handled by including 'attachment' in the Spam
>>>>     Actions setting (though some references note 'attachment' along
>>>>     with 'deliver').  What I'm seeing, however, is that it is not
>>>>     behaving as described.  When the rule only includes
>>>>     'attachment', no message is fully delivered.  When it includes
>>>>     'attachment' and 'deliver' (regardless of order, understanding
>>>>     that it shouldn't matter), I get the message with the '{Spam?}'
>>>>     subject prefix, but otherwise not encapsulated and not
>>>>     including a notification message.  When attempting with
>>>>     'attachment' and 'notify', I only get the notification, and if
>>>>     'attachment', 'deliver', and 'notify' are included, I get both
>>>>     the non-encapsulated spam message and the notification without
>>>>     an attachment.
>>>>
>>>>     Prior to opening an issue in the GitHub project, I just want to
>>>>     be sure I'm not doing something incorrectly.
>>>>
>>>>     For reference, I'm currently running MailScanner 5.3.3 (aware
>>>>     that there are newer versions, but none that appear to be
>>>>     relevant to address this issue based on the changelog) on
>>>>     CentOS 7 with postfix as the MTA, along with MailWatch 1.2.15. 
>>>>     Spam Actions points to a custom rules file with a default
>>>>     (FromOrTo) action set to 'store notify header "X-Spam-Status:
>>>>     Yes"', but I have a To email address for testing with 'store
>>>>     attachment deliver header "X-Spam-Status: Yes"' (though I've
>>>>     tried this without deliver, removing store and header, with
>>>>     notify, etc.).
>>>>
>>>>     The logs seem to reflect my settings, depending on what I've
>>>>     saved and reloaded.  For example, if I have attachment and
>>>>     deliver set, I see this in the logs:
>>>>
>>>>     Aug 23 14:03:37 MailScanner[24433]: Delivery of spam: message
>>>>     0BD1220625B0.AB434 from [removed] to [removed] with subject Re:
>>>>     Test message
>>>>     Aug 23 14:03:37 MailScanner[24433]: Spam Actions: message
>>>>     0BD1220625B0.AB434 actions are attachment,store,deliver,header
>>>>     Aug 23 14:03:39 MailScanner[24433]: Requeue: 0BD1220625B0.AB434
>>>>     to E965720625AA
>>>>
>>>>     And if I have only attachment set:
>>>>
>>>>     Aug 23 11:57:15 MailScanner[22466]: Non-delivery of spam:
>>>>     message 8225F206258E.AB9CA from  [removed] to [removed] with
>>>>     subject Test message
>>>>     Aug 23 11:57:15 MailScanner[22466]: Spam Actions: message
>>>>     8225F206258E.AB9CA actions are attachment,store,header
>>>>
>>>>
>>>
>>>
>>>     -- 
>>>     MailScanner mailing list
>>>     mailscanner at lists.mailscanner.info
>>>     http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>
>>>
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20220905/3b19a92f/attachment.html>