Spamassassin being bypassed?

keefe007

Verified User
Joined
Dec 25, 2004
Messages
291
I have at least one user who has been receiving spam that appears to bypass spam-assassin.

Here are some headers:

Code:
Return-path: <[email protected]>
Envelope-to: [email protected]
Delivery-date: Thu, 28 May 2009 14:11:32 -0500
Received: from ip-174-142-68-70.static.privatedns.com ([174.142.68.70]
helo=mx1.yourbusinessview.com)
	by astra.techwarepc.com with smtp (Exim 4.69)
	(envelope-from <[email protected]>)
	id 1M9l0m-0002o9-7m
	for [email protected]; Thu, 28 May 2009 14:11:32 -0500
From: "Auto Protection Results" <[email protected]>
Subject: Car Warranty Wholesale
Date: Thu, 28 May 2009 15:15:25 -0500
Message-ID: <[email protected]>
To: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_0082_226a25f0.226a25f0"
X-Mailer: Microsoft Office Outlook 12.0
Content-Language: en-us
Importance: High

-------------------------------------------------------------------------

Return-path: <[email protected]>
Envelope-to: [email protected]
Delivery-date: Thu, 28 May 2009 14:11:58 -0500
Received: from [208.87.91.51] (helo=mx2.bigbrownloco.com)
	by astra.techwarepc.com with smtp (Exim 4.69)
	(envelope-from <[email protected]>)
	id 1M9l0Y-0002ms-Ss
	for [email protected]; Thu, 28 May 2009 14:11:57 -0500
To: <[email protected]>
Reply-To: <[email protected]>
From: "SimplyInk" <Save.Up.To.76%[email protected]>
Subject: RE: Ink & Toner {Get 10% Off + Free Shipping}
Date: Thu, 28 May 2009 14:25:29 -0600
Message-ID: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/related;
	boundary="----=_extPart_000_0004_10542050.10542050"

______________________________________________________________________

Return-path: <[email protected]>
Envelope-to: [email protected]
Delivery-date: Thu, 28 May 2009 14:52:37 -0500
Received: from [76.73.20.74] (helo=mx1.wealthteamusa.com)
	by astra.techwarepc.com with smtp (Exim 4.69)
	(envelope-from <[email protected]>)
	id 1M9leU-0005qk-NL
	for [email protected]; Thu, 28 May 2009 14:52:37 -0500
From: "Body Solutions" <[email protected]>
Subject: Sick of Stubborn Cellulite
Date: Thu, 28 May 2009 13:56:28 -0700
Message-ID: <[email protected]>
To: <[email protected]>
MIME-Version: 1.0
Content-Type: multipart/related;
	boundary="----=_NextPart_000_0007_01C9DA0F.9B810BA0"
X-Mailer: Microsoft Office Outlook 12.0
Content-Language: en-us

The interesting thing is that *most* of his email contains the spamassassin headers.

What could be causing these particular emails to not be scanned?

Thanks,

Keefe
 
Are these large emails? Check to see the email size over which SpamAssassin doesn't scan.

Jeff
 
They were all around 100 - 150 KB. Where is that setting located? I'll check to see what i'm set at.
 
How are you calling SpamAssassin? Through the standard exim.conf file? Or using MailScanner? If you're using MailScanner you can find a relevant post here; see post #7 in the thread.

If you're not using MailScanner, then the problem may be in your batch_max setting in exim.conf, but unfortunately I can't find a good definition of the meaning. I'm thinking it's probably the amount of emails to batch for scanning, after which SpamAssassin will stop scanning, but I haven't found the details. Perhaps someone else can help.

Jeff
 
Back
Top