Hello,
Recently I did some tweaks to my spamassasing configuration and I periodically verified my recieved e-mails to check the SA score.
I noticed the some e-mails are note being scanned by SA, apparently.
A good heard should look like this:
X-Spam-Status: No, score=4.1
X-Spam-Score: 41
X-Spam-Bar: ++++
X-Ham-Report: Spam detection software, running on the system "quanton.tchmachines.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
root\@localhost for details.
Content preview: [...]
Content analysis details: (4.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
8.0 BAYES_99 BODY: Bayes spam probability is 99 to 100%
[score: 1.0000]
-1.5 SPF_HELO_PASS SPF: HELO matches SPF record
-1.5 SPF_PASS SPF: sender matches SPF record
-1.5 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 T_REMOTE_IMAGE Message contains an external image
0.6 AWL AWL: From: address is in the auto white-list
X-Spam-Flag: NO
But the non-scanned e-mail have a header like this:
X-Spam-Status: No, score=
X-Spam-Score:
X-Spam-Bar:
X-Ham-Report:
X-Spam-Flag: NO
My first guess is that the e-mails already included the spam-related headers.
Potentially added by the spammers to trick SA into not scanning it again.
Second the spammers might be adding some other code to the header to trick SA.
Third it can be some configuration problem with SA.
I can send the full header of some e-mails for further analysis.
Is anyone else having such problem?
Thank you.
Note: Ticket already opened (#VVQ-565-94936) but I am having a quite hard time.