https://issues.apache.org/SpamAssassin/show_bug.cgi?id=7101
Bug ID: 7101
Summary: Received.pm: United Internet changed the way the
indicate authenticated HTTP submitted mail
Product: Spamassassin
Version: SVN Trunk (Latest Devel Version)
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Libraries
Assignee: [email protected]
Reporter: [email protected]
United Internet (GMX, Web.de and possibly also 1&1) seems to have changed the
way they indicate authenticated mail submitted through their Webmailers.
In the past it used to be:
Received: from [87.78.98.150] by msvc200 with HTTP; Wed, 16 Apr 2014
17:31:00 +0200
Now it's:
Received: from [94.79.161.130] by 3capp-webde-bs01.dlan.cinetic.de (via
HTTP); Tue, 11 Nov 2014 20:32:34 +0100
The IP address in brackets is the sender's actual IP address (most likely
dynamic).
Note the difference in "with HTTP" and "via HTTP". The replacing of the "with"
with "via" circumvents the rule set in
lib/Mail/SpamAssassin/Message/Metadata/Received.pm (Line 408)
For many mails this triggers SPF_FAIL and RCVD_IN_PBL and therefor incorrectly
flags many ham mails as spam.
--
You are receiving this mail because:
You are the assignee for the bug.
