On 29 December 2016 at 10:13, Martin Skjöldebrand <[email protected]> wrote: > > I post the headers of the mail here in case more eyes can see what I'm > not seeing. > > Return-Path: <[email protected]> > Delivered-To: [email protected] > Received: from localhost (mail.skjoldebrand.org [127.0.0.1]) > by mail.skjoldebrand.org (Postfix) with ESMTP id 5C49241FA9 > for <[email protected]>; Thu, 29 Dec 2016 09:49:14 +0000 (UTC) > X-Virus-Scanned: Debian amavisd-new at skjoldebrand.org > X-Spam-Flag: NO > X-Spam-Score: 4.93 > X-Spam-Level: **** > X-Spam-Status: No, score=4.93 tagged_above=-9999 required=6.31 > tests=[HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_IMAGE_ONLY_24=1.282, > HTML_MESSAGE=0.001, NO_RECEIVED=-0.001, NO_RELAYS=-0.001, > URIBL_ABUSE_SURBL=1.948, URIBL_BLACK=1.7] > autolearn=no autolearn_force=no > Received: from mail.skjoldebrand.org ([127.0.0.1]) > by localhost (mail.is5vvtanwi2exf2ymdo0g3rtze.fx.internal.cloudapp.net > [127.0.0.1]) (amavisd-new, port 10024) > with ESMTP id UEpvsKs9y09d for <[email protected]>; > Thu, 29 Dec 2016 09:49:10 +0000 (UTC) > Date: Thu, 29 Dec 2016 10:49:09 +0100 > To: [email protected] > From: Julia Petterson <[email protected]> > Subject: Du har 15.739,15 kr klart till utbetalning > Message-ID: <[email protected]> > X-YMLPcode: y3p2+398+54296 > List-Unsubscribe: <http://t.ymlp31.net/unsub_gwhbmmugsgbjeyhgmyqggyujsh.php> > MIME-Version: 1.0 > Content-Type: multipart/alternative; > boundary="b1_5b2e4056110b69010cbed7ad5097c5ee" >
Did you edit out some lines between the 2nd Received: and the Date: headers? Seems strange that the first (i.e. the last as listed) Received header is the internal one as postfix passes the email to amavis, shouldn't there be earlier Received headers showing the email's progress through to, and including its arrival at, your server? BTW if you aren't using Bayes with spamassassin (or you aren't training it), you could try a lower trigger setting in amavis, I use 4.0 instead of the default 6.31, which would have picked up your example as spam: $sa_tag2_level_deflt = 4.0; # add 'spam detected' headers at that level $sa_kill_level_deflt = 4.0; # triggers spam evasive actions
