I have noticed on some emails that when SIMSCAN refers the email to Spamassassin, the domain name gets changed, like so (from the Spamassassin log):
> 2011-04-20 13:55:32.757156500 Apr 20 13:55:32.751 [17877] info: spamd: > result: . 3 - > HTML_MESSAGE,MIME_QP_LONG_LINE,RCVD_NUMERIC_HELO,RDNS_NONE,SARE_GIF_AT > TACH,T> _FILL_THIS_FORM_SHORT > scantime=6.0,size=11089,user=clamav,uid=89,required_score=3.7,rhost=lo calhost.localdomain,raddr=127.0.0.1,rport=34733,mid=<006301cbff8c$49186170$d b492450$@com>,autolearn=no The domain name (in red) was supposed to be 'ncm20.com'. I have not yet seen any other changed, but I'll keep looking. Where this causes a problem is if you have a whitelist_from entry set up in your local.cf. Since it doesn't match that whitelist entry, it doesn't get whitelisted. Scott
