[ Okay trying to post this to the new list now that I've slogged through my backlog and figured out y'all up and moved on me. :-P ]
Yesterday we upgraded from SA 2.55 to SA 2.63 and I've noticed a difference in the headers SA is adding to the messages that get flagged.
Headers from v2.55
X-Spam-Report: This mail is probably spam. [* Snip inclusion of original message]
Content analysis details: (5.60 points, 5 required)
PLING_QUERY (0.7 points) Subject has exclamation mark and question mark
J_CHICKENPOX_23 (0.6 points) BODY: {2}Letter - punctuation - {3}Letter
J_CHICKENPOX_39 (0.6 points) BODY: {3}Letter - punctuation - {9}Letter
HTML_50_60 (0.5 points) BODY: Message is 50% to 60% HTML
HTML_MESSAGE (0.1 points) BODY: HTML included in message
HTML_TAG_BALANCE_BODY (0.2 points) BODY: HTML has unbalanced "body" tags
HTML_IMAGE_ONLY_02 (1.9 points) BODY: HTML has images with 0-200 bytes of words
MRWIGGLY (1.0 points) Mr. Wiggly enhance drug spam.
Headers from v2.63:
X-Spam-Report:
* 1.5 RCVD_NUMERIC_HELO Received: contains a numeric HELO
* 0.0 BAYES_50 BODY: Bayesian spam probability is 50 to 56%
* [score: 0.5003]
* 0.1 HTML_MESSAGE BODY: HTML included in message
* 4.1 FORGED_RCVD_NET_HELO Host HELO'd using the wrong IP network
* 0.1 FVGT_TRIPWIRE_QD FVGT_TRIPWIRE_QD
* 0.1 FVGT_TRIPWIRE_QF FVGT_TRIPWIRE_QF
* 0.1 FVGT_TRIPWIRE_TN FVGT_TRIPWIRE_TN
* 0.1 FVGT_TRIPWIRE_OQ FVGT_TRIPWIRE_OQ
* 0.1 FVGT_TRIPWIRE_IQ FVGT_TRIPWIRE_IQ
* 0.1 FVGT_TRIPWIRE_PP FVGT_TRIPWIRE_PPI can happily do with out the I'm-mucking-up-your-headers-by-including-the-original-message-up-here part, and but the new format is uuuuuuuuuuugly! Wazzup w'dat?
--JR
