It's just a guess, but I'm thinking that the Envelope-From may be using your domain name which is why it is getting whitelisted. Is it possible to get your MTA to include the Envelope From in the headers?


Victor wrote:

Hi. I am running postfix and spamassassin from .procmailrc (spamc connecting to spamd).

The problem I am facing is that over time, more and more emails are getting through. I am trying to add some rules to stop some of them, but strangely, something that looks like spam in header values, is getting through with amazing consistency. I am trying to figure out why this would get such a good score.

Also, I don't have a lot of HAM to use for learning, so I decided not to use learning (since I would only have spam to teach) is auto-learn, basian learning the best alternative then? What is the difference between those two settings?

Thank you

Here is the attached spam message (see below)
Ignore SpamProbe, I am running that as a secondary filter, but it marks everything as spam and took a month just to teach it right, and I don't know if I will continue using it.
However, SpamAssassin marks it as -79.8, I am trying to figure out what gives it such a good score.


It says "user in whitelist", but that's not possible:
  From: "Daryl Dickinson" <>

I assume it's the whitelist giving it such a good score? But I am not sure why.

in local.cf, I only have
  whitelist_from

and list only my domains.

Any help appreciated.
Thank you

----------------------------------------------------------------

Return-Path: <[EMAIL PROTECTED]>
X-Original-To: [EMAIL PROTECTED]
Delivered-To: [EMAIL PROTECTED]
Received: from c-24-2-80-128.client.comcast.net (c-24-2-80-128.client.comcast.net [24.2.80.128])
by mail.paid.com (Postfix) with SMTP id 172EB43C5
for <[EMAIL PROTECTED]>; Mon, 15 Mar 2004 18:28:58 -0500 (EST)
Received: from 224.148.110.198 by 24.2.80.128; %CURRENT_DATE_TIME
Message-ID: <ISDPSRVXZJDPLANWAGVRB@>
From: "Daryl Dickinson" <>
Reply-To: "Daryl Dickinson" <>
To: [EMAIL PROTECTED]
Subject:
Date: %CURRENT_DATE_TIME
X-Mailer:
MIME-Version: 1.0
X-Security: MIME headers sanitized on mail.paid.com
See http://www.impsec.org/email-tools/sanitizer-intro.html
for details. $Revision: 1.136 $Date: 2002-10-20 10:38:14-07
Content-Type: multipart/alternative;
boundary="--6436349948252736170"
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on mail.paid.com
X-Spam-Status: No, hits=-79.8 required=7.5 tests=BAYES_99,EARN_MONEY,
FROM_NO_USER,HTML_MIME_NO_HTML_TAG,INVALID_MSGID,MIME_HTML_NO_CHARSET,


    MIME_HTML_ONLY,MIME_HTML_ONLY_MULTI,MLM,MSGID_NO_HOST,REMOVE_PAGE,
    USER_IN_WHITELIST,WORK_AT_HOME autolearn=no version=2.63
X-Spam-Level:
X-SpamProbe: SPAM 1.0000000 663c1c9cb799fc03a25418273e58f154

----6436349948252736170
Content-Type: text/html;
Content-Transfer-Encoding: quoted-printable


If you've been looking and searching for a legitimate way to earn a large income at home, using the internet, your search is over.

Six months ago I was searching for the same thing.

In the past, I had tried Multi-Level-Marketing (M.L.M)
with minimal success.

I still believed there must be something out there
that I could do and make a large income from home.

But what?

THEN I FOUND IT !!

1. Find out how I earn $400 to $800 everyday working at
   home 3 to 4 hours a day.
2. I provide step-by-step instructions to make immediate income.
3. Turnkey blueprint that's easy to follow.
4. Immediate income paid directly to you
5. Not M.L.M!

I work only with people who are committed to success and
don't mind working for big results. If that's you and
are sincere about wanting and needing to earn a minimum
of $400 daily, call me.

Go ahead now!

http://www.toform.net/mcp/696/26/cap232.html

Don't let the next 5 years be like the last 5 years!























If you received this message in error or if you wish to be
removed from our OUA mailing list.

http://www.financialbuilder.info/remove.html

THIS EMAIL IS A COMMERCIAL ADVERTISEMENT.
This eMail is in compliance with the all US Federal eMail Laws.

SS
P.O. Box 1958
Bloomfield, N.J. 07003


----6436349948252736170--

Reply via email to