I might have answered my question after doing further research. I have 3 mx records, one mx at 10 the other 2 at 15. Majority volumes goes thru mx1 record then to postfix then SpamAssassin, it the mail goes to mx2 or mx3 no scanning is done. But if this is not the problem, please let me know.
--Bryan SpamAssassin is being called from postfix SpamAssassin is system wide habeas tags are not a factor in my case, I looked at 20-30 with no issues Below are examples of 2 headers, I choose 2 with the spam content type: Example of actual header of no scan: Return-Path: <[EMAIL PROTECTED]> Received: from jonas.corp.good-sam.com ([172.16.102.109]) by nsmail1.corp.good-sam.com (Netscape Messaging Server 4.15) with ESMTP id HUSORV00.3Z2 for <[EMAIL PROTECTED]>; Thu, 18 Mar 2004 17:19:07 -0600 Received: from thieme.de ([127.0.0.1]) by jonas.corp.good-sam.com (Netscape Messaging Server 4.15) with SMTP id HUSP2G00.EEI for <[EMAIL PROTECTED]>; Thu, 18 Mar 2004 17:25:28 -0600 From: "Vonda Lynn" <[EMAIL PROTECTED]> Message-ID: <[EMAIL PROTECTED]> Subject: Half the price of Viagra i To: [EMAIL PROTECTED] Date: Thu, 18 Mar 2004 23:22:08 +0000 MIME-Version:1.0 Content-Type: text/html Content-Transfer-Encoding: quoted-printable An example of actual header that was scanned succesfully: Return-Path:<[EMAIL PROTECTED]> Received: from obmc03.messagehands.com (obmc03.messagehands.com [209.237.250.101]) by relay2.good-sam.com (Postfix) with SMTP id CBB0810E80A for <[EMAIL PROTECTED]>; Fri, 19 Mar 2004 15:16:48 -0600 (CST) Received: by obmc03.messagehands.com (PowerMTA(TM) v2.0r10) id hbc834055oop; Fri, 19 Mar 2004 07:21:38 -0800 (envelope-from <[EMAIL PROTECTED]>) Date: Fri, 19 Mar 2004 07:21:38 -0800 From: Platinum Credit <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: Want a new Platinum card? Content-Type: text/html Message-ID:<[EMAIL PROTECTED]> >>> Clive Eisen <[EMAIL PROTECTED]> 03/22/04 04:08PM >>> Send us a message, including ALL headers that got through, and another that was scanned succesfully. Then we might be able to help -- Clive Bryan Haase wrote: >Hi, >HELP! I have small amount of email that somehow bypasses the SA scoring and is >sent directly on. The style of email varies from html, multi-part message in >MIME format, and Base64 Encoded Files. SA blocks around 1200+ emails daily. My >boss daily gets at least 10 spams, that by pass the filters. I am using SA >2.60 and postfix. > >The problem happens randomly, the box load is very low around 1.0% or lower. >Does any have any suggestion on how to troubleshoot or what the issue could be? > >Thanks in advance >Bryan I >
------------------------------------------------- This email transmission and any documents, files or previous email messages attached to it may contain information that is confidential or legally privileged. If you are not the intended recipient, you are hereby notified that any disclosure, copying, printing, distributing or use of this transmission is strictly prohibited. If you have received this transmission in error, please immediately notify the sender by telephone or return email and delete the original transmission and its attachments without reading or saving in any manner. The Evangelical Lutheran Good Samaritan Society. ---------------------------------------------------------
