At 11:51 PM 5/4/04 +0200, Thomas Ugland wrote:
I have a minor problem with some inmail tags beening faulty.
That's the result of scanning a message twice.
The first time, it scores high, gets tagged, and gets encapsulated.
The second time, all the headers are different, so the score goes down (no RBL matches).. The X-Spam-Status gets over-written with a new header that doesn't indicate spam, but the body and subject are still marked from the first pass.
Notice the list of hits in the body is:
SUBJ_BUY HTML_30_40 HTML_FONTCOLOR_UNKNOWN MIME_HTML_ONLY HTML_MESSAGE HTML_IMAGE_ONLY_04 RCVD_IN_SORBS RCVD_IN_DSBL RCVD_IN_BL_SPAMCOP_NET RCVD_IN_DYNABLOCK
And then in the x-spam-Status: DATE_IN_PAST_12_24, HTML_FONTCOLOR_UNKNOWN, HTML_MESSAGE SUBJ_BUY
All the differences in hits are exactly what you'd expect to result from encapsulation. Loss of RBL hits, reduction in the HTML percentage, and a DATE_IN_PAST because the new Received: headers will be later in time than the original ones.. 12_24 is a bit odd, but not outrageous if your mail processing is slow.
