This is likely being caused by a bug in spamass-milter 0.2.0 (bug #6970)
that I reported back in December of 2003 which apparently still hasn't even
been acknowledged. My posting to the SpamAssassin list (including a
workaround) can be found at
http://article.gmane.org/gmane.mail.spam.spamassassin.general/36778/.
Briefly there is a bug in how spamass-milter generates the pseudo header it
passes to SpamAssassin during delivery (because a milter processes email
before Sendmail adds its headers). Spamass-milter sometimes leaves an extra
space at the end of the pseudo header because of an undefined variable. The
regexes SpamAssassin uses when parsing headers are anchored to a
non-whitespace character followed by the newline, so this whitespace
character causes SpamAssassin to ignore the header entirely. Granted this
could also be considered a bug/feature request for SpamAssassin.
In your case what's happening is the header added by your mail server
(specifically by spamass-milter) is not being parsed so SpamAssassin is only
really seeing:
Received: from mail.bremanda.com (unknown [192.168.1.24])
by smtp01.mail.yourwebhosting.com (Postfix) with ESMTP
id 895B9B9944; Wed, 12 May 2004 18:33:25 -0500 (CDT)
Received: from 68.79.16.194
(SquirrelMail authenticated user [EMAIL PROTECTED])
by webmail.yourwebhosting.com with HTTP;
Wed, 12 May 2004 18:51:30 -0500 (CDT) ...<snip>...
SpamAssassin checks the most recent header and sees that it was from an IP
in RFC1918 address space (192.168.1.24) and considers it a trusted host.
The next header is not in trusted_networks nor is it in RFC1918 space so
SpamAssassin considers it to be the first untrusted host. To SpamAssassin
it's as if this host had directly delivered mail to it so it's a candidate
for RBL checks including -notfirsthost since it's the only untrusted header.
Brian
-----Original Message-----
From: Martin McWhorter [mailto:[EMAIL PROTECTED]
Sent: Thursday, May 13, 2004 11:14 AM
To: Brian Sneddon; SpamAssassin Users List
Subject: Re: Not First Hop?
Brian Sneddon wrote:
>Which Sendmail milter are you using?
>
>
>
I am using spamass-milter 0.2.0
It runs with the following switches:
-p /var/run/spamass.sock -f -b [EMAIL PROTECTED]
Martin
