> We're running SpamAssassin 2.63 with amavisd-new-20030616-p5 > and postfix as > a frontend to our Exchange server (yes, it all needs to be > updated, but > still working damn well). SA/amavisd-new tags all mail with > scores (dropping > stuff with scores over 20), and it's up to Exchange rules to > filter to Spam > folders for the end users. > > A few months ago I started to see an occasional email come > through to the > client with the X-Spam headers showing up in the body of the > email rather > than the header (and since the rules trigger on the header, > not getting > filtered as spam by the client rules). > > Attached is an example of one of these emails. It appears > that there is a > space between the original header and the X-Spam headers, > which I think is > what is causing the client to consider the space to mark the > beginning of > the body. > > Anyone seen this? The email shows up in the Outlook client > with this at the > top, followed by the pharmeceutical spam pitch:
When we were running Merak for a evaluation, I saw this occasionally. What happens is that some spam engine must insert an extra CR without the LF following which apparently most e-mail servers ignore. But in parsing the headers for rules, some servers see CR-CR-LF as the end of the headers and ignore the remaining headers. In my case, the app calling SpamAssassin was my own, so I simply coded it to drop extra CR characters which then made it perform correctly. > > X-Spam-Status: Yes, hits=12.6 tagged_above=-999.0 > required=5.0 tests=AWL, > BANG_GUARANTEE, BAYES_99, DATE_IN_FUTURE_03_06, J_CHICKENPOX_28, > RCVD_IN_SBL, > SARE_OBFUMONEY2, TW_NW > X-Spam-Level: ************ > X-Spam-Flag: YES > > > The strange thing is when I copy this deformed email back to > the Exchange > server (using IMAP), that Outlook then seems to decide that > the X-Spam stuff > *is* part of the header after all and the Outlook client > doesn't show the > X-Spam stuff in the body of the email... even though on > initial delivery it > was in the body.... so not sure if this is a problem in SA, > amavsd-new, or > Exchange/Outlook. > > Pretty annoying to have SA properly tag something, but have > it come through > anyway... I'm hoping someone else has seen this (I was unable > to turn up anything in the archives). Bret
