I'm having some difficulty getting a simple custom
rule to
work based on the X-Mailer used. Here is the custom
rule:
header
SPAM_BAT X-Mailer =~ /The
Bat!/i
describe SPAM_BAT Potential spam
client (The Bat)
score
SPAM_BAT
8.0
Here is a portion of an example header that goes
right through with no
spam hits, and by the way, I have a bunch of
these:
Microsoft Mail Internet Headers Version
2.0
Received: {content removed for security reasons}
Received: {content
removed for security reasons}
Received: {content removed for security
reasons}
Received: {content removed for security reasons}
Date: Sat, 19
Aug 2006 15:52:23 -0100
From: "asdf" <[EMAIL PROTECTED]>
X-Mailer:
The Bat! (v2.12.00) Personal
X-Priority: 3
Message-ID: <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: This
transmission is an eyeopener
MIME-Version: 1.0
Content-Type:
multipart/alternative;
boundary="----------O4VYWC6U0DPTOV4HHOAO5"
X-TRC-MailScanner-Information:
Please contact the ISP for more
information
X-TRC-MailScanner: Found to be
clean
X-MailScanner-From: [EMAIL PROTECTED]
Return-Path: [EMAIL PROTECTED]
X-OriginalArrivalTime: 19 Aug 2006 18:10:19.0424
(UTC)
FILETIME=[BAEFAA00:01C6C3BA]
------------O4VYWC6U0DPTOV4HHOAO5
Content-Type:
text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit
------------O4VYWC6U0DPTOV4HHOAO5--
My Setup:
SpamAssassin: v3.14
Called
via MailScanner: v4.55.10
Perl: 5.8.5
Troubleshooting steps thus far:
* Ran
spamassassin -D --lint. No errors
* Confirmed that the file with
the above rule is being read by putting
other rules in the file. The
other rules are found and executed.
* Attempted to search the entire
hearder using ALL instead of
X-Mailer. Same results.
*
Confirmed that the message in question is indeed getting routed
through the
MailScanner/Spamassassin filter.
* Confirmed that Spamassassin doesn't
show as timed out.
* Stopped/Restearted and even rebooted the computer
(yes, I know that
should be necessary but wanted to make sure) to make sure
the rules is
being read.
I know someone will mention that it is not
necessarily a good idea to
filter on a particular mailer, but I have
confirmed that none of my
clients use "The Bat!" and I am willing to take the
chance.
Any ideas?
