My Spamassassin version : 3.3.1
Following are sample message headers:
Return-Path: <>
Delivered-To: clean-quarantine
X-Envelope-From:
<b9d02381-7740-4159-badd-eadc565eb...@cloudemail5.cpgtest.ostinet.net>
X-Envelope-To: <4564eji78...@load.cpgtest.ostinet.net>
X-Envelope-To-Blocked:
X-Quarantine-ID: <F2SbkzVKv8fE>
X-Spam-Flag: NO
X-Spam-Score: 6.423
X-Spam-Level: ******
X-Spam-Status: No, score=6.423 tag=-999 tag2=6.9 kill=6.9
tests=[FROM_LOCAL_HEX=0.331, HTML_IMAGE_ONLY_24=1.282,
HTML_MESSAGE=0.001, RCVD_ILLEGAL_IP=3.399, SARE_GIF_ATTACH=1.42,
T_RP_MATCHES_RCVD=-0.01] autolearn=no
X-Spam-Report:
* 3.4 RCVD_ILLEGAL_IP Received: contains illegal IP address
* 0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence
* -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
* domain
* 1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 1.4 SARE_GIF_ATTACH FULL: Email has a inline gif
Received: from load.cpgtest.ostinet.net ([127.0.0.1])
by localhost (load.cpgtest.ostinet.net [127.0.0.1]) (amavisd-new, port
10024)
with LMTP id F2SbkzVKv8fE for <4564eji78...@load.cpgtest.ostinet.net>;
Fri, 10 Feb 2012 08:23:09 -0500 (EST)
Received: from mail.ostinet.net (mail.ostinet.net [194.149.89.24])
by load.cpgtest.ostinet.net (Postfix) with ESMTPS id C054F1ACC045
for <4564eji78...@load.cpgtest.ostinet.net>; Fri, 10 Feb 2012 08:23:07
-0500 (EST)
Authentication-Results: load.cpgtest.ostinet.net; sender-id=none
header.from=b9d02381-7740-4159-badd-eadc565eb...@cloudemail5.cpgtest.ostinet.net;
spf=none
smtp.mfrom=b9d02381-7740-4159-badd-eadc565eb...@cloudemail5.cpgtest.ostinet.net
X-DKIM: OpenDKIM Filter v2.1.3 load.cpgtest.ostinet.net C054F1ACC045
Authentication-Results: load.cpgtest.ostinet.net; dkim=none (no signature);
dkim-adsp=none
Received: from cloudemail5.cpgtest.ostinet.net
(ec2-184-72-247-145.compute-1.amazonaws.com [184.72.247.145])
by mail.ostinet.net (8.13.1/8.13.1) with SMTP id q1ADMwXp018879
for <4564eji78...@load.cpgtest.ostinet.net>; Fri, 10 Feb 2012 13:23:00
GMT
Received: from expedite (unknown [15.219.195.127])
by cloudemail5.cpgtest.ostinet.net (Postfix) with ESMTP id 8328E3485E
for <4564eji78...@load.cpgtest.ostinet.net>; Fri, 10 Feb 2012 08:22:54
-0500 (EST)
X-Original-To: 1364_testm...@cloudemail5.cpgtest.ostinet.net
Delivered-To: 1364_testm...@cloudemail5.cpgtest.ostinet.net
Received: from mail-pz0-f41.google.com (mail-pz0-f41.google.com [209.85.210.41])
by cloudemail5.cpgtest.ostinet.net (Postfix) with ESMTP id 2152834837
for <1364_testm...@cloudemail5.cpgtest.ostinet.net>; Tue, 7 Feb 2012
06:03:59 -0500 (EST)
Received: by dadv6 with SMTP id v6so5891220dad.28
for <1364_testm...@cloudemail5.cpgtest.ostinet.net>; Tue, 07 Feb 2012
03:03:58 -0800 (PST)
Received: by 10.68.219.101 with SMTP id pn5mr5483175pbc.37.1328612638547;
Tue, 07 Feb 2012 03:03:58 -0800 (PST)
Received: from [192.168.1.106] ([14.98.27.245])
by mx.google.com with ESMTPS id q8sm22575740pbi.1.2012.02.07.03.03.33
(version=TLSv1/SSLv3 cipher=OTHER);
Tue, 07 Feb 2012 03:03:56 -0800 (PST)
Subject: Fwd: GMAIL WEB attachment contains Gif and Giff files
References: <CAK=nnrwusn3jfxt2e0yxhmeutykgyh7sh+iqgxydwxggxht...@mail.gmail.com>
From: b9d02381-7740-4159-badd-eadc565eb...@cloudemail5.cpgtest.ostinet.net
Content-Type: multipart/alternative;
boundary=Apple-Mail-6494678E-A93F-4140-86A9-5E0B53C654F4
X-Mailer: iPhone Mail (9A405)
Message-Id:
<17004336.2371328880174317.javamail.hpad...@cloudemail5.cpgtest.ostinet.net>
Date: Tue, 7 Feb 2012 16:33:25 +0530
To: 4564eji78...@load.cpgtest.ostinet.net
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0
Reply-To: b9d02381-7740-4159-badd-eadc565eb...@cloudemail5.cpgtest.ostinet.net
Thanks
Ashish
-----Original Message-----
From: Axb [mailto:axb.li...@gmail.com]
Sent: Friday, February 10, 2012 2:39 PM
To: users@spamassassin.apache.org
Subject: Re: Getting high spam score for email server hosted on AWS instance
On 02/10/2012 09:33 AM, Sharma, Ashish wrote:
> Following is the spam score received for cloudemail5.cpgtest.ostinet.net
> (184.72.247.145) email sending setup on one of my Spamassassin email
> receiving setup:
>
> [FROM_LOCAL_HEX=0.331, HTML_IMAGE_ONLY_24=1.282, HTML_MESSAGE=0.001,
> RCVD_ILLEGAL_IP=3.399, T_REMOTE_IMAGE=0.01, T_RP_MATCHES_RCVD=-0.01]
> autolearn=no
>
> Is there anything else you need? I didn't get your last question completely.
>
why not post a sample msg's headers in a pastebin ?
Would prevent a lot of the guess work.
What SA version are you using?
