On Thu, 16 Oct 2014 22:37:20 -0700
Cathryn Mataga <cath...@junglevision.com> wrote:
> The score is only 1.9, 3.5 required. What's going on here?
>
>
> From me...@ecuador.junglevision.com Mon Oct 13 08:38:09 2014
> Return-Path: <me...@ecuador.junglevision.com>
> X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
> ecuador.junglevision.com
> X-Spam-Level: *
> X-Spam-Status: No, score=1.9 required=3.5 tests=BAYES_50,DKIM_SIGNED,
> EMAIL_URI_PHISH,HTML_MESSAGE,MIME_HTML_ONLY,RCVD_IN_DNSWL_LOW,T_DKIM_INVALID,
> URIBL_BLOCKED autolearn=disabled version=3.3.2
> Received: from ecuador.junglevision.com (localhost [127.0.0.1])
> by ecuador.junglevision.com (8.14.7/8.14.7) with ESMTP id
> s9DFc8B7015308
> (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384
> bits=256 verify=NO)
> for <megans...@junglevision.com>; Mon, 13 Oct 2014 08:38:08
> -0700 Received: (from megan@localhost)
> by ecuador.junglevision.com (8.14.7/8.14.7/Submit) id
> s9DFc8xV015307
> for megans...@junglevision.com; Mon, 13 Oct 2014 08:38:08
> -0700
^^^^^^^^
Recipient changed
Received: from egssmtp03.att.com (egssmtp03.att.com
> [144.160.128.152]) by ecuador.junglevision.com (8.14.7/8.14.7) with
> ESMTP id s9DFc5xN015302
> (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256
> verify=OK) for <me...@junglevision.com>; Mon, 13 Oct 2014 08:38:06
> -0700
Original recipient -- up to here.
Received: from uspedd06.edc.cingular.net
> (uspedd06.edc.cingular.net [135.214.228.40])
> by egssmtp03.att.com ( egs 8.14.5 TLS/8.14.5) with ESMTP id
> s9DFc46P014887
> for <me...@junglevision.com>; Mon, 13 Oct 2014 08:38:05 -0700
> DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;
> d=amcustomercare.att-mail.com; s=egs03; t=1413214685;
> bh=MI7iSFEx0e8sM2n1cEp/PA3RpmsCaSIBkzWhOYJfYAA=;
> h=Message-ID:Date:From:To:Subject:Mime-Version:Content-Type:
> Content-Transfer-Encoding;
> b=CYX9YX0nPomkMgc9QVja839EteJAXDIlKj0PGU7FS6Na0Bbe2MKs02M/tElklPs4H
> xkFLgTFYcep3bVF5BvPXbx4GTTTfG8t2SRph/JzCEMIkZUGCyjVnB+l507IiU/8qwZ
> D318VRDQoTPpXolVQMvP7EWBvn63ZKf49zG/Lh5JnhVqYYxcMyS5XVfJR9VRgt/Y+v
> lt4nkGSI0L+bf76ajwYTS6bERuSXRkwn7LsqYZkLRzBVbseQVK2oMFjV7pABS3Ru7d
> B2qDr9tjTuGnAhVrp8dloyU+fBVRc4jcj8Fas1FqgcoXoYFfIgqR2dQNkeKpYl+qRi
> GvEd3zXt9+ajw==
> Message-ID:
> <15150565.1413214684341.javamail.p7edd...@uspedd06.edc.cingular.net>
^^^^^^^^
???
Are you using imap to fetch your mail?
> Date: Mon, 13 Oct 2014 10:38:04 -0500 (CDT)
> From: AT&T Customer Care <ica...@amcustomercare.att-mail.com>
> To: me...@junglevision.com
> Subject: [SPAM] Your AT&T wireless bill is ready to view
^^^^^^
Fairly sure that this is not from spamassassin.
It appears the original recipient is megan@mumble but the address has
been rewritten or forwarded to meganspam@mumble.
It's only a guess but it appears that some server upstream has changed
the subject for you. Have a look at your mail logs to see if the subject
came into your server that way. If so, there's probably nothing you can
do to stop it. You can however, depending on your server, rewrite
subjects to remove such uselessly helpful edits.
And perhaps an upstream server has not properly implemented DKIM to
authenticate this message or has improperly modified it resulting in it
being marked as spam? DKIM auth apparently isn't too easy to get right.
jd
