On Tue, 6 Dec 2016 17:43:26 +0000 SA wrote: > One of my web sites sends me a minimal email to indicate its status. > There is no body, just a subject and the usual headers. It is sent > several times a day. > > The sending domain is in the trusted_networks list so the SA report > includes ALL_TRUSTED
No, ALL_TRUSTED means that the email only passed through trusted IP addresses or was authenticated into the trusted network. ... > There is another oddity in this scenario. I have set up a tracing > header, shown above as... > > X-Original-IP: (web visitor's IP) > > This is recent. Previously I had... > > X-Originating-IP: (web visitor's IP) > > ... but this resulted in losing ALL_TRUSTED (all other tags in > X-Spam-Status remained). Spamassassin seemed to think this was the > envelope-from or something of that kind and filled in... > > X-Spam-RelaysUntrusted: [ ip=(visitor's IP) rdns= helo= by= ident= > envfrom= In webmail the client IP address is often put in X-Originating-IP; SpamAssassin treats this as the first relay just as if it were from an smtp submission received header.
