spamassassin-users June 2010 archive
Main Archive Page > Month Archives  > spamassassin-users archives
spamassassin-users: Re: NO_RELAYS spam

Re: NO_RELAYS spam

From: Martin Gregorie <martin_at_nospam>
Date: Sun Jun 20 2010 - 15:57:16 GMT
To: users@spamassassin.apache.org

On Sun, 2010-06-20 at 08:22 -0500, David Morton wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 6/17/10 11:13 AM, Randy Ramsdell wrote:
>
> > Postfix ---> 2. Amavis ( Spamd/Clamd) ---> 3. Postfix ---> 4.
> > Dovecot-deliver
>
> > No, I run a script on the mail server manually that simply moves the
> > files. Then I check with spamassassin.
>
> I wonder about step 4, or 5... what does this script move? Is this an
> MBOX format file, or Maildir? Do you have a broken Sieve script?
>
> It sounds to me like the original scoring is correct, as it does not hit
> the NO_RELAYS rule, and that takes place in step 2.
>
An easy way to check what's in the message at steps 2 and 4 would be to
add an "always_bcc" directive to "/etc/postfix/main.cf", which will send
a copy of every mail message that passes through Postfix to a nominated
mailbox. If amavis is being run as a Postfix service, i.e. using
sendmail to re-inject the scanned message into the Postfix mail queue,
then always_bcc will capture two copies of the message - (1) after
delivery to Postfix and (2) on redelivery to Postfix after its been
through amavis.

You can then use procmail and/or mboxgrep to search through the captured
messages.

Martin