[imp] Re: spamassassin and blocking lists

[George Theall]

On Wed, Nov 03, 2004 at 04:42:01PM +1100, Iain Pople wrote:

> The issue is that a header inserted from IMP triggers 
> spamassassin whereas a header inserted by the mail server doesn't.
> 
> E.g. The following header triggers spamassassin:
> 
> Received: from CPE-203-45-11-59.vic.bigpond.net.au 
> (CPE-203-45-11-59.vic.bigpond.net.au [203.45.11.59])
>     by webmail.brunny.com (IMP) with HTTP
>     for <iain at localhost>; Sun, 24 Oct 2004 10:21:07 +1000
> 
> This one doesn't:
> 
> Received: from cpe-203-45-11-59.vic.bigpond.net.au ([203.45.11.59]) by 
> bwmam09.bigpond.com(MAM REL_3_4_2a 138/139363271) with SMTP id 
> 139363271; Sun, 31 Oct 2004 14:35:01 +1000

One of SpamAssassin's new features, in 20_fake_helo_tests.cf, is a set
of tests that identify connections in which the HELO host used was the
rDNS for a host on a dialup / DSL / cablemodem connection on the
assumption that there are few valid mailservers calling themselves
things like 'CPE-203-45-11-59.vic.bigpond.net.au'.  The tests don't
actually check whether the HELO host equals the rDNS, just that there is
something for the rDNS and then they look at the HELO host.  With that
said, the reason your second example is not being tagged as spam is
simply that your ISP's MTA doesn't include the rDNS info.  If it were to
do that, you'd experience the same results as with messages sent with
IMP. 

As I said before, though, the issue is with the way
Mail::SpamAssassin::Message::Metadata::Received is parsing Received
headers, in parse_received_line().  That is, like SquirrelMail, headers
belonging to IMP should be ignored since they reflect an authenticated
connection. 

George
-- 
theall at tifaware.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.horde.org/archives/imp/attachments/20041104/828b5d47/attachment.bin