ALL_TRUSTED getting triggered on spam emails

Jason Hollenberg wrote:

> Received: from mx2.housedogs.net (mx2.housedogs.net
[72.46.158.216])/
> /        by mail.mydomain.com (Postfix) with ESMTP id
4A6662263C/
> /        for <usermydomain.com>; Wed, 25
Oct 2006 08:56:07 -0500 (CDT)/

Is this the /only/ 'Received:' header, or did you just edit
out the
other ones to reduce the noise?  If your upstream MTA and/or
amavisd-maia is not inserting its own 'Received:' header,
then that's
most likely the problem.  With trusted_networks and
internal_networks
you've told SpamAssassin where to look for the trust
boundary, but if no
mail hosts in that list ever show up in the list of
'Received:' headers
it assumes that everything must have taken place /within/
that trust zone.

There's an amavisd.conf setting called $insert_received_line
that you
can use (it's set to 1 to enable it by default) to ensure
that
amavisd-maia inserts its own 'Received:' header, but note
that this can
only be done with Postfix or a dual-Sendmail setup--it won't
work with a
Sendmail milter setup.  In any case, your upstream MTA
should be
inserting a 'Received:' header for you as well.

If this still doesn't help, try running SpamAssassin
directly on one of
these mail items in debug mode (as your amavis/maia user),
e.g.

  spamassassin -D -t < email.txt

You should see lines like:

[16429] dbg: dns: looking up PTR record for '150.51.53.1'
[16429] dbg: dns: PTR for '150.51.53.1': ''
[16429] dbg: received-header: parsed as [ ip=150.51.53.1
rdns=
helo=dmz.example.com by=internal.example.com ident= envfrom=
intl=0 id=
auth= ]
[16429] dbg: received-header: relay 150.51.53.1 trusted? yes
internal? yes

See <http://wiki.apache.org/spamassassin/TrustedRelays>
for more details.

-- 
Robert LeBlanc <rjlrenaissoft.com>
Renaissoft, Inc.
Maia Mailguard <http://www.maiamail
guard.com/>

_______________________________________________
Maia-users mailing list
Maia-usersrenaissoft.com
http://www.renaissoft.com/mailman/listinfo/maia-users