SpamAssassin and QMail-Scanner headers

[jsimarro]

Hello,

I have a problem with SA / QMail-Scanner. Messages are not filtered through qmail-scanner, so I am receiving all the spam over a determined score.

I have noted that headers of an email received used to show the following before the problem:

------------------------------
Received: from xxx.2.xxx.6 by server.mydomain.com (envelope-from <[email protected]>, uid 2020) with qmail-scanner-2.01st
(clamdscan: 0.88.6/3272. spamassassin: 3.0.6. perlscan: 2.01st.
Clear:RC:0(xxx.212.xxx.58):SA:0(2.0/5.0):.
Processed in 1.301765 secs); 21 May 2007 11:44:03 -0000
------------------------------

And now it shows this:

------------------------------
Received: from xxx.2.xxx.6 by server.mydomain.com (envelope-from <[email protected]>, uid 2020) with qmail-scanner-2.01st
(clamdscan: 0.88.6/5024. spamassassin: 3.0.6. perlscan: 2.01st.
Clear:RC:1(xxx.212.xxx.58):.
Processed in 0.022646 secs); 07 Dec 2007 18:35:43 -0000
------------------------------

What happened, and what is disabled?

Regards,

 

[ib1984]

It doesn't look like headers which spamassassin puts into headers. If you are using 4PSA antivirus/antispam products, then I think you better check this with them.

 

[jsimarro]

But I don't use 4PSA, just Plesk.

 

[ib1984]

qmail-scanner is not a part of Plesk AFAIK... never had any expirience with it... maybe someone in thirdparty forum had... try asking there.

 

[atomicturtle]

Is that using my rpm, or a custom build? Normally you get that if its running through localhost or some other whitelist that skips the content scanners.

 

[jsimarro]

I don't remember if it was your distribution (how could I check it?). But although the server is scanning spamassassin for every message, it is only filtering through QMail-Scanner for local outgoing messages:

Received: from 89.129.xxx.xxx by myserver.mydomain.com (envelope-from <[email protected]>, uid 2020) with qmail-scanner-2.01st
(clamdscan: 0.88.6/5066. spamassassin: 3.0.6. perlscan: 2.01st.
Clear:RC:0(89.129.xxx.xxx):SA:0(-100.0/5.0):.

Received: from 209.85.xxx.xxx by myserver.mydomain.com (envelope-from <[email protected]>, uid 2020) with qmail-scanner-2.01st
(clamdscan: 0.88.6/5066. spamassassin: 3.0.6. perlscan: 2.01st.
Clear:RC:0(209.85.xxx.xxx):.

This is crazy, ...

I am using some whitelist domains, but all they are through local.cf. I am not using whitelist servers. In fact, I prefer to use blacklists, so I have RBLs at 'smtp_psa' file, and use a 'submission' file/port (587).