[Mimedefang] Strange behavior

[Kelson Vibber]

At 11:05 AM 9/30/2003, Shawn Button wrote:
>We have 1 Word document that, when sent internally from any user, is 
>flagged as
>spam and dumped. This is despite the whitelist, despite allowing .doc and 
>occurs
>whether the message itself is html or plain text. It appears from testing that
>the attachment is causing the issue. We have had other users send the 
>attachment
>and it discards it as well:

Does the word document have ".com" anywhere in the filename?  Say, 
"Whatever.com statistics.doc"?

>What could be making SA dump e-mails with this word document attached? Why is
>the whitelist apparently not being honored?

Are you certain it's SpamAssassin and not some other check, like 
filter_bad_filename?  Check your filter for all the places that it discards 
mail and add logging  - something like "md_graphdefang_log('Dropping 
because of xxxxx');" (see the man page for mimedefang-filter for more info) 
- so you know where the decision is being made to drop it.  And when 
SpamAssassin determines something is spam, make sure you log the value of 
$names so that you can see what rules the message tripped.

Also, remember that SpamAssassin's whitelist functions don't prevent 
scanning, they just subtract 100 from the final score.  So they won't have 
any effect on what MIMEDefang does or does not scan/drop/alter, except for 
making it extremely unlikely that SpamAssassin will identify the message as 
spam.


Kelson Vibber
SpeedGate Communications <www.speed.net>