<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
I am having a problem where it appears that MimeDefang does not
actually scan a very few spam emails, or at least it does not add
the appropriate headers and change the subject header. The result is
that there are no<b> </b><b>X-Spam-Status:</b> headers to indicate
that MimeDefang even found any spam characteristics<b>. </b>I
believe that something in the message being sent is preventing
MimeDefang from performing correctly.<br>
<br>
I have modified my mimedefang-filter as follows so that all emails
should have SpamAssassinReport.txt attached. All do except for a
very few. <br>
<br>
<br>
###############################################################################################################<br>
<br>
#####################################################################<br>
# Determine how to handle the email based on its spam
score and #<br>
# add an appropriate X-Spam-Status header and alter the
subject. #<br>
#####################################################################<br>
# Set required_hits in sa-mimedefang.cf to get value for
$req #<br>
#####################################################################<br>
if ($hits >= $req) {<br>
action_add_header("X-Spam-Status", "Spam,
score=$hits required=$req tests=$names");<br>
action_change_header("Subject", "****SPAM****
($hits) $Subject");<br>
md_graphdefang_log('spam', $hits, $RelayAddr);<br>
action_add_part($entity, "text/plain", "-suggest",
"$report\n", "SpamAssassinReport.txt", "inline");<br>
# action_discard();<br>
} elsif ($hits >= 6) {<br>
action_add_header("X-Spam-Status", "Probably,
score=$hits required=$req tests=$names");<br>
action_change_header("Subject", "****Probably
SPAM**** ($hits) $Subject");<br>
md_graphdefang_log('spam', $hits, $RelayAddr);<br>
action_add_part($entity, "text/plain", "-suggest",
"$report\n", "SpamAssassinReport.txt", "inline");<br>
} elsif ($hits >= 3) {<br>
action_add_header("X-Spam-Status", "Possibly,
score=$hits required=$req tests=$names");<br>
action_change_header("Subject", "****Possibly
SPAM**** ($hits) $Subject");<br>
md_graphdefang_log('spam', $hits, $RelayAddr);<br>
action_add_part($entity, "text/plain", "-suggest",
"$report\n", "SpamAssassinReport.txt", "inline");<br>
} elsif ($hits >= 0.00) {<br>
action_add_header("X-Spam-Status", "Probably not,
score=$hits required=$req tests=$names");<br>
md_graphdefang_log('spam', $hits, $RelayAddr);<br>
action_add_part($entity, "text/plain", "-suggest",
"$report\n", "SpamAssassinReport.txt", "inline");<br>
} else {<br>
# If score (hits) is less than or equal to 0<br>
action_add_header("X-Spam-Status", "No, score=$hits
required=$req tests=$names");<br>
md_graphdefang_log('spam', $hits, $RelayAddr);<br>
action_add_part($entity, "text/plain", "-suggest",
"$report\n", "SpamAssassinReport.txt", "inline");<br>
}<br>
<br>
###############################################################################################################<br>
<br>
The following header is from an email that did not have the expected
headers or SpamAssassinReport.txt:<br>
###############################################################################################################<br>
<pre>Return-Path: <a class="moz-txt-link-rfc2396E" href="mailto:support@lihko.us"><support@lihko.us></a>
Received: from lihko.us ([50.2.35.183])
by hornet.both.org (8.14.4/8.14.4) with ESMTP id t5MDXLuC025459
for <a class="moz-txt-link-rfc2396E" href="mailto:dboth@both.org"><dboth@both.org></a>; Mon, 22 Jun 2015 09:33:26 -0400
Subject: TermFinder can match you with term providers
From: "TopLifeProviders" <a class="moz-txt-link-rfc2396E" href="mailto:toplifeproviders@steak.lihko.us"><toplifeproviders@steak.lihko.us></a>
To: <a class="moz-txt-link-rfc2396E" href="mailto:dboth@both.org"><dboth@both.org></a>
Date: Mon, 22 Jun 2015 06:02:49 -0700
List-Unsubscribe: <a class="moz-txt-link-rfc2396E" href="mailto:unsubscribe@eyeopening.lihko.us"><mailto:unsubscribe@eyeopening.lihko.us></a>
Content-Type: multipart/related; boundary="69c5bfe25f6473ef_ba3896c800ae7ad5a"
MIME-Version: 1.0
Message-ID: <a class="moz-txt-link-rfc2396E" href="mailto:0.0.0.35.1D0ACEBC8BC70A4.1F7ABB@lihko.us"><0.0.0.35.1D0ACEBC8BC70A4.1F7ABB@lihko.us></a>
<b>X-Scanned-By: MIMEDefang 2.78 on 192.168.0.53</b>
--69c5bfe25f6473ef_ba3896c800ae7ad5a
Content-Type: multipart/alternative; boundary="69c5bfe25f6473ef_ba3896c800ae7ad5b"
--69c5bfe25f6473ef_ba3896c800ae7ad5b
Content-Type: text/plain; charset="utf8"
Content-Transfer-Encoding: 8-bit
Content-Disposition: inline
TermFinder can match you with term providers!
For the online version, please click the link below:
<a class="moz-txt-link-freetext" href="http://mauler.lihko.us/s/m/OTZ8NTR8Mjc0Ng,,/land/pZGJvdGhAYm90aC5vcmc=t/">http://mauler.lihko.us/s/m/OTZ8NTR8Mjc0Ng,,/land/pZGJvdGhAYm90aC5vcmc=t/</a>
Click this link to unsubscribe:
<a class="moz-txt-link-freetext" href="http://disposable.lihko.us/s/m/OTZ8NTR8Mjc0Ng,,/unsub/pZGJvdGhAYm90aC5vcmc=t/">http://disposable.lihko.us/s/m/OTZ8NTR8Mjc0Ng,,/unsub/pZGJvdGhAYm90aC5vcmc=t/</a>
--69c5bfe25f6473ef_ba3896c800ae7ad5b
Content-Type: text/html; charset="utf8"
Content-Transfer-Encoding: 8bit
Content-Disposition: inline</pre>
###############################################################################################################<br>
<br>
Good headers:<br>
###############################################################################################################<br>
<br>
<pre>Return-Path: <a class="moz-txt-link-rfc2396E" href="mailto:support@ceefn.us"><support@ceefn.us></a>
Received: from ceefn.us ([50.2.58.133])
by hornet.both.org (8.14.4/8.14.4) with ESMTP id t5OBSdfL007496
for <a class="moz-txt-link-rfc2396E" href="mailto:dboth@both.org"><dboth@both.org></a>; Wed, 24 Jun 2015 07:28:43 -0400
Subject: ****SPAM**** (80.343) Summer WindowSpecials on Pella, Andersen, Marvin & more
From: "Summer-Window-Plans" <a class="moz-txt-link-rfc2396E" href="mailto:summer-window-plans@axes.ceefn.us"><summer-window-plans@axes.ceefn.us></a>
To: <a class="moz-txt-link-rfc2396E" href="mailto:dboth@both.org"><dboth@both.org></a>
Date: Wed, 24 Jun 2015 04:01:53 -0700
List-Unsubscribe: <a class="moz-txt-link-rfc2396E" href="mailto:unsubscribe@exobiologist.ceefn.us"><mailto:unsubscribe@exobiologist.ceefn.us></a>
Content-Type: multipart/mixed; boundary="----------=_1435145369-2922-55"
MIME-Version: 1.0
Message-ID: <a class="moz-txt-link-rfc2396E" href="mailto:0.0.0.40.1D0AE6D3A5DF82C.1CE166@ceefn.us"><0.0.0.40.1D0AE6D3A5DF82C.1CE166@ceefn.us></a>
<b>X-Spam-Status: Spam, score=80.343 required=10.6 tests=BAYES_99,BAYES_999,CLICK_LINK_BELOW,HTML_MESSAGE,HTML_TAG_BALANCE_BODY,LIST_PARTIAL,LIST_UNSUBSCRIBE_1,MIME_BASE64_BLANKS,MPART_ALT_DIFF,ONLINE_VERSION,RCVD_IN_SBL_CSS,RDNS_NONE,URIBL_BLACK,URIBL_DBL_SPAM,URIBL_JP_SURBL</b>
Content-Transfer-Encoding: binary
<b>X-Scanned-By: MIMEDefang 2.78 on 192.168.0.53</b>
This is a multi-part message in MIME format...
------------=_1435145369-2922-55
Subject: Summer WindowSpecials on Pella, Andersen, Marvin & more
From: "Summer-Window-Plans" <a class="moz-txt-link-rfc2396E" href="mailto:summer-window-plans@axes.ceefn.us"><summer-window-plans@axes.ceefn.us></a>
To: <a class="moz-txt-link-rfc2396E" href="mailto:dboth@both.org"><dboth@both.org></a>
Date: Wed, 24 Jun 2015 04:01:53 -0700
List-Unsubscribe: <a class="moz-txt-link-rfc2396E" href="mailto:unsubscribe@exobiologist.ceefn.us"><mailto:unsubscribe@exobiologist.ceefn.us></a>
Content-Type: multipart/related; boundary="2b5a96654db3fecc_9a4ba919a3ce529ba"
MIME-Version: 1.0
Message-ID: <a class="moz-txt-link-rfc2396E" href="mailto:0.0.0.40.1D0AE6D3A5DF82C.1CE166@ceefn.us"><0.0.0.40.1D0AE6D3A5DF82C.1CE166@ceefn.us></a>
--2b5a96654db3fecc_9a4ba919a3ce529ba
Content-Type: multipart/alternative; boundary="2b5a96654db3fecc_9a4ba919a3ce529bb"
</pre>
<br>
<br>
###############################################################################################################<br>
<br>
I am looking for help as these spams are very annoying and are
getting much more frequent.<br>
<br>
Thanks in advance for any help.<br>
<pre class="moz-signature" cols="80">--
*********************************************************
David P. Both, RHCE
Millennium Technology Consulting LLC
Raleigh, NC, USA
919-389-8678
<a class="moz-txt-link-abbreviated" href="mailto:dboth@millennium-technology.com">dboth@millennium-technology.com</a>
<a class="moz-txt-link-abbreviated" href="http://www.millennium-technology.com">www.millennium-technology.com</a>
<a class="moz-txt-link-abbreviated" href="http://www.databook.bz">www.databook.bz</a> - Home of the DataBook for Linux
DataBook is a Registered Trademark of David Both
*********************************************************
This communication may be unlawfully collected and stored by the National
Security Agency (NSA) in secret. The parties to this email do not consent to the
retrieving or storing of this communication and any related metadata, as well as
printing, copying, re-transmitting, disseminating, or otherwise using it. If you
believe you have received this communication in error, please delete it
immediately.
</pre>
</body>
</html>