Админю два своих сервера Centos 6.10 c VestaCP на борту. Оперативы стоит 1GB + SWAP на 4ГБ.
Подключил Spamassassin и на первом всё работает нормально, все письма проходят проверку, а на втором половина явного спама проходит проверку, а половина – нет (тупо нет заголовков Spamassassin), но когда запускаю проверку на такое письмо через ssh spamassassin -D < test-message.txt
оно показывает что score 14 из 3 required – т.е. явный спам.
Вопрос следующий – почему spamassassin не считывает все письма?
Конфиг spamassassin (local.cf):
required_hits 3
report_safe 0
ok_locales en ru
rewrite_header Subject [SPAM]
add_header spam Flag _YESNOCAPS_
add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_ autolearn=_AUTOLEARN_ version=_VERSION_
add_header all Level _STARS(*)_
add_header all Checker-Version SpamAssassin _VERSION_ (_SUBVERSION_) on _HOSTNAME_
use_learner 0
use_auto_whitelist 0
use_bayes 1
use_bayes_rules 1
bayes_auto_learn 0
bayes_auto_expire 0
Конфиг Exim
######################################################################
# #
# Exim configuration file for Vesta Control Panel #
# #
######################################################################
SPAMASSASSIN = yes SPAM_SCORE = 10
#CLAMD = yes
disable_ipv6=true domainlist local_domains = dsearch;/etc/exim/domains/ domainlist relay_to_domains = dsearch;/etc/exim/domains/ hostlist relay_from_hosts = 127.0.0.1 hostlist whitelist = net-iplsearch;/etc/exim/white-blocks.conf hostlist spammers = net-iplsearch;/etc/exim/spam-blocks.conf no_local_from_check untrusted_set_sender = * acl_smtp_connect = acl_check_spammers acl_smtp_mail = acl_check_mail acl_smtp_rcpt = acl_check_rcpt acl_smtp_data = acl_check_data acl_smtp_mime = acl_check_mime
.ifdef SPAMASSASSIN spamd_address = 127.0.0.1 783 .endif
.ifdef CLAMD av_scanner = clamd: /var/run/clamav/clamd.sock .endif
tls_advertise_hosts = * tls_certificate = /usr/local/vesta/ssl/certificate.crt tls_privatekey = /usr/local/vesta/ssl/certificate.key
daemon_smtp_ports = 25 : 465 : 587 : 2525 tls_on_connect_ports = 465 never_users = root host_lookup = * rfc1413_hosts = * rfc1413_query_timeout = 5s ignore_bounce_errors_after = 2d timeout_frozen_after = 7d
DKIM_DOMAIN = ${lc:${domain:$h_from:}} DKIM_FILE = /etc/exim/domains/${lc:${domain:$h_from:}}/dkim.pem DKIM_PRIVATE_KEY = ${if exists{DKIM_FILE}{DKIM_FILE}{0}}
######################################################################
# ACL CONFIGURATION #
# Specifies access control lists for incoming SMTP mail #
###################################################################### begin acl
acl_check_spammers: accept hosts = +whitelist
drop message = Your host in blacklist on this server.
log_message = Host in blacklist
hosts = +spammers
accept
acl_check_mail: deny condition = ${if eq{$sender_helo_name}{}}
message = HELO required before MAIL
drop message = Helo name contains a ip address (HELO was $sender_helo_name) and not is valid
condition = ${if match{$sender_helo_name}{\N((\d{1,3}[.-]\d{1,3}[.-]\d{1,3}[.-]\d{1,3})|([0-9a-f]{8})|([0-9A-F]{8}))\N}{yes}{no}}
condition = ${if match {${lookup dnsdb{>: defer_never,ptr=$sender_host_address}}\}{$sender_helo_name}{no}{yes}}
delay = 45s
drop condition = ${if isip{$sender_helo_name}}
message = Access denied - Invalid HELO name (See RFC2821 4.1.3)
drop condition = ${if eq{[$interface_address]}{$sender_helo_name}}
message = $interface_address is _my_ address
accept
acl_check_rcpt: accept hosts = :
deny message = Restricted characters in address
domains = +local_domains
local_parts = ^[.] : ^.*[@%!/|]
deny message = Restricted characters in address
domains = !+local_domains
local_parts = ^[./|] : ^.*[@%!] : ^.*/\\.\\./
require verify = sender
accept hosts = +relay_from_hosts
control = submission
accept authenticated = *
control = submission/domain=
deny message = Rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text
hosts = !+whitelist
dnslists = ${readfile {/etc/exim/dnsbl.conf}{:}}
require message = relay not permitted
domains = +local_domains : +relay_to_domains
deny message = smtp auth requried
sender_domains = +local_domains
!authenticated = *
require verify = recipient
.ifdef CLAMD warn set acl_m0 = no
warn condition = ${if exists {/etc/exim/domains/$domain/antivirus}{yes}{no}}
set acl_m0 = yes .endif
.ifdef SPAMASSASSIN warn set acl_m1 = no
warn condition = ${if exists {/etc/exim/domains/$domain/antispam}{yes}{no}}
set acl_m1 = yes .endif
accept
acl_check_data: .ifdef CLAMD deny message = Message contains a virus ($malware_name) and has been rejected
malware = *
condition = ${if eq{$acl_m0}{yes}{yes}{no}} .endif
.ifdef SPAMASSASSIN warn !authenticated = *
hosts = !+relay_from_hosts
condition = ${if < {$message_size}{100K}}
condition = ${if eq{$acl_m1}{yes}{yes}{no}}
spam = nobody:true/defer_ok
add_header = X-Spam-Score: $spam_score_int
add_header = X-Spam-Bar: $spam_bar
add_header = X-Spam-Report: $spam_report
set acl_m2 = $spam_score_int
warn condition = ${if !eq{$acl_m2}{} {yes}{no}}
condition = ${if >{$acl_m2}{SPAM_SCORE} {yes}{no}}
add_header = X-Spam-Status: Yes
message = SpamAssassin detected spam (from $sender_address to $recipients). .endif
accept
acl_check_mime: deny message = Blacklisted file extension detected
condition = ${if match {${lc:$mime_filename}}{\N(\.ade|\.adp|\.bat|\.chm|\.cmd|\.com|\.cpl|\.exe|\.hta|\.ins|\.isp|\.jse|\.lib|\.lnk|\.mde|\.msc|\.msp|\.mst|\.pif|\.scr|\.sct|\.shb|\.sys|\.vb|\.vbe|\.vbs|\.vxd|\.wsc|\.wsf|\.wsh)$\N}{1}{0}}
accept
######################################################################
# AUTHENTICATION CONFIGURATION #
###################################################################### begin authenticators
dovecot_plain: driver = dovecot public_name = PLAIN server_socket = /var/run/dovecot/auth-client server_set_id = $auth1
dovecot_login: driver = dovecot public_name = LOGIN server_socket = /var/run/dovecot/auth-client server_set_id = $auth1
######################################################################
# ROUTERS CONFIGURATION #
# Specifies how addresses are handled #
###################################################################### begin routers
#smarthost:
# driver = manualroute
# domains = ! +local_domains
# transport = remote_smtp
# route_list = * smartrelay.vestacp.com
# no_more
# no_verify
dnslookup: driver = dnslookup domains = !+local_domains transport = remote_smtp no_more
userforward: driver = redirect check_local_user file = $home/.forward allow_filter no_verify no_expn check_ancestor file_transport = address_file pipe_transport = address_pipe reply_transport = address_reply
procmail: driver = accept check_local_user require_files = ${local_part}:+${home}/.procmailrc:/usr/bin/procmail transport = procmail no_verify
autoreplay: driver = accept require_files = /etc/exim/domains/$domain/autoreply.${local_part}.msg condition = ${if exists{/etc/exim/domains/$domain/autoreply.${local_part}.msg}{yes}{no}} retry_use_local_part transport = userautoreply unseen
aliases: driver = redirect headers_add = X-redirected: yes data
= ${extract{1}{:}{${lookup{$local_part@$domain}lsearch{/etc/exim/domains/$domain/aliases}}}} require_files = /etc/exim/domains/$domain/aliases redirect_router = dnslookup pipe_transport = address_pipe unseen
localuser_fwd_only: driver = accept transport = devnull condition = ${if exists{/etc/exim/domains/$domain/fwd_only}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/fwd_only}{true}{false}}}}
localuser_spam: driver = accept transport = local_spam_delivery condition = ${if eq {${if match{$h_X-Spam-Status:}{\N^Yes\N}{yes}{no}}} {${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}{yes}{no_such_user}}}}
localuser: driver = accept transport = local_delivery condition
= ${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}{true}{false}}
catchall: driver = redirect headers_add = X-redirected: yes require_files = /etc/exim/domains/$domain/aliases data = ${extract{1}{:}{${lookup{*@$domain}lsearch{/etc/exim/domains/$domain/aliases}}}} file_transport = local_delivery redirect_router = dnslookup
terminate_alias: driver = accept transport = devnull condition = ${lookup{$local_part@$domain}lsearch{/etc/exim/domains/$domain/aliases}{true}{false}}
######################################################################
# TRANSPORTS CONFIGURATION #
###################################################################### begin transports
remote_smtp: driver = smtp #helo_data = $sender_address_domain dkim_domain = DKIM_DOMAIN dkim_selector = mail dkim_private_key = DKIM_PRIVATE_KEY dkim_canon = relaxed dkim_strict = 0
procmail: driver = pipe command = "/usr/bin/procmail -d $local_part" return_path_add delivery_date_add envelope_to_add user = $local_part initgroups return_output
local_delivery: driver = appendfile maildir_format maildir_use_size_file user = ${extract{2}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}} group = mail create_directory directory_mode = 770 mode = 660 use_lockfile = no delivery_date_add envelope_to_add return_path_add directory = "${extract{5}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}}/mail/$domain/$local_part" quota = ${extract{6}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}}M quota_warn_threshold = 75%
local_spam_delivery: driver = appendfile maildir_format maildir_use_size_file user = ${extract{2}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}} group = mail create_directory directory_mode = 770 mode = 660 use_lockfile = no delivery_date_add envelope_to_add return_path_add directory = "${extract{5}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}}/mail/$domain/$local_part/.Spam" quota = ${extract{6}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}}M quota_directory = "${extract{5}{:}{${lookup{$local_part}lsearch{/etc/exim/domains/$domain/passwd}}}}/mail/$domain/$local_part" quota_warn_threshold = 75%
address_pipe: driver = pipe return_output
address_file: driver = appendfile delivery_date_add envelope_to_add return_path_add
address_reply: driver = autoreply
userautoreply: driver = autoreply file = /etc/exim/domains/$domain/autoreply.${local_part}.msg from = "${local_part}@${domain}" headers = Content-Type: text/plain; charset=utf-8;\nContent-Transfer-Encoding: 8bit subject = "${if def:h_Subject: {Autoreply: \"${rfc2047:$h_Subject:}\"} {Autoreply Message}}" to = "${sender_address}"
devnull: driver = appendfile file = /dev/null
######################################################################
# RETRY CONFIGURATION #
###################################################################### begin retry
# Address or Domain Error Retries
# ----------------- ----- -------
* * F,2h,15m; G,16h,1h,1.5; F,4d,6h
######################################################################
# REWRITE CONFIGURATION #
###################################################################### begin rewrite
######################################################################
Заголовки письма которое считало:
Return-path: <[email protected]>
Envelope-to: [email protected]
Delivery-date: Wed, 13 Mar 2019 09:46:41 +0200
Received: from mail44.em3.n.mlgn2ca.com ([80.233.244.44])
by server.myserver.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
(Exim 4.91)
(envelope-from <[email protected]>)
id 1h3yas-0003GM-KA
for [email protected]; Wed, 13 Mar 2019 09:46:41 +0200
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=s3o18; d=mlgn2ca.com;
h=Date:To:From:Reply-to:Subject:Message-ID:List-Unsubscribe:Sender:List-id:MIME-Version:Content-Type; [email protected];
bh=y6ODlLrCRV9qpTdyxqFIUGwKFrtvZg+NIE1VEGLcY4U=;
b=l3kILPFNpLzMT61iAQKXgEYQzPhTKIdHYBMd1CnbVDfaOAB6pkaDczoj5YgdxHDTMLYnb1RIcxIZ
OTuwxvFcxWXdsHH2Fj7TsMCGYmgDnNSksixYrKgOEin9CtYhqRBQehgKgceIXIpAQzkacWH/kclW
7mAqHvM7H3GMqaImVAdoH9mk+reN+FIvHntFKv6FeGEoeyfzl2l+Yw0Qc4WB6UpiNEMjsJRsvriM
sN7dnfboOqWih2VpZVg+DDpi4gOgTrX0o1GFZBRRNNE4rHd9HdDBI+KIun7XzQiIVLejWQoFt2it
1fmOwq8AGK62orhn2kxCGTf2vfCeCVcLGNQYxg==
Received: by mail44.em3.n.mlgn2ca.com id hh2qlc28kv88 for <[email protected]>; Wed, 13 Mar 2019 09:45:56 +0200 (envelope-from <[email protected]>)
Date: Wed, 13 Mar 2019 09:45:42 +0200
To: [email protected]
From: =?utf-8?B?0JLRi9GB0YLQsNCy0LrQsCBDUFM=?= <[email protected]>
Reply-to: =?utf-8?B?0JLRi9GB0YLQsNCy0LrQsCBDUFM=?= <[email protected]>
Subject: =?utf-8?B?0J/RgNC+0LPRgNCw0LzQvNCwINCy0YvRgdGC0LDQstC60LggQ1BTIDIwMTk=?=
Message-ID: <[email protected]>
X-Priority: 3
X-Mailer: Mailigen Mailer - **CID530f49b6f2749e77**
X-Campaign: mailigen1a742220b1040be5bcb716e1e17a3b92.530f49b6
X-campaignid: mailigen1a742220b1040be5bcb716e1e17a3b92.530f49b6
X-Report-Abuse: Please report abuse for this campaign here: http://list.mlgn2ca.com/abuse/?u=1a742220b1040be5bcb716e1e17a3b92&id=530f49b6&e=f2749e77
List-Unsubscribe: <mailto:[email protected]?subject=unsubscribe;1a742220b1040be5bcb716e1e17a3b92-530f49b6-f2749e77>, <http://list.mlgn2ca.com/unsubscribe?u=1a742220b1040be5bcb716e1e17a3b92&id=8539a322&e=f2749e77&c=530f49b6>
Sender: "=?utf-8?B?0JLRi9GB0YLQsNCy0LrQsCBDUFM=?=" <[email protected]>
Precedence: bulk
Feedback-ID: 1a742220b1040be5bcb716e1e17a3b92:530f49b6:f2749e77:mailigen
X-Feedback-ID: 1a742220b1040be5bcb716e1e17a3b92:530f49b6:f2749e77:mailigen
X-Postmaster-MsgType: 530f49b6
List-id: 530f49b6
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="b1_e1109ce545fb7e40f309b1d7c9d2ef82"
X-Spam-Score: 118
X-Spam-Bar: +++++++++++
X-Spam-Report: Spam detection software, running on the system "server.myserver.com", has
identified this incoming email as possible spam. The original message
has been attached to this so you can view it (if it isn't spam) or label
similar future email. If you have any questions, see
the administrator of that system for details.
Content preview: Мы выходим на финишную прямую подготовки
нашей выставки CPS-2019 (Http://cps-expo.ru) (Http://cps-expo.ru),
которая состоится ровно через две недели,
27-29 марта на территории Киностудии "АМЕДИА".
Программа на сайте обновлена практически
полностью, подробности на подходе. Главное,
не забудьте зарегистрироваться на сайте
(http://cps-expo.ru) выставки уже сейчас. (http://discountfoto.ru/)
[...]
Content analysis details: (11.8 points, 3.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no
trust
[80.233.244.44 listed in list.dnswl.org]
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.
See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information.
[URIs: cps-expo.ru]
1.6 SUBJ_ALL_CAPS Subject is all capitals
-0.4 RCVD_IN_IADB_LISTED RBL: Participates in the IADB system
[80.233.244.44 listed in iadb.isipp.com]
-0.2 RCVD_IN_IADB_RDNS RBL: IADB: Sender has reverse DNS record
-0.0 RCVD_IN_IADB_DOPTIN_LT50 RBL: IADB: Confirmed opt-in used less than
50% of the time
-2.2 RCVD_IN_IADB_VOUCHED RBL: ISIPP IADB lists as vouched-for sender
-0.0 RCVD_IN_IADB_SPF RBL: IADB: Sender publishes SPF record
-0.0 RCVD_IN_IADB_SENDERID RBL: IADB: Sender publishes Sender ID record
-0.2 RCVD_IN_IADB_DK RBL: IADB: Sender publishes Domain Keys record
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list
manager
0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily
7.0 RU_WENTOR_PHONE RU_WENTOR_PHONE
7.0 RU_WENTOR_RASSILKA RU_WENTOR_RASSILKA
X-Spam-Status: Yes
X-ACL-Warn: SpamAssassin detected spam (from [email protected] to [email protected]).
Пример письма которое не считало:
Return-path: <[email protected]>
Envelope-to: [email protected]
Delivery-date: Wed, 13 Mar 2019 11:37:05 +0200
Received: from mail.intestell.co.ua ([176.9.103.48])
by server.myserver.com with esmtp (Exim 4.91)
(envelope-from <[email protected]>)
id 1h40Jt-0005E0-5j
for [email protected]; Wed, 13 Mar 2019 11:37:05 +0200
Received: from intestell.co.ua (unknown [195.216.190.7])
by mail.intestell.co.ua (Postfix) with ESMTPA id 9D9892A01035;
Wed, 13 Mar 2019 11:33:54 +0200 (EET)
Message-ID: <f1f001d4d990$a740d930$a247989c@ovvewcc>
From: "=?windows-1251?B?wS/OIMLl8O7t6OrgLiDO5OXx8erg/yDu4esu?=" <[email protected]>
To: <[email protected]>
Subject: =?windows-1251?B?1+XsIPDg7fz45SDy5ewg5OX45eLr5S4=?=
Date: Wed, 13 Mar 2019 11:34:00 +0200
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----=_NextPart_000_0006_01D4D98F.AD0120B0"
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Live Mail 14.0.8117.416
X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8117.416
Затем сохраняю данное письмо в файл и через ssh запускаю проверку и показывает:
Mar 13 12:23:44.520 [23577] dbg: rules: compiled meta tests
Mar 13 12:23:44.521 [23577] dbg: check: is spam? score=14.94 required=3
Mar 13 12:23:44.521 [23577] dbg: check: tests=FROM_EXCESS_BASE64,HTML_IMAGE_ONLY_20,HTML_IMAGE_RATIO_02,HTML_MESSAGE,HTML_SHORT_LINK_IMG_3,RCVD_IN_DNSWL_NONE,RU_WENTOR_2GT,RU_WENTOR_PHONE,URIBL_BLOCKED
Mar 13 12:23:44.521 [23577] dbg: check: subtests=__ANY_IMAGE_ATTACH,__ANY_TEXT_ATTACH,__ANY_TEXT_ATTACH_DOC,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__BODY_TEXT_LINE,__CT,__CTYPE_HAS_BOUNDARY,__CTYPE_MULTIPART_ALT,__CTYPE_MULTIPART_ANY,__DC_IMG_HTML_RATIO,__DC_IMG_TEXT_RATIO,__DKIM_DEPENDABLE,__DOS_HAS_ANY_URI,__DOS_RCVD_WED,__DOS_RELAYED_EXT,__ENV_AND_HDR_FROM_MATCH,__FB_NUM_PERCNT,__FROM_ENCODED_B64,__FROM_FULL_NAME,__HAS_ANY_EMAIL,__HAS_ANY_URI,__HAS_DATE,__HAS_FROM,__HAS_MESSAGE_ID,__HAS_MIMEOLE,__HAS_MSGID,__HAS_MSMAIL_PRI,__HAS_RCVD,__HAS_SUBJECT,__HAS_TO,__HAS_URI,__HAS_XMAIL,__HAS_X_MAILER,__HIGHBITS,__HTML_IMG_ONLY,__HTML_LENGTH_1536_2048,__HTML_LINK_IMAGE,__IMG_LE_300K,__JPEG_ATTACH,__JPEG_ATTACH_1,__LAST_EXTERNAL_RELAY_NO_AUTH,__LAST_UNTRUSTED_RELAY_NO_AUTH,__LCL__ENV_AND_HDR_FROM_MATCH,__LOCAL_PP_NONPPURL,__L_BODY_8BITS,__MIMEOLE_MS,__MIME_BASE64,__MIME_HTML,__MIME_QP,__MIME_VERSION,__MISSING_REF,__MISSING_REPLY,__MSGID_DOLLARS_MAYBE,__MSGID_DOLLARS_OK,__MSGID_NOFQDN2,__MSGID_OK_HEX,__MSGID_OK_HOST,__MSGID_RANDY,__NONEMPTY_BODY,__OE_MSGID_2,__ONE_IMG,__RCD_RDNS_MAIL,__RCD_RDNS_MAIL_MESSY,__RCVD_IN_DNSWL,__RP_MATCHES_RCVD,__RU_WENTOR_PHONE_KOI8,__RU_WENTOR_PHONE_UTF8,__RU_WENTOR_PHONE_WIN1251,__RU_WENTOR_RCPTS,__SANE_MSGID,__SA_RUS_HLINK,__SUBJECT_ENCODED_B64,__SUBJ_NOT_SHORT,__TAG_EXISTS_BODY,__TAG_EXISTS_HEAD,__TAG_EXISTS_HTML,__TAG_EXISTS_META,__TOCC_EXISTS,__TO___LOWER,__TVD_MIME_ATT_TP,__URI_MAILTO
Mar 13 12:23:44.522 [23577] dbg: timing: total 6466 ms - init: 4879 (75.5%), parse: 10 (0.2%), extract_message_metadata: 62 (1.0%), poll_dns_idle: 0.91 (0.0%), get_uri_detail_list: 2 (0.0%), tests_pri_-1000: 28 (0.4%), compile_gen: 553 (8.5%), compile_eval: 22 (0.3%), tests_pri_-950: 7 (0.1%), tests_pri_-900: 8 (0.1%), tests_pri_-90: 5 (0.1%), tests_pri_0: 1322 (20.4%), dkim_load_modules: 59 (0.9%), check_dkim_signature: 7 (0.1%), check_dkim_adsp: 4 (0.1%), check_spf: 1.51 (0.0%), tests_pri_10: 7 (0.1%), check_dcc: 0.61 (0.0%), tests_pri_20: 7 (0.1%), tests_pri_30: 6 (0.1%), check_pyzor: 0.29 (0.0%), tests_pri_500: 89 (1.4%), tests_pri_1000: 6 (0.1%)
Return-path: <[email protected]>
X-Spam-Report:
* -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no
* trust
* [176.9.103.48 listed in list.dnswl.org]
* 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.
* See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
* for more information.
* [URIs: veronika.in.ua]
* 0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words
* 0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 6.0 RU_WENTOR_2GT RAW: RU_WENTOR_2GT
* 0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image
* 0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily
* 7.0 RU_WENTOR_PHONE RU_WENTOR_PHONE
X-Spam-Flag: YES
X-Spam-Status: Yes, score=14.9 required=3.0 tests=FROM_EXCESS_BASE64,
HTML_IMAGE_ONLY_20,HTML_IMAGE_RATIO_02,HTML_MESSAGE,HTML_SHORT_LINK_IMG_3,
RCVD_IN_DNSWL_NONE,RU_WENTOR_2GT,RU_WENTOR_PHONE,URIBL_BLOCKED
autolearn=disabled version=3.3.1
X-Spam-Level: **************
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on server.myserver.com
Envelope-to: [email protected]
Delivery-date: Wed, 13 Mar 2019 11:37:05 +0200
Received: from mail.intestell.co.ua ([176.9.103.48])
by server.myserver.com with esmtp (Exim 4.91)
(envelope-from <[email protected]>)
id 1h40Jt-0005E0-5j
for [email protected]; Wed, 13 Mar 2019 11:37:05 +0200
Received: from intestell.co.ua (unknown [195.216.190.7])
by mail.intestell.co.ua (Postfix) with ESMTPA id 9D9892A01035;
Wed, 13 Mar 2019 11:33:54 +0200 (EET)
Message-ID: <f1f001d4d990$a740d930$a247989c@ovvewcc>
From: "=?windows-1251?B?wS/OIMLl8O7t6OrgLiDO5OXx8erg/yDu4esu?=" <[email protected]>
To: <[email protected]>
Subject: [SPAM] =?windows-1251?B?1+XsIPDg7fz45SDy5ewg5OX45eLr5S4=?=
Date: Wed, 13 Mar 2019 11:34:00 +0200
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----=_NextPart_000_0006_01D4D98F.AD0120B0"
X-MSMail-Priority: Normal
X-Mailer: Microsoft Windows Live Mail 14.0.8117.416
X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8117.416
X-Spam-Prev-Subject: =?windows-1251?B?1+XsIPDg7fz45SDy5ewg5OX45eLr5S4=?=
This is a multi-part message in MIME format.
------=_NextPart_000_0006_01D4D98F.AD0120B0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0007_01D4D98F.AD0120B0"
------=_NextPart_000_0007_01D4D98F.AD0120B0
Content-Type: text/plain;
charset="windows-1251"
Content-Transfer-Encoding: quoted-printable
Исходя из всего этого, как я понимаю, правила настроены верно, но почему spamassasin не выставляет свои заголовки в каждое письмо? Явные же спам, даже сам понимает. Если нужны дополнительные логи – обязательно приведу.