I have my spamassassin filter modifed so if it is recognized as spam it froze the message in the queue. Can you add diagnose for these kind of frozen messages eg: BLOCKED_BY_SPAMASSASSIN ?
Here is an example of SLOG:
CODE | 80.231.200.146:33685;192.168.10.10:25;Mon, 12 Jan 2004 23:45:19 +0100 me.homelinux.net S1376B MAIL FROM: <gbarrera_ji@acceso.or.cr> RCPT TO:<sasa@stupar.homelinux.net> <<MAIL-DATA>> Received: from localhost [127.0.0.1] by mig29 with SpamAssassin (2.61 1.212.2.1-2003-12-09-exp); Mon, 12 Jan 2004 23:45:25 +0100 From: "Gregorio Barrera" <gbarrera_ji@acceso.or.cr> To: sasa@stupar.homelinux.net Subject: [SPAM] hottest adult site Date: Tue, 13 Jan 2004 14:55:48 +0000 Message-Id: <CPLPDDFBCLFENMMMNIDABFEHBOAA.gbarrera_ji@acceso.or.cr> X-Spam-Checker-Version: SpamAssassin 2.61 (1.212.2.1-2003-12-09-exp) on mig29 X-Spam-Status: Yes, hits=5.9 required=5.0 tests=ADULT_SITE, DATE_IN_FUTURE_12_24,HOT_NASTY,HTML_MIME_NO_HTML_TAG,MIME_BASE64_TEXT, MIME_HTML_NO_CHARSET,MIME_HTML_ONLY autolearn=no version=2.61 X-Spam-Level: ***** X-Spam-Flag: YES MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----------=_40032385.ED30C050"
This is a multi-part message in MIME format.
------------=_40032385.ED30C050 Content-Type: text/plain Content-Disposition: inline Content-Transfer-Encoding: 8bit
Spam detection software, running on the system "mig29", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or block similar future email. If you have any questions, see the administrator of that system for details.
Content preview: Hey You must check out this Paris Hilton site its FREE and got her HOT video everyone is talking about come check her out here http://www.bestofthestarz.com/ its absolutely free [...]
Content analysis details: (5.9 points, 5.0 required)
pts rule name description ---- ---------------------- -------------------------------------------------- 0.2 ADULT_SITE BODY: Possible porn - Adult Web Sites 0.0 HOT_NASTY BODY: Possible porn - Hot, Nasty, Wild, Young 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 1.1 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding 0.7 MIME_HTML_NO_CHARSET RAW: Message text in HTML without charset 2.0 DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received: date 1.7 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
The original message was not completely plain text, and may be unsafe to open with some email clients; in particular, it may contain a virus, or confirm that your address can receive spam. If you wish to view it, it may be safer to save it to a file and open it with an editor.
------------=_40032385.ED30C050 Content-Type: message/rfc822; x-spam-type=original Content-Description: original message before SpamAssassin Content-Disposition: attachment Content-Transfer-Encoding: 8bit
X-AV-Scanned: yes 86fe9fe9b4eb60bf86c35cd108ec2ed5 Received: from advodata.be (80.231.200.146:33685) by me.homelinux.net (192.168.10.10:25) with [XMail 1.17 (Linux/Ix86) ESMTP Server] id <S1376B> for <sasa@stupar.homelinux.net> from <gbarrera_ji@acceso.or.cr>; Mon, 12 Jan 2004 23:45:19 +0100 Message-ID: <CPLPDDFBCLFENMMMNIDABFEHBOAA.gbarrera_ji@acceso.or.cr> From: "Gregorio Barrera" <gbarrera_ji@acceso.or.cr> To: sasa@stupar.homelinux.net Subject: hottest adult site Date: Tue, 13 Jan 2004 14:55:48 +0000 MIME-Version: 1.0 Content-Type: text/html Content-Transfer-Encoding: base64
SGV5DQogICAgWW91IG11c3QgY2hlY2sgb3V0IHRoaXMgUGFyaXMgSGlsdG9u IHNpdGUgaXRzIEZSRUUgYW5kIGdvdCBoZXIgSE9UIHZpZGVvIGV2ZXJ5b25l DQogICBpcyB0YWxraW5nIGFib3V0IGNvbWUgY2hlY2sgaGVyIG91dCBoZXJl IA0KICANCiAgIGh0dHA6Ly93d3cuYmVzdG9mdGhlc3RhcnouY29tLyAgICBp dHMgYWJzb2x1dGVseSBmcmVl
------------=_40032385.ED30C050-- |
|