spamassassin-dev December 2011 archive
Main Archive Page > Month Archives  > spamassassin-dev archives
spamassassin-dev: Re: No RP_MATCHES_RCVD at reception time, lots

Re: No RP_MATCHES_RCVD at reception time, lots in masscheck

From: Kevin A. McGrail <KMcGrail_at_nospam>
Date: Thu Dec 22 2011 - 11:59:15 GMT

How are you calling SA? One theory that might cause your issue is to use a milter that might be syntheisizing the mbox format prior to your MTA actually adding the real received and From delimiter.
KAM wrote:

People on the users list are complaining about getting lots of false
negatives due to RP_MATCHES_RCVD. RuleQA doesn't say particularly good
things about its rank or score:

Neither of those things really concern me, because I know the reasons for
score selection can be complicated.

What does concern me is that ruleqa says 29% of my ham hits it, but *none*
of my ham actually has a hit on that rule in my mailboxes. It's only
showing up in masscheck, not when I get the mail, and not when I manually
re-run spamassassin on an email that masscheck says hit it.

The latest example that masscheck says hit this rule:

As far as I can tell, that email should hit RP_MATCHES_RCVD. Because these
have the same domain:

Return-Path: <>
Received: from ( [])

I'm running trunk synced about a month ago.

This is the output of running "spamassassin -tD" on it, so you can see it's
loading Mail::SpamAssassin::Plugin::WLBLEval:

Any idea why I'm not getting hits on this rule when I run it manually, but
am getting lots of hits via masscheck?

-- "I don't want people who want to dance, I want people who have to dance." --George Balanchine