spamassassin-dev December 2011 archive
Main Archive Page > Month Archives  > spamassassin-dev archives
spamassassin-dev: Re: No RP_MATCHES_RCVD at reception time, lots

Re: No RP_MATCHES_RCVD at reception time, lots in masscheck

From: <darxus_at_nospam>
Date: Thu Dec 22 2011 - 15:14:50 GMT
To: dev@spamassassin.apache.org

>From my bash history:

spamassassin -tD < missing_RP_MATCHES_RCVD.txt > missing_RP_MATCHES_RCVD_output.txt 2>&1

On 12/22, Kevin A. McGrail wrote:
> How are you calling SA? One theory that might cause your issue is to use a
> milter that might be syntheisizing the mbox format prior to your MTA
> actually adding the real received and From delimiter.
> Regards,
> KAM
>
> darxus@chaosreigns.com wrote:
>
> People on the users list are complaining about getting lots of false
> negatives due to RP_MATCHES_RCVD. RuleQA doesn't say particularly good
> things about its rank or score:
> [1]http://ruleqa.spamassassin.org/20111217/RP_MATCHES_RCVD/detail
>
> Neither of those things really concern me, because I know the reasons for
> score selection can be complicated.
>
> What does concern me is that ruleqa says 29% of my ham hits it, but *none*
> of my ham actually has a hit on that rule in my mailboxes. It's only
> showing up in masscheck, not when I get the mail, and not when I manually
> re-run spamassassin on an email that masscheck says hit it.
>
> The latest example that masscheck says hit this rule:
> [2]http://www.chaosreigns.com/sa/missing_RP_MATCHES_RCVD.txt
>
> As far as I can tell, that email should hit RP_MATCHES_RCVD. Because these
> have the same domain:
>
> Return-Path: <sandrakoroma@anyemails.com>
> Received: from [3]anyemails.yesup.com ([4]mail.anyemails.com [[5]199.21.148.38])
>
> I'm running trunk synced about a month ago.
>
> This is the output of running "spamassassin -tD" on it, so you can see it's
> loading Mail::SpamAssassin::Plugin::WLBLEval:
> [6]http://www.chaosreigns.com/sa/missing_RP_MATCHES_RCVD_output.txt
>
> Any idea why I'm not getting hits on this rule when I run it manually, but
> am getting lots of hits via masscheck?
>
> --
> "I d!
> on't
> want people who want to dance, I want people who have to dance."
> --George Balanchine
> [7]http://www.ChaosReigns.com
>
> References
>
> Visible links
> 1. http://ruleqa.spamassassin.org/20111217/RP_MATCHES_RCVD/detail
> 2. http://www.chaosreigns.com/sa/missing_RP_MATCHES_RCVD.txt
> 3. http://anyemails.yesup.com/
> 4. http://mail.anyemails.com/
> 5. http://199.21.148.38/
> 6. http://www.chaosreigns.com/sa/missing_RP_MATCHES_RCVD_output.txt
> 7. http://www.chaosreigns.com/

-- "A ship in a port is safe, but that's not what ships are built for." -Grace Murray Hopper http://www.ChaosReigns.com