[TriLUG] procmail/spamassasin question
jonc at nc.rr.com
Wed Oct 6 11:26:50 EDT 2004
On Wed, 2004-10-06 at 10:12, Jeremy Portzer wrote:
> On Wed, 2004-10-06 at 09:57, Brian Henning wrote:
> > Hi Folks,
> > Is there some certain set of circumstances that would cause spamc to
> > completely skip a message? Or is there a particular set of circumstances
> > where spamc won't make any marks on a message? I was expecting that spamc
> > would make a mark on all messages it examined, either to say X-Spam-Status:
> > Yes or X-Spam-Status: No... More and more spam is slipping through lately
> > (which is to be expected, I suppose), but a lot of it has no sa headers at
> > all, which almost suggests it's not getting scanned. Here's the juicy bits
> > of my /etc/procmailrc file; maybe someone will see something wrong with it?
> Sometimes spamc/spamd itself will refuse to scan a message, and return
> it to procmail without adding the headers. This could be due to large
> size; huge messages are sometimes skipped because it can really bog-down
> the pattern-matching within spamd. I think there is a setting for this
> in /etc/mail/spamassasin/local.cf, but a quick look through perldoc
> Mail::SpamAssasin:Conf isn't revealing it, so maybe I'm hallucinating.
> Also make sure you don't have any other settings that might be causing
> the headers not to be set -- there are a lot of options on what to do
> with the headers.
Jeremy is not hallucinating. Large emails are skipped.
Also a lot of spam these days is encoded in a gif - so it looks like a
real message, but its simply an image. I don't think spam assassin is
doing too good a job against that currently.
More information about the TriLUG