Problems with Spamassassin

[iyeat]

Greetings,

I'm having trouble with my spamassassin configuration...

One of my clients just upgraded their internet connection, and suddenly they've starting having their inter-office email returned or marked as spam by our mail server.

Here is an example of the headers from an email that was marked as spam. It appears that the problem is that spamassassin is recognizing their IPs as dynamic IP addresses even though they are static.

However, I don't believe that this is correct behavior, even for dynamic addresses... lowering the spam score, also, would unleash a flood of spam to all of my users (I have already tried this).

Additionally, of about 20 active email domains on this box, this is the only domain having issues.

Does anyone have any thoughts?

Thanks!

Caio

From: Julie Bigford <julie@schoolvideos.com>
Date: September 16, 2008 3:30:42 PM PDT
To: Anthony Sarti <anthony@schoolvideos.com>
Subject: SPAM > Yo
Return-Path: <julie@schoolvideos.com>
X-Original-To: anthony@schoolvideos.com
Delivered-To: anthony@schoolvideos.com
Received: from localhost (unknown [127.0.0.1]) by echo.basicprototype.com (Postfix) with ESMTP id 18C9A40703A9 for <anthony@schoolvideos.com>; Tue, 16 Sep 2008 22:31:13 +0000 (UTC)
Received: from echo.basicprototype.com ([127.0.0.1]) by localhost (echo.basicprototype.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dMlb-E3PGY0E for <anthony@schoolvideos.com>; Tue, 16 Sep 2008 15:30:54 -0700 (PDT)
Received: from 66.89.96.137.ptr.us.xo.net (66.89.96.137.ptr.us.xo.net [66.89.96.137]) by echo.basicprototype.com (Postfix) with ESMTP id 0D7004070395 for <anthony@schoolvideos.com>; Tue, 16 Sep 2008 15:30:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at localhost
X-Spam-Flag: YES
X-Spam-Score: 6.948
X-Spam-Level: ******
X-Spam-Status: Yes, score=6.948 required=4 tests=[AWL=-6.157, BAYES_50=0.001, HELO_DYNAMIC_IPADDR2=4.395, HELO_DYNAMIC_SPLIT_IP=3.493, HELO_EQ_IP_ADDR=1.119, RCVD_NUMERIC_HELO=2.067, RDNS_DYNAMIC=0.1, TVD_RCVD_IP=1.931]
X-Domainkeys: Sendmail DomainKeys Filter v0.6.0 echo.basicprototype.com 0D7004070395
Domainkey-Signature: a=rsa-sha1; s=echo; d=schoolvideos.com; c=simple; q=dns; b=npHQDn/jeH64IfXq/G/gFt6fya8TW0jVgUCTJa8V6atqNVnF44ik+iXSAB4wHTcBS yM1LpUtvd9UK8q2MBtiQg==
Message-Id: <16DF1521-DC88-429A-858E-5108B46DBE8F@schoolvideos.com>
Content-Type: text/plain; charset=US-ASCII; format=flowed
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v926)
X-Mailer: Apple Mail (2.926)

This is me typing like a real letter ;)

Jules

[falko]

Please try this:
postconf -e 'smtpd_sasl_authenticated_header = yes'
/etc/init.d/postfix restart

[chipsafts]

to me it seems that either/both
* that the sending email server is not quite configured correctly and a name is not attached to the ip address

* the new information did not propagate yet

[iyeat]

Please try this:
postconf -e 'smtpd_sasl_authenticated_header = yes'
/etc/init.d/postfix restart
Falko,

I have tried this, and will post back with my results.

Thank You!

Caio

[iyeat]

to me it seems that either/both
* that the sending email server is not quite configured correctly and a name is not attached to the ip address

* the new information did not propagate yet
Chipsafts,

In my case, both the sending & receiving email server are actually the same server. The user is simply sending a mail to another user on her domain.

Caio

[bwragg]

Hi,

Did anyone ever get a resolution of this problem. I'm getting the same thing. I tried falkos suggestion of:

postconf -e 'smtpd_sasl_authenticated_header = yes'

but my postfix version doesn't support this. Is there another work around?

Thanks,

[iyeat]

This actually did work for me...

What version of Postfix are you running?

C

[bwragg]

Thats good news but I'm running centos 4 which only has postfix 2.2.10 and http://www.postfix.org/postconf.5.html says the smtpd_sasl_authenticated_header setting is only available from 2.3.

Any suggestions?

[falko]

Do you get any errors in your mail log or when you restart Postfix when you add it anyway?

[bwragg]

I don't get any errors and it restarts fine, but it doesn't do anything? I assume int the maillog the ip addresses will be replaced with the username?

when I run postconf and it dumps the current settings, the smtpd_sasl_authenticated_header setting isn't set.

Any ideas?