On 11/16/21 17:03, Evgeniy Berdnikov via Exim-users wrote:
> On Tue, Nov 16, 2021 at 03:11:50PM -0500, Matt Corallo via Exim-users wrote:
>> The way I was (apparently incorrectly?) interpreting a similar expansion
>> here is that the host was not verified via FcRDNS due to the presence of the
>> square brackets in the parenthetical. Apparently that is the way Spamassasin
>> is also interpreting the same received line, marking all mails as "no
>> verified RDNS".
>
> Sounds strange... Your original mail passed my Spamassasin with this result:
>
> X-Spam-Flag: NO
> X-Spam-Score: -0.09
> X-Spam-Level:
> X-Spam-Status: No, score=-0.09 tagged_above=-100 required=4.7
> tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-1, DKIM_SIGNED=0.1,
> DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
> MAILING_LIST_MULTI=-1, MONEY_CONTENT_02=2, MONEY_CONTENT_02=2,
> SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_FOREIGN_FROM=0.01]
> autolearn=no autolearn_force=no
>
> Here "MONEY_CONTENT_02" is my own test, it catched two "bitcoin" words
> in line "id=bitcoin/bitcoin/pull/23496/review/807558392@???"
> from your mail. But RDNS is not mentioned, dispite of header
> "Received: from hummus.exim.org ([37.221.193.62]:49438)".
>
> Have you X-Spam-Status: records in received mails? Do they mention RDNS?
>
Yes, the relevant mail which kicked off the investigation is available on the spamassassin-users
thread at [0]. The original received line generated by Exim which SA failed to properly parse was:
Received: from o13.mailer.shopify.com ([149.72.221.62])
by mail.as397444.net with esmtps TLS1.3 id 1mmjFb-0034Ki-02
(envelope-from <bounces+11006833-f9b2-vmstfpodc=mattcorallo.com@???>)
for vmstfpodc@???; Mon, 15 Nov 2021 21:10:54 +0000
[0]
https://mail-archives.apache.org/mod_mbox/spamassassin-users/202111.mbox/browser
Matt
