0

I'm getting hundreds/thousands of emails on my catch all address for my domain, with the subject "Returned mail: see transcript for details".

I am trying to catch these emails with spam assassin (SA) to mark them as spam, but the SA rule only works if I email a test email to my domain with that text in the subject. The actual spam mails are not marked... only the once I send myself as a test.

I have tried (in local.cf): header LOCAL_SUBJECT_RETURNED_MAIL Subject =~ m/Returned mail/i score LOCAL_SUBJECT_RETURNED_MAIL 10.0

header LOCAL_SUBJECT_RETURNED Subject =~ /\bReturned\b/i score LOCAL_SUBJECT_RETURNED 10.0

Again... the rules are working, yet it looks like the spam emails come in without being scanned by spam assassin.

Does anyone have any idea on what I could try?

Things I've tried/done

I enabled php mail logging on my system, to ensure it's not being send through a script on my domain. Log is empty, so that's good.

Michaël
  • 357
  • 3
  • 9

1 Answers1

0

The reason why spamassassin is not catching these emails (backscatter), is because they don't come through spamassasin, because they come from the mailer deamon inside my domain/webserver.

Test mail I send myself:
Received: from localhost by server.myprovider.net with SpamAssassin (version 3.2.4);

Backscatter spam:
Return-Path: Received: from localhost (localhost)

As you can see, it doesn't come through spamassassin, hence, no rules are triggered...

Michaël
  • 357
  • 3
  • 9