For me, mail that is detected as spam by spam assassin comes through with modified subject line like:
Quote:
|
** SPAM Score: 15.8 ** {original message subject here}
|
The message part of the email looks like the following, and the original email is as an attachment (I set up Spam Assassin to do this)
Quote:
Spam detection software, running on the system "vc10.eukhost.com", has identified this incoming email as possible spam. The original message has been attached to this so you can view it (if it isn't spam) or label similar future email. If you have any questions, see the administrator of that system for details.
Content preview: Cute blonde in nylon posing blah blah [...]
Content analysis details: (32.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.7 SARE_ADLTSUB2 Contains possible adult words
2.2 SUBJECT_***UAL Subject indicates ***ually-explicit content
3.4 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr
1)
3.2 RCVD_HELO_IP_MISMATCH Received: HELO and IP do not match, but should
1.3 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
0.9 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers
1.0 SARE_ADULT2 BODY: Contains adult material
0.8 INFO_TLD URI: Contains an URL in the INFO top-level domain
0.5 RAZOR2_CHECK Listed in Razor2 (http:// razor.sf.net)
0.5 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org
0.9 DNS_FROM_RFC_WHOIS RBL: Envelope sender in whois.rfc-ignorant.org
3.1 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[82.81.110.53 listed in sbl-xbl.spamhaus.org]
2.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address
[82.81.110.53 listed in dnsbl.sorbs.net]
1.3 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see <www. spamcop.net/bl.shtml?82.81.110.53>]
1.4 DNS_FROM_RFC_POST RBL: Envelope sender in postmaster.rfc-ignorant.org
1.7 RCVD_IN_NJABL_DUL RBL: NJABL: dialup sender did non-local SMTP
[82.81.110.53 listed in combined.njabl.org]
4.5 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: voiceknewatthere.info]
1.7 FM_PORN_A_4 FM_PORN_A_4
|
Yes, my main mail account comes directly into my eukhost hosted pop3 account.
I'm not sure how to investigate if mail is being bounced - let me know how you're doing it, and i'll give it a go - as I, like you do want to receive every email i get sent (spam or otherwise!)