Re: Still seeing lots of false positives caused by SHOPIFY_IMG_NOT_RCVD_SFY

On 2026-01-10 at 13:05:10 UTC-0500 (Sat, 10 Jan 2026 18:05:10 +0000)
Niamh Holding <[email protected]>
is rumored to have said:

> Hello Bill,
>
> Saturday, January 10, 2026, 5:34:02 PM, you wrote:
>
> BC> Here's your problem. Your MTA is doing something to strip all of 
> the Received headers from the message before SpamAssassin is seeing 
> it.
>
> OK, I've looked again and those were the headers of the message sent 
> by procmail and not the ones on the incoming external email which will 
> follow.

I don't see any evidence of Shopify in those headers either and at first 
I suspected that maybe the mail isn't really from Shopify, since there 
are indicators of both Sendgrid and Klayvio in those headers.

As it turns out, apparently Shopify has outsourced to Klayvio who has 
outsourced to Sendgrid. It's not clear to me whether the full message 
would hit SHOPIFY_IMG_NOT_RCVD_SFY, since there are multiple ways for 
the body or headers  to be exempt from the basic "Shopify-hosted image 
without Shopify in headers" concept of the rule, but I will shortly add 
a sub-rule to detect Klayvio and prevent this class of FP.


> As to the version,  it's the lastest version in the CentOS repos.

And yet, it remains obsolete.

It's probably not *dangerous* to be using SA 3.4.6-RedHat. They backport 
security and some bugfix changes, so it's not broken exactly. It's just 
not the SA that we still support and it's not ever going to have all of 
the features added since 3.4.6, nor some of the more complicated 
bugfixes.

It is possible to upgrade to 4.0.2 using CPAN but there are definitely 
reasons not to do so if you value simple clean system management.



>
> eturn-Path: 
> <bounces+47981661-220c-niamh=fullbore.co.uk@k1.email.collectiflondon.com>
> X-Original-To: [email protected]
> Delivered-To: [email protected]
> Received-SPF: Pass (mailfrom) identity=mailfrom; 
> client-ip=167.89.100.83; helo=o1305.shared.klaviyomail.com; 
> envelope-from=bounces+47981661-220c-niamh=fullbore.co.uk@k1.email.collectiflondon.com; 
> receiver=<UNKNOWN>
> DMARC-Filter: OpenDMARC Filter v1.4.2 iron.holtain.net EF7ABC000085
> Authentication-Results: iron.holtain.net; dmarc=pass (p=none dis=none) 
> header.from=collectiflondon.com
> Authentication-Results: iron.holtain.net; spf=pass 
> smtp.mailfrom=k1.email.collectiflondon.com
> DKIM-Filter: OpenDKIM Filter v2.11.0 iron.holtain.net EF7ABC000085
> Authentication-Results: iron.holtain.net;
>         dkim=pass (2048-bit key, unprotected) 
> header.d=email.collectiflondon.com [email protected] 
> header.a=rsa-sha256 header.s=s1 header.b=Uu5vIjZS
> X-Greylist: delayed 250 seconds by postgrey-1.37 at iron.holtain.net; 
> Sun, 04 Jan 2026 07:05:42 GMT
> Received: from o1305.shared.klaviyomail.com 
> (o1305.shared.klaviyomail.com [167.89.100.83])
>         by iron.holtain.net (Postfix) with ESMTPS id EF7ABC000085
>         for <[email protected]>; Sun,  4 Jan 2026 07:05:42 +0000 
> (GMT)
> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; 
> d=email.collectiflondon.com;
>         h=content-type:date:from:mime-version:subject:list-unsubscribe:
>         list-unsubscribe-post:to:cc:content-type:date:from:subject:to;
>         s=s1; bh=Kz+ya+jh+aHOhBtrjiSC9iG91XvkpBvvLf6WOCbshGs=;
>         b=Uu5vIjZSJYLO0+zKibxZZ/52wA2rpE23Y22Ho8drs57DhiMfUVlgozqd64GQ3K8Y4XvC
>         tMruCBFTbieG/RvpLSbPGj2gBfajjGf/tv0dJwz1nq10Z2M0Temjvcfyxnwq6OgFDEZ4W6
>         yYl4twZO4ImbWCKOrFC4o9tQaCW4BYxN7X5b1X1mGeETwEYMLiSeQzyicOW0xU8g/RUzqA
>         UOciXkjuUKnKYR8yBrgMhcZp8pt46g9y6cw7CBh7czFSDIkpHeTesirrDZAVe6oLBBCK5L
>         DKEFVfFhS6szbOBuE+F68IHaWYuuncb0rRsiZl7x7bp+S9OSysWty5N/mX2SHwZA==
> Received: by recvd-canary-7f45df575c-cbq4r with SMTP id 
> recvd-canary-7f45df575c-cbq4r-1-695A1049-8
>         2026-01-04 07:01:29.061046374 +0000 UTC m=+1501158.128200560
> Received: from NDc5ODE2NjE (unknown)
>         by geopod-ismtpd-51 (SG) with HTTP
>         id SZuEI0FhTHeYkABhD5hHIA
>         Sun, 04 Jan 2026 07:01:28.995 +0000 (UTC)
> Content-Type: multipart/alternative; 
> boundary=689a8b0786b18362c78fb4173c0ac5556f695d46c647d18226f0640833c9
> Date: Sun, 04 Jan 2026 07:01:29 +0000 (UTC)
> From: Collectif <[email protected]>
> Mime-Version: 1.0
> Message-ID: <SZuEI0FhTHeYkABhD5hHIA@geopod-ismtpd-51>
> Subject: You =?UTF-8?B?YXNrZWTigKYgd2UgcmVzdG9ja2VkIPCfkYA=?=
> List-Unsubscribe:
>  =?us-ascii?Q?=3Chttps=3A=2F=2Fmanage=2Ekmail-lists=2Ecom=2Fsubscriptions=2Funsubscribe=3Fa=3DUW?=
>  =?us-ascii?Q?7jxv&c=3D01JC435HXQDXN21VA0TW14HST0&k=3D3a6?=
>  =?us-ascii?Q?7960f3d545a8ecf39f59de9dc5315&m=3D01KDQBT?=
>  =?us-ascii?Q?QTZVPG7ZRWC3TPNZVAP&r=3D01KE3W12NWM6RDPGF?=
>  =?us-ascii?Q?5NXYJNMCQ=3E?=
> List-Unsubscribe-Post: List-Unsubscribe=One-Click
> X-Kmail-Account: UW7jxv
> X-Kmail-Message: 01KDQBTQTZVPG7ZRWC3TPNZVAP
> X-Kmail-Ops: 01JC435HXQDXN21VA0TW14HST0
> X-Report-Abuse: Please report any spam or abuse to: [email protected]
> X-SG-EID:
>  =?us-ascii?Q?u001=2ELhzasuSPjOJK=2F2wNdeOjkxMcFVJdEHbuRgn6illXclk4EUoy1qxLR4+O6?=
>  =?us-ascii?Q?VLWWVqcttynD5dlJx=2FagH7PXpdIjKm86vhfNaS7?=
>  =?us-ascii?Q?vziM7+tpzOdRHH9UZFLngQss6LwlBRt6PziJW0r?=
>  =?us-ascii?Q?sLSdHxce08p538GynBqdBeE=2FBY9zwv4JrZkJjZo?=
>  =?us-ascii?Q?Fmfn0Qj7qGZNfMEOqyAu3GHYOGadSOAWg+fL1VZ?=
>  =?us-ascii?Q?kzTSRyTrM4nITY=2FYMbl+xhVL2=2FZQcfXXupknOYF?=
>  =?us-ascii?Q?NU3M?=
> X-SG-ID:
>  =?us-ascii?Q?u001=2ESdBcvi+Evd=2FbQef8eZF3BiU3Zi1S53GtqGa3TWBmqe75yn5aYrkvkfG+Z?=
>  =?us-ascii?Q?GKrHRvqf=2F3T67W2R1E9qUvw09PsusoeKtHebqpH?=
>  =?us-ascii?Q?+XwhYp6yLc7Z9LrYjraTJEtdQiQC8ARpXH8hvbQ?=
>  =?us-ascii?Q?=2FLLX3L+QgPZ85B7xJFFc7qAI3=2FrKenXaUCWdwR2?=
>  =?us-ascii?Q?zgjlRJ7XzwkSqh6n3rMNV2juBNJ4uSLyZLw+XFS?=
>  =?us-ascii?Q?0Rk6yDateLHeKaCouMjBYJAgAy102fDxB3=2FF6ES?=
>  =?us-ascii?Q?LZ4BT9YD0MYPVrql8rAQde4Ll3zH9aPDSo4sRa6?=
>  =?us-ascii?Q?sbmXkKPsvznouMrkcj+UnlE+Lt8gJZziM9NQA5V?=
>  =?us-ascii?Q?BcJqKha6x6=2FJ1KuO8P1Zsof5GvgAmY4wxdpk=2FlC?=
>  =?us-ascii?Q?YgYnX4iy+nHPzRU?=
> To: Niamh Holding <[email protected]>
> X-Entity-ID: u001.8l375WroaHPJyZgBg+X6pg==
>
>
> -- 
> Best regards,
>  Niamh                            mailto:[email protected]


-- 
  Bill Cole
  [email protected] or [email protected]
  (AKA @[email protected] and many *@billmail.scconsult.com 
addresses)
  Not Currently Available For Hire