Re: Spamcop failing to detect true originating IP

Various forms of inadequate 'header describing'.

wskrispy wrote:
> message like "No source IP header found - cannot proceed". Most of
> these spams have spoofed senders but the real originating IP is plain
> to see in the second block of headers.

wskrispy wrote:
> when I trim the source down to the bare minimum with just
> the originating headers Spamcop is now accepting it

John Richards wrote:
> How about if he just removes the headers added  by SpamAssassin?

> My ISP prepends "[Bulk]" to the subject field of
> suspected spam (an option I elected).  Aren't these things
> technically "material changes"?

N. Miller wrote:
> One of my mail providers uses SpamAssassin, and
> made a change in the manner of SA's operation which broke the
> headers; I believe by adding an unexpected, and non-RFC-compliant
> space. When it wrapped in my MTA, the result was a blank line,
> denoting the end of the headers, and my MTA added its two cents worth
> before putting the email in the mailbox. The result was "headers in
> the body", or something like that.

When we talk about a header, it might seem like it is sufficient to
'describe' the headers in some way which we feel like characterizes the
issue;  but nothing characterizes an issue about a specific header
related discussion as much as access to the 'real' headers themselves,
instead of an inadequately described generi-cized description of what
the poster is talking about.

Invariably there is some other part of the header which actually may
come to relevance, and there is no substitute for the real header.

It takes much less 'space' to paste the tracker than even beginning to
'simply' describe a header, which description is typically going to
somehow turn up inadquate in ways in which the original describer can
not possibly anticipate.

If we are going to talk about a spam or a parse or what SC did with
something or what something said or whatever;  we should be posting the
tracker so that when the unexpected considerations arise, the original
headers and/or spam are right there available at the tracker.

-- 
Mike Easter
kibitzer, not SC admin