Re: milter messages marked as ALL_TRUSTED

Matus UHLAR - fantomas <[email protected]>
Newsgroups gmane.mail.virus.amavis.user
Message-ID <[email protected]>
>> Can you advise me easy way to log e.g. Received: headers from amavisd-new
>> or a hint, what more to log?

On 20.04.20 23:22, Damian wrote:
>Run amavis with debug-sa parameter and egrep for "tag RELAY|trusted". Do
>you see obvious differences between the two systems?

no differences for now, but you helped me at least a bit.
Because of reason unknown to me yet, mail is tagged as originating:

<6>(04723-01) Checking: mBPk-5qhK5mx AM.PDP-SOCK [209.85.221.45] <[email protected]> -> <[email protected]>
<6>(04723-01) SA dbg: config: time limit 300.0 s
<6>(04723-01) SA dbg: message: main message type: text/plain
<6>(04723-01) SA dbg: check: pms new, time limit in 299.999 s
<6>(04723-01) SA dbg: check: using scoreset 3 in M:S:Pms
<6>(04723-01) SA dbg: check: adding caller rule hits, 0 rules
<6>(04723-01) SA dbg: received-header: parsed as [ ip=209.85.221.45 rdns=mail-wr1-f45.google.com helo=mail-wr1-f45.google.com by=mail.zzz.sk ident= [email protected] intl=0 id= auth= msa=0 ]
<6>(04723-01) SA dbg: netset: trusted_networks patricia lookup on 209.85.221.45, 7 networks, result: 0, 0.147 ms
<6>(04723-01) SA dbg: received-header: originating, 209.85.221.45 and remaining relays will be considered trusted, but no longer internal
<6>(04723-01) SA dbg: received-header: relay 209.85.221.45 trusted? yes internal? no msa? no
<6>(04723-01) SA dbg: received-header: parsed as [ ip=46.34.246.6 rdns=ip-46.34.246.6.o2inet.sk. helo=!10.128.220.122! by=smtp.gmail.com ident= envfrom= intl=0 id=1sm4004710wmz.13.2020.04.21.08.13.47 auth=ESMTPSA msa=0 ]
<6>(04723-01) SA dbg: received-header: relay 46.34.246.6 trusted? yes internal? no msa? no
<6>(04723-01) SA dbg: metadata: X-Spam-Relays-Trusted: [ ip=209.85.221.45 rdns=mail-wr1-f45.google.com helo=mail-wr1-f45.google.com by=mail.zzz.sk ident= [email protected] intl=0 id= auth= msa=0 ] [ ip=46.34.246.6 rdns=ip-46.34.246.6.o2inet.sk. helo=!10.128.220.122! by=smtp.gmail.com ident= envfrom= intl=0 id=1sm4004710wmz.13.2020.04.21.08.13.47 auth=ESMTPSA msa=0 ]
<6>(04723-01) SA dbg: metadata: X-Spam-Relays-Untrusted:
<6>(04723-01) SA dbg: metadata: X-Spam-Relays-Internal:
<6>(04723-01) SA dbg: metadata: X-Spam-Relays-External: [ ip=209.85.221.45 rdns=mail-wr1-f45.google.com helo=mail-wr1-f45.google.com by=mail.zzz.sk ident= [email protected] intl=0 id= auth= msa=0 ] [ ip=46.34.246.6 rdns=ip-46.34.246.6.o2inet.sk. helo=!10.128.220.122! by=smtp.gmail.com ident= envfrom= intl=0 id=1sm4004710wmz.13.2020.04.21.08.13.47 auth=ESMTPSA msa=0 ]
<6>(04723-01) SA dbg: check: tagrun - tag RELAYSTRUSTEDREVIP is now ready, value: ARY:[45.221.85.209,6.246.34.46]
<6>(04723-01) SA dbg: check: tagrun - tag RELAYSEXTERNALREVIP is now ready, value: ARY:[45.221.85.209,6.246.34.46]


-- 
Matus UHLAR - fantomas, [email protected] ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
- Holmes, what kind of school did you study to be a detective?
- Elementary, Watkins.  -- Daffy Duck & Porky Pig
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.