Hallo!
Leider habe ich erst jetzt gesehen, dass hier geantwortet wurde. Habe witzigerweise keine Email-Notification dazu bekommen.
Hier aber eine beispielhafte Email - mehrfach hin und her gesendet und die FQDNs etc. sind natürlich verfälscht:
Return-Path: max.mustermann@example2.local
Received: from mail.example.local (localhost [127.0.0.1])
by ox (Cyrus v2.4.16-Debian-2.4.16-4.32.201410011447) with LMTPA;
Wed, 03 Feb 2016 10:46:20 +0100
X-Sieve: CMU Sieve 2.4
Received: from localhost (localhost [127.0.0.1])
by mail.example.local (Postfix) with ESMTP id ADE03BCABFA
for max.mustermann@example.local; Wed, 3 Feb 2016 10:46:20 +0100 (CET)
X-Virus-Scanned: by amavisd-new-2.7.1 (20120429) (Debian) at example.local
X-Spam-Flag: NO
X-Spam-Score: -2.598
X-Spam-Level:
X-Spam-Status: No, score=-2.598 tagged_above=-1000 required=5
tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7,
URIBL_BLOCKED=0.001] autolearn=ham
Received: from mail.example.local ([127.0.0.1])
by localhost (mail.example.local [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id Q6x6J0uLt4uL for max.mustermann@example.local;
Wed, 3 Feb 2016 10:46:19 +0100 (CET)
Received: from xmail.xpirio.net (xmail.xpirio.net [195.16.241.189])
by mail.example.local (Postfix) with ESMTPS id 3D9BFBC64AD
for max.mustermann@example.local; Wed, 3 Feb 2016 10:46:19 +0100 (CET)
Received: from webmail.example2.local (unknown [95.143.82.202])
(using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
(No client certificate requested)
by xmail.xpirio.net (Postfix) with ESMTPS id 014B8498035F
for max.mustermann@example.local; Wed, 3 Feb 2016 10:46:46 +0100 (CET)
Received: from localhost (localhost [127.0.0.1])
by webmail.example2.local (Postfix) with ESMTP id B682A2AA0027
for max.mustermann@example.local; Wed, 3 Feb 2016 10:46:45 +0100 (CET)
X-Virus-Scanned: by amavisd-new-2.7.1 (20120429) (Debian) at example2.local
Received: from webmail.example2.local ([127.0.0.1])
by localhost (webmail.example2.local [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 1jVRo1yH4imB for max.mustermann@example.local;
Wed, 3 Feb 2016 10:46:45 +0100 (CET)
Received: from webmail.example2.local (localhost [127.0.0.1])
by webmail.example2.local (Postfix) with ESMTPA id 871882AA0025
for max.mustermann@example.local; Wed, 3 Feb 2016 10:46:45 +0100 (CET)
Date: Wed, 3 Feb 2016 10:46:45 +0100 (CET)
From: Harald Knapp max.mustermann@example2.local
To: Harald Knapp max.mustermann@example.local
Message-ID: 1921559028.24660.a9cf944b-3662-4eea-9493-9512a33b4ed7.open-xchange@webmail.example2.local
Subject: Fwd: mal jetzt
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_Part_24659_1167733640.1454492805499"
X-Priority: 3
Importance: Medium
X-Mailer: Open-Xchange Mailer v7.8.0-Rev16
X-Originating-Client: com.openexchange.ox.gui.dhtml
Also mir zeigt sich dabei, dass der Score für diese SPAM-Email zu gering ist, um als Spam behandelt zu werden. Aber da ist definitv dieser Spam-Test-String drinnen!
PS: Beim weiteren Recherchieren habe ich diesen Beitrag gesehen, der anscheinend schon das gleiche Problem mal hatte: UCS 3.1 + OXSE+ Spamassassin
Liebe Grüße und schon mal danke.
Harald