SpamAssassin: Black List Question

[Astrotrain]

How does SA work, does it read the 'From:' field or does it dig down deeper
into the actual source server to determine if the email is Spam.

Reason being, I took liberty to enter all the standard world wide suffixes
(*.jp = Japan, *.tw=Twain), ect into my Blacklist, and I am still getting
email originating from blablah@mydomian.de even though I have '*.de'
in my black list.

Any suggestions?

Thanks

[Bob]

Hello,

I just setup a test email account with SA set to BlackList *.net and sent a test message from an account with a .net From address but a .com Return-Path and the message was tagged by SA with a 100 score indicating it simply reads the From: address.

-Bob

[Astrotrain]

So unless the spammer has a '*.de' in their "From:" field, its not being blocked even though the detailed headers read "xyz123.server.de".

Right?

[sheila]

Correct. The Blacklist From setting on SpamAssassin only checks the contents of the "From" header.

[jwlai]

I also has an issue with the black list.
There is a sales person keep sending me the stock information. I put her email address in the black list, but it seems not working.

In the email header, she is using the address I blocked in the From: but there is no spamAssassin score at all! It seems SpamAssassin is skip her email. So her email just keep coming. Any idea? :umm:

P.S. There are some Chinese characters in her From: field, could it be the cause of this?
From: "=?big5?B?pXi1/SipTaWtKX6pea1zfn4=?=" <jean3344@mail.tsc.com.tw>

[Bob]

Jerry,

Please send the full raw headers for a message you believe should have been tagged by SA and wasn't to the Service Desk for review. Service@FutureQuest.net

Thanks,
Bob

[jwlai]

Bob,


Thanks for the reply. I have sent the header to FQ by email.