I use DSPAM to handle my spam checking and have been quite happy with it as it normally delivers >99.9% hit rate.
In the last few weeks the amount of spam in my INBOX had been getting progressively worse to the point where I noticed no spam whatsoever was making its way into my spam folder.
Looking through my logs I eventually found the following
May 10 10:03:03 fozzie dspam[30287]: Unable to find a valid signature. Aborting. May 10 10:03:03 fozzie dspam[30287]: process_message returned error -5. dropping message.
I process my spam by using a mutt macro which bounces emails to johnf-spam at inodes dot org. This then passes the email to DSPAM which reclassifies it. It does this by looking at a header it added to the email.
X-DSPAM-Signature: 464400d0223642194712985
However these were appearing in my INBOX as
X-Dspam-Signature: 464400d0223642194712985
I use procmail and a perl script to pre-process some of my email and it uses Mail::Internet which in turn uses Mail::Header. It bestows this piece of wisdom upon the world.
# attempt to change the case of a tag to that required by RFC822. That # being all characters are lowercase except the first of each word. Also # if the word is an `acronym' then all characters are uppercase. We decide # a word is an acronym if it does not contain a vowel. sub _tag_case {
Now I can’t see where in RFC822 it specifies this but in section B.2 it does specify
Upper and lower case are not dis-tinguished when comparing field-names.
So on that basis I choose to blame DSPAM and applied the following diff
diff -ur dspam-3.8.0.orig/src/dspam.c dspam-3.8.0/src/dspam.c --- dspam-3.8.0.orig/src/dspam.c 2006-12-13 02:33:45.000000000 +1100 +++ dspam-3.8.0/src/dspam.c 2007-05-11 16:25:11.000000000 +1000 @@ -2165,7 +2165,7 @@ while(node_header != NULL) { head = (ds_header_t) node_header->ptr; if (head->heading && - !strcmp(head->heading, "X-DSPAM-Signature")) { + !strcasecmp(head->heading, "X-DSPAM-Signature")) { if (!strncmp(head->data, SIGNATURE_BEGIN, strlen(SIGNATURE_BEGIN))) {
Now to work out the best way to push that upstream.