I use DSPAM to handle my spam checking and have been quite happy with it as it normally delivers >99.9% hit rate.
In the last few weeks the amount of spam in my INBOX had been getting progressively worse to the point where I noticed no spam whatsoever was making its way into my spam folder.
Looking through my logs I eventually found the following
May 10 10:03:03 fozzie dspam[30287]: Unable to find a valid signature. Aborting.
May 10 10:03:03 fozzie dspam[30287]: process_message returned error -5. dropping message.
I process my spam by using a mutt macro which bounces emails to johnf-spam at inodes dot org. This then passes the email to DSPAM which reclassifies it. It does this by looking at a header it added to the email.
X-DSPAM-Signature: 464400d0223642194712985
However these were appearing in my INBOX as
X-Dspam-Signature: 464400d0223642194712985
I use procmail and a perl script to pre-process some of my email and it uses Mail::Internet which in turn uses Mail::Header. It bestows this piece of wisdom upon the world.
# attempt to change the case of a tag to that required by RFC822. That
# being all characters are lowercase except the first of each word. Also
# if the word is an `acronym' then all characters are uppercase. We decide
# a word is an acronym if it does not contain a vowel.
sub _tag_case
{
Now I can’t see where in RFC822 it specifies this but in section B.2 it does specify
Upper and lower case are not dis-tinguished when comparing field-names.
So on that basis I choose to blame DSPAM and applied the following diff
diff -ur dspam-3.8.0.orig/src/dspam.c dspam-3.8.0/src/dspam.c
--- dspam-3.8.0.orig/src/dspam.c 2006-12-13 02:33:45.000000000 +1100
+++ dspam-3.8.0/src/dspam.c 2007-05-11 16:25:11.000000000 +1000
@@ -2165,7 +2165,7 @@
while(node_header != NULL) {
head = (ds_header_t) node_header->ptr;
if (head->heading &&
- !strcmp(head->heading, "X-DSPAM-Signature")) {
+ !strcasecmp(head->heading, "X-DSPAM-Signature")) {
if (!strncmp(head->data, SIGNATURE_BEGIN,
strlen(SIGNATURE_BEGIN)))
{
Now to work out the best way to push that upstream.
