Tag: dspam

I use DSPAM to handle my spam checking and have been quite happy with it as it normally delivers >99.9% hit rate.

In the last few weeks the amount of spam in my INBOX had been getting progressively worse to the point where I noticed no spam whatsoever was making its way into my spam folder.

Looking through my logs I eventually found the following

May 10 10:03:03 fozzie dspam[30287]: Unable to find a valid signature. Aborting.
May 10 10:03:03 fozzie dspam[30287]: process_message returned error -5.  dropping message.

I process my spam by using a mutt macro which bounces emails to johnf-spam at inodes dot org. This then passes the email to DSPAM which reclassifies it. It does this by looking at a header it added to the email.

X-DSPAM-Signature: 464400d0223642194712985

However these were appearing in my INBOX as

X-Dspam-Signature: 464400d0223642194712985

I use procmail and a perl script to pre-process some of my email and it uses Mail::Internet which in turn uses Mail::Header. It bestows this piece of wisdom upon the world.

# attempt to change the case of a tag to that required by RFC822. That
# being all characters are lowercase except the first of each word. Also
# if the word is an `acronym' then all characters are uppercase. We decide
# a word is an acronym if it does not contain a vowel.

sub _tag_case
{

Now I can’t see where in RFC822 it specifies this but in section B.2 it does specify

Upper and lower case are not dis-tinguished when comparing field-names.

So on that basis I choose to blame DSPAM and applied the following diff

diff -ur dspam-3.8.0.orig/src/dspam.c dspam-3.8.0/src/dspam.c
--- dspam-3.8.0.orig/src/dspam.c        2006-12-13 02:33:45.000000000 +1100
+++ dspam-3.8.0/src/dspam.c     2007-05-11 16:25:11.000000000 +1000
@@ -2165,7 +2165,7 @@
           while(node_header != NULL) {
             head = (ds_header_t) node_header->ptr;
             if (head->heading && 
-                !strcmp(head->heading, "X-DSPAM-Signature")) {
+                !strcasecmp(head->heading, "X-DSPAM-Signature")) {
               if (!strncmp(head->data, SIGNATURE_BEGIN, 
                            strlen(SIGNATURE_BEGIN))) 
               {

Now to work out the best way to push that upstream.