[SpamCop-List] Re: gold.csi (full spam in spamcop.spam)

[Mike Easter]

John Dawson wrote:
> Today (and not before), several spam messages have been reported by
SpamCop as being sent from my own domain, which is manifestly not so.

> Result of parsing spam (posted to spamcop.spam with subject gold.csi)

The spam in .spam has a *different* problem than the problem you posted
here.  The spam headers below say "gold.csi.domain" for your server;  the
ones in .spam say "gold.csi.cam.ac.uk" [good] *but* they have question
marks [?] stuck in at very bad places, most especially directly stuck to
the "by" which SC cannot abide.  It appears that something replaced the
leading space of the continuation of a Received line with a qx-mark in a
very awkward way.

> Received:  from gold.csi.domain ([131.111.8.12]) by libra.domain with
> esmtp (Exim 4.12) id spammed Thu, 20 Feb 2003 17:04:16 +0000
> Received:  from [200.83.173.186] (helo=yahoo.com) by gold.csi.domain
> with smtp (Exim 4.10) id spammed Thu, 20 Feb 2003 17:04:15 +0000

from .spam

Received: from gold.csi.cam.ac.uk ([131.111.8.12])
?by libra.cus.cam.ac.uk with esmtp (Exim 4.12)
?id 18lu7M-0006vM-00; Thu, 20 Feb 2003 17:04:16 +0000
Received: from [200.83.173.186] (helo=yahoo.com)
?by gold.csi.cam.ac.uk with smtp (Exim 4.10)
?id 18lu7L-00021t-00; Thu, 20 Feb 2003 17:04:15 +0000

SC chokes when parsing that spam simply because the "by" is screwed up;
not because of the domainname discrepancy I described in my previous post.
It is perfectly happy with the correct domainname in the .spam headers.

I removed those question marks and SC parsed the spam just fine, as
evidenced by this tracker
http://spamcop.net/sc?id=z65136739z0cef9269dfe9ecc5236efff1ed819b06z

-- 
Mike Easter