Why is our spamfiltering software client crazy?

Question

What to do? It blocks almost all incoming messages. What to do? It complains about:

• RDNS_NONE - a host with no rDNS? What is that?
• BAD_ENC_HEADER
• FH_DATE_PAS_20XX

What does these rules mean really?

Answer 1

I'm gonna guess this is spamassassin.

• RDNS_NONE means it couldn't perform a reverse-DNS lookup on the originating SMTP server
• BAD_ENC_HEADER is whitespace in the encoded part of the message
• FH_DATE_PAS_20XX means the timestamp of the message is way off in the future.

You can disable RDNS lookups but you'll be reducing security somewhat. Check your system time is accurate on all the servers involved. Check the email that is arriving hasn't already been run through spamassassin before it reaches your spamassassin server, as that triggers the ENC_HEADER rule.

Answer 2

You should have automatic rules updates for your spamassassin server. FH_DATE_PAS_20XX used to add a +3 score to everything in 2010 or later; since we're in 2010 you likely didn't update your rules and you're adding a +3 score to all current emails!

The updated rules changes this to anything in 2020 or later, IIRC.

Regarding the RDNS_NONE tag, make sure you can reverse-resolve the IPs of the servers you get emails from. If you have a frontend server that do not resolve or broken DNS resolver this may explain it.