5. The X-SpamSpector: header

SpamSpector adds an X-SpamSpector: header to all of your email messages. To most email messages, the X-SpamSpector: header will look like this:

X-SpamSpector: PASS

But to anything that SpamSpector thinks is spam, the header will instead start thusly:

X-SpamSpector: SPAM

To see the X-SpamSpector: header, open in your mail program an email you've received since you started using SpamSpector and bring up the Full Message Headers. How to do this will differ between mail programs; detailed information can be found at SpamCop FAQ: Viewing the Full, Unmodified Email.

The Full Message Headers are a bit like the address & postmark on a piece of postal mail; they give the source and destination of the email, the systems it passed through on the way, the date, the subject, and other bits and pieces. They are usually placed at the top of the email message, separated from the body by a blank line. X-SpamSpector: should be one of the last message headers in the list.

Usually, you set your mail client to filter anything with "SPAM" in the X-SpamSpector: header into your spamtrap folder, and that's all you need to know about it. But there are occaisions when you need to know more about why an email message ended up tagged as spam, and to help you SpamSpector puts a little more information in the X-SpamSpector: header.

In most messages tagged as spam, the X-SpamSpector: header has the following format:

X-SpamSpector: SPAM <list code> <I.P. address>

The list code is a five-letter code identifying which DNSBL list caused this message to be tagged as spam. You can find which list has which code using the DNSBL lists pane of the Options dialog. Next to it will be the I.P. address which was found in that DNSBL list; usually you will be able to find this I.P. address in one of the "Received" lines of the message header.

For example:

X-SpamSpector: SPAM ORDB 127.0.0.2

This line says that a message was tagged as spam because it passed through the machine 127.0.0.2, which is on the DNSBL list "ORDB". We can look on the Options dialog and find that this list is the Open Relay DataBase, website www.ordb.org, which lists open mail relays.

For those messages blocked by your personal Advanced Blacklist, the X-SpamSpector: header will look like this:

X-SpamSpector: SPAM BLIST <I.P. address>

And for those blocked by your personal non-advanced Blacklist:

X-SpamSpector: SPAM BLIST FROM

Incidentally, messages from senders listed in the Whitelist will have the following header:

X-SpamSpector: PASS WLIST FROM

The Advanced Whitelist does not leave any mark on the X-SpamSpector: header.

Messages passed by the Automatic Whitelist of email addresses will contain this header:

X-SpamSpector: PASS A-WLIST FROM

Finally, where the status of a message is uncertain because a DNSBL query timed out, SpamSpector will add this:

X-SpamSpector: PASS TIME-OUT

If you see this a lot, you can increase the time-out interval in the Options dialog.

Previous Chapter: Configuring SpamSpector Table of Contents Next Chapter: Troubleshooting