Hi

Can someone confirm if spamassassin by default sends a copy of scanned email out from the server to somewhere where it is logged as spam or ham?

The reason I ask is that as I watch an internal mail being sent (which should never leave the building due to me setting our hostnames etc) there is internet activity before the message is flushed to the internal receipient.

I could be being paranoid here. I do not have pyzor or razor and my spamassassin conf has three checks:

hashcash
URIDNSBL
and SFF

I know that URIDNSBL could be the culprit as it will do a dns check on any url's present in the email (like our web address on our signature). - but I would like confirmation from someone much better than me!

If you're using remote databases like RBL's then outbound traffic (firewall logging rules, tcpdump, wireshark, router etc) will show the box first making a DNS request for these RBL hosts then do a HTTP query.

Thanks - but that doesn't mean the content of our emails is going anywhere does it?

No, it doesn't: sniff your traffic and you'll see.

Thanks. Not sure what I'm looking for and what tool to use. Ethereal?

Never done it before - so now's a good time to try.

I think I was getting a bit freaked out because I read about razor and pyzor - which send a copy of a suspected email onto a server somewhere for profiling. As I'm not using them but the bog-standard spamassassin setup, it won't be the same. If I'm wrong or confused, just put it down to having never done spam filtering before!

Just the network traffic that made me anxious

A wee bit of paranoia ain't bad. Keeps you alert. You could run tcpdump but Wireshark (the application formerly known as Ethereal) would do too. Difference is Tcpdump is low resource and console mode while Wireshark is more of a GUI tool. You could run tcpdump unattended and in the background for a while and use the "-w" switch to make it dump the packet captures to file which you can peruse at leisure later on with Wireshark.

I think Razor and similar only send out hashes of you're E-mail

This is good stuff. Thanks folks!