Spamassassin, auto whitelist, backscatter and spam problems.

Question

My Mail is handled by an XServe with Mac OS X Server 10.5.5.
I have many email problems. One of them is an email backscatter problem. Sometimes, but not always, when email is identified as spam, an email gets sent back to the "From" address saying it is spam. This email seems to come directly from my servers, which is bad as spammers usually spoof the From addresses. I have modified amavisd.conf as per below. I changed all the D_BOUNCE instances to D_REJECT, yet still emails seeming to come from my server gets sent back to the From address. This is the relevant bit out of amavisd.conf:
$finalvirusdestiny = D_REJECT;
$finalbanneddestiny = D_REJECT;
$finalspamdestiny = D_REJECT;
$finalbad_headerdestiny = D_PASS;
I tried testing this by sending lots of emails that with keywords in them that rules are set up for to add enough points so that such emails get blocked, however, these emails seem to come through. At first I thought this was the AWL's doing, but by examining the headers of the email, there is no X-SPAM header as I'd expect, which makes me believe Spamassassin has not checked the email?? What can cause emails to bypass spamassassin and how do I get spamassassin to check every email? This seems to be a cause of my other problem of a lot of SPAM passing through the spam filter.
I am also having a lot of trouble understanding the SA AWL.
Is there any way I can change the scores in the AWL database?
I have tried:
spamassassin --remove-addr-from-whitelist=[email protected]
This outputs a message saying it removed an address from the whitelist, but in reality does absolutely nothing. Way I can tell is by using this script which still shows the same entries for the relevant email address:
http://spamassassin.apache.org/full/3.0.x/dist/tools/check_whitelist
I'm stumped. Any answers/thoughts/suggestions would be much appreciated. Please help!

Answer 1

postfix receives the mail, then passes it to amavisd.
amavisd decides what scanners to use (clamav/spamassassin and possibly others) and performs the scan
amavisd might not scan the messages if certain criteria are met (size too large, white list, etc), this is all configurable in amavisd.conf. For example, the size threshold by default may be too small, so messages with large graphics may not be scanned.
after amavis processes the message, depending on the config of amavis, certain actions are performed (add headers, discard, reject, bounce, etc).
then amavisd passes the mail back to postfix
postfix delivers any deliverable mail to cyrus/dovecot and/or processes and bounce/rejection.
a rejection doesn't work in the above scenario because it's already been accepted by postfix.
best to discard.
if you would like to learn more about the flow and logic, look at the amavisd config file
/etc/amavisd.conf
and check out the docs
http://www.ijs.si/software/amavisd/
Jeff