I'm using SA 2.20 from Debian testing.

I've received a couple of messages today that have been tagged as Spam and
shouldn't have been and it looks like I've tracked it down to a logic problem
with  the RCVD_IN_OSIRUSOFT_COM rule.

Here are the headers and part of the body of an example message:

Return-Path: <squeak-dev-admin@lists.squeakfoundation.org>
X-Sieve: cmu-sieve 2.0
Received: from mail.premiernet.net [205.229.224.233] by localhost with POP3
        (fetchmail-5.9.0) for ken@localhost (single-drop); Wed, 01 May 2002
        12:33:49 -0500 (CDT)
Received: from mail.theinternetone.net (lnx-3.ams-2.theinternetone.net
        [62.4.94.4] (may be forged)) by mail.premiernet.net (8.12.3/8.12.3/Debian
        -4) with SMTP id g41HVVdd004635 for <ken@ineffable.com>; Wed, 1 May 2002
        12:31:32 -0500
Received: (qmail 2620 invoked from network); 1 May 2002 17:31:02 -0000
Received: from lnx-3.ams-2.theinternetone.net (62.4.94.210) by
        lnx-3.ams-2.theinternetone.net with SMTP; 1 May 2002 17:31:02 -0000
Delivered-To: mailman-squeak-dev@lists.squeakfoundation.org
Received: (qmail 2360 invoked from network); 1 May 2002 17:30:43 -0000
Received: from uhura.concentric.net (206.173.118.93) by
        lnx-3.ams-2.theinternetone.net with SMTP; 1 May 2002 17:30:43 -0000
Received: from marconi.concentric.net (marconi.concentric.net
        [206.173.118.71]) by uhura.concentric.net [Concentric SMTP Routing 1.0] id
        g41HUMk16364 ; Wed, 1 May 2002 13:30:22 -0400 (EDT)
Received: from sumeru.stanford.edu (da003d0951.sjc-ca.osd.concentric.net
        [64.1.3.184]) by marconi.concentric.net (8.9.1a) id NAA11296; Wed, 1 May
        2002 13:30:20 -0400 (EDT)
Message-ID: <3CD0206C.17643FEF@sumeru.stanford.edu>
From: Tim Rowledge <tim@sumeru.stanford.edu>
X-Mailer: Mozilla 4.61 (Macintosh; I; PPC)
X-Accept-Language: en,pdf
MIME-Version: 1.0
To: squeak-dev@lists.squeakfoundation.org
Subject: *****SPAM***** Re: Is BC worth the image format switch?
References: <080c01c1f113$65c53460$0e00000a@SPAIR>
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Sender: squeak-dev-admin@lists.squeakfoundation.org
Errors-To: squeak-dev-admin@lists.squeakfoundation.org
X-BeenThere: squeak-dev@lists.squeakfoundation.org
X-Mailman-Version: 2.0.8
Precedence: bulk
Reply-To: squeak-dev@lists.squeakfoundation.org
X-Reply-To: tim@sumeru.stanford.edu
List-Help:
        <mailto:squeak-dev-request@lists.squeakfoundation.org?subject=help>
List-Post: <mailto:squeak-dev@lists.squeakfoundation.org>
List-Subscribe: <http://lists.squeakfoundation.org/listinfo/squeak-dev>,
        <mailto:squeak-dev-request@lists.squeakfoundation.org?subject=subscribe>
List-Id: The general-purpose Squeak developers list
        <squeak-dev.lists.squeakfoundation.org>
List-Unsubscribe: <http://lists.squeakfoundation.org/listinfo/squeak-dev>,
        <mailto:squeak-dev-request@lists.squeakfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.squeakfoundation.org/pipermail/squeak-dev/>
Date: Wed, 01 May 2002 10:05:52 -0700
X-Spam-Status: Yes, hits=5.0 required=5.0
        tests=SUBJ_ENDS_IN_Q_MARK,MAY_BE_FORGED,NO_MX_FOR_FROM,RCVD_IN_OSIRUSOFT_COM
         version=2.20
X-Spam-Flag: YES
X-Spam-Level: *****
X-Spam-Checker-Version: SpamAssassin 2.20 (devel $Id: SpamAssassin.pm,v
        1.77 2002/04/06 19:28:30 hughescr Exp $)
X-Spam-Prev-Content-Type: text/plain; charset=us-ascii
X-Spam-Prev-Content-Transfer-Encoding: 7bit
X-UIDL: IQV"!GNB!!c@4"!~R,!!
X-Evolution-Source: imap://ken;auth=CRAM-MD5@linux.ineffable.com/

SPAM: -------------------- Start SpamAssassin results ----------------------
SPAM: This mail is probably spam.  The original message has been altered
SPAM: so you can recognise or block similar unwanted mail in future.
SPAM: See http://spamassassin.org/tag/ for more details.
SPAM: 
SPAM: Content analysis details:   (5 hits, 5 required)
SPAM: Hit! (-0.1 points) Subject: ends in a question mark
SPAM: Hit! (1.3 points)  'Received:' has 'may be forged' warning
SPAM: Hit! (1.8 points)  No MX records for the From: domain
SPAM: Hit! (2.0 points)  Received via a relay in relays.osirusoft.com
SPAM:                    [RBL check: found 184.3.1.64.relays.osirusoft.com.]
SPAM: 
SPAM: -------------------- End of SpamAssassin results ---------------------

RCVD_IN_OSIRUSOFT_COM is triggering on the originating system, which is not in
fact a relay.  The problem with this is that relays.osirusoft.com will answer
for dialup IPs.