<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Vorformatiert Zchn";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLVorformatiertZchn
{mso-style-name:"HTML Vorformatiert Zchn";
mso-style-priority:99;
mso-style-link:"HTML Vorformatiert";
font-family:Consolas;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.E-MailFormatvorlage20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.E-MailFormatvorlage23
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">It could be a password-protected zip attachment that prevents the virus scanner from opening and scanning the contents…<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">regards<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">MK<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b>Von:</b> amavis-users <<a href="mailto:amavis-users-bounces+info=ea80.net@amavis.org">amavis-users-bounces+info=ea80.net@amavis.org</a>>
<b>Im Auftrag von </b>Nick Tait<br>
<b>Gesendet:</b> Montag, 16. Juni 2025 11:24<br>
<b>An:</b> Amavis Users Mailing List <<a href="mailto:amavis-users@amavis.org">amavis-users@amavis.org</a>><br>
<b>Betreff:</b> What does "UNCHECKED" really mean?<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p>Hi list.<o:p></o:p></p>
<p>It appears that every email one of my users receives from a particular company logs "Passed UNCHECKED {AcceptedInbound}", but for the life of me I've been unable to understand exactly what this means, or why it is doing it for just one sender. Initially
I had assumed that something had prevented the email from being SPAM-checked and/or virus-scanned, but I took a closer look at one of these emails, and it contains headers to the contrary...<o:p></o:p></p>
<p>I'm using Postfix with Amavis invoked as a milter with SpamAssassin and ClamAV.<o:p></o:p></p>
<p>These are the messages I see in (Postfix) mail logs for one particular example:<o:p></o:p></p>
<pre>2025-06-09T20:38:01.159392+12:00 mx postfix/smtpd[66941]: connect from XXX[XXX]<o:p></o:p></pre>
<pre>2025-06-09T20:38:01.982297+12:00 mx postfix/smtpd[66941]: Anonymous TLS connection established from XXX[XXX]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)<o:p></o:p></pre>
<pre>2025-06-09T20:38:04.114647+12:00 mx policyd-spf[66963]: : prepend Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=XXX; helo=XXX; envelope-from=XXX@XXX; receiver=<UNKNOWN> <o:p></o:p></pre>
<pre>2025-06-09T20:38:04.165040+12:00 mx policyd-spf[66968]: : prepend Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=XXX; helo=XXX; envelope-from=XXX@XXX; receiver=<UNKNOWN> <o:p></o:p></pre>
<pre>2025-06-09T20:38:04.170630+12:00 mx postfix/smtpd[66941]: 29982A0F3D: client=XXX[XXX]<o:p></o:p></pre>
<pre>2025-06-09T20:38:04.372133+12:00 mx postfix/cleanup[66969]: 29982A0F3D: message-id=<XXX><o:p></o:p></pre>
<pre>2025-06-09T20:38:06.990525+12:00 mx opendkim[1174]: 29982A0F3D: message has signatures from XXX, XXX<o:p></o:p></pre>
<pre>2025-06-09T20:38:06.990875+12:00 mx opendkim[1174]: 29982A0F3D: DKIM verification successful<o:p></o:p></pre>
<pre>2025-06-09T20:38:06.991081+12:00 mx opendkim[1174]: 29982A0F3D: s=XXX d=XXX a=rsa-sha256 SSL <o:p></o:p></pre>
<pre>2025-06-09T20:38:06.993404+12:00 mx opendmarc[1172]: implicit authentication service: mx.tait.net.nz<o:p></o:p></pre>
<pre>2025-06-09T20:38:06.994461+12:00 mx opendmarc[1172]: 29982A0F3D: SPF(mailfrom): XXX pass<o:p></o:p></pre>
<pre>2025-06-09T20:38:07.169121+12:00 mx opendmarc[1172]: 29982A0F3D: XXX pass<o:p></o:p></pre>
<pre>2025-06-09T20:38:07.180201+12:00 mx amavis[65876]: (65876-07) Checking: DYupweuONgIb AM.PDP-SOCK [XXX] <XXX@XXX> -> <a href="mailto:XXX@tait.net.nz"><XXX@tait.net.nz></a><o:p></o:p></pre>
<pre><b><span style="color:#E01B24">2025-06-09T20:38:08.883015+12:00 mx amavis[65876]: (65876-07) Passed UNCHECKED {AcceptedInbound}, AM.PDP-SOCK [XXX] [XXX] <XXX@XXX> -> <a href="mailto:XXX@tait.net.nz"><XXX@tait.net.nz></a>, Queue-ID: 29982A0F3D, Message-ID: <XXX>, mail_id: DYupweuONgIb, Hits: -2.403, size: 10828, 1706 ms</span></b><o:p></o:p></pre>
<pre>2025-06-09T20:38:08.890559+12:00 mx postfix/qmgr[14097]: 29982A0F3D: from=<XXX@XXX>, size=10269, nrcpt=1 (queue active)<o:p></o:p></pre>
<pre>2025-06-09T20:38:08.925566+12:00 mx postfix/smtp[66972]: Verified TLS connection established to XXX[XXX]:25: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)<o:p></o:p></pre>
<pre>2025-06-09T20:38:08.980830+12:00 mx postfix/smtp[66972]: 29982A0F3D: to=<a href="mailto:XXX@tait.net.nz"><XXX@tait.net.nz></a>, relay=XXX[XXX]:25, delay=6.4, delays=6.3/0.01/0.07/0.01, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as EE0C7E61010)<o:p></o:p></pre>
<pre>2025-06-09T20:38:08.981461+12:00 mx postfix/qmgr[14097]: 29982A0F3D: removed<o:p></o:p></pre>
<pre>2025-06-09T20:38:09.093713+12:00 mx postfix/smtpd[66941]: disconnect from XXX[XXX] ehlo=2 starttls=1 mail=1 rcpt=1 bdat=2 quit=1 commands=8<o:p></o:p></pre>
<p>These headers were added to the message during the processing above:<o:p></o:p></p>
<pre>X-Virus-Scanned: Debian amavis at tait.net.nz<o:p></o:p></pre>
<pre>X-Spam-Flag: NO<o:p></o:p></pre>
<pre>X-Spam-Score: -2.403<o:p></o:p></pre>
<pre>X-Spam-Level:<o:p></o:p></pre>
<pre>X-Spam-Status: No, score=-2.403 required=6.31 tests=[DKIMWL_WL_MED=-0.001,<o:p></o:p></pre>
<pre> DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DMARC_PASS=-0.001,<o:p></o:p></pre>
<pre> HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_PASS=-0.001,<o:p></o:p></pre>
<pre> SPF_PASS=-0.001] autolearn=disabled<o:p></o:p></pre>
<pre>Authentication-Results: mx.tait.net.nz; dmarc=pass (p=none dis=none) header.from=XXX<o:p></o:p></pre>
<pre>Authentication-Results: mx.tait.net.nz; spf=pass smtp.mailfrom=XXX<o:p></o:p></pre>
<pre>Authentication-Results: mx.tait.net.nz;<o:p></o:p></pre>
<pre> dkim=pass (2048-bit key; unprotected) header.d=XXX <a href="mailto:header.i=@XXX">header.i=@XXX</a> header.a=rsa-sha256 header.s=XXX header.b=fQ/8+1td;<o:p></o:p></pre>
<pre> dkim=pass (2048-bit key; unprotected) header.d=XXX <a href="mailto:header.i=@XXX">header.i=@XXX</a> header.a=rsa-sha256 header.s=XXX header.b=cdSF0Aeu;<o:p></o:p></pre>
<pre> dkim-atps=neutral<o:p></o:p></pre>
<pre>Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=XXX; helo=XXX; envelope-from=XXX@XXX; receiver=<UNKNOWN><o:p></o:p></pre>
<pre>Received: from XXX (XXX [XXX])<o:p></o:p></pre>
<pre> by mx.tait.net.nz (Postfix) with ESMTPS id 29982A0F3D<o:p></o:p></pre>
<pre> for <a href="mailto:XXX@tait.net.nz"><XXX@tait.net.nz></a>; Mon, 09 Jun 2025 20:38:02 +1200 (NZST)<o:p></o:p></pre>
<p>As you can see the headers above show that the message was SPAM-checked and virus-scanned.<o:p></o:p></p>
<p>So what exactly does UNCHECKED mean then?<o:p></o:p></p>
<p>Thanks,<o:p></o:p></p>
<p>Nick.<o:p></o:p></p>
</div>
</body>
</html>