This shows a real spam collected in a user quarantine. This shows the headers of the messages with the X-MailCleaner anti spam tags and filtering process

Received: by mailcleaner.example.net stage2 with id 1XBACS-0003Me-7w
for <john.doe@example.net>; Sun, 27 Jul 2014 00:12:20 +0200
Received: from hermes.apache.org ([140.211.11.3] helo=mail.apache.org)
by mailcleaner.example.net stage1 with smtp
(Exim MailCleaner)
id 1XBACQ-00033c-OU
for <john.doe@example.net>
from <users-return-104250-john.doe=example.net@spamassassin.apache.org>; Sun, 27 Jul 2014 00:12:19 +0200
Received: (qmail 32516 invoked by uid 500); 26 Jul 2014 22:10:58 -0000
X-MailCleaner-SPF: pass
Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm
Precedence: bulk
list-help: <mailto:users-help@spamassassin.apache.org>
list-unsubscribe: <mailto:users-unsubscribe@spamassassin.apache.org>
List-Post: <mailto:users@spamassassin.apache.org>
List-Id: <users.spamassassin.apache.org>
Delivered-To: mailing list users@spamassassin.apache.org
Received: (qmail 32505 invoked by uid 99); 26 Jul 2014 22:10:57 -0000
Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230)
by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 26 Jul 2014 22:10:57 +0000
X-ASF-Spam-Status: No, hits=-0.7 required=10.0
tests=RCVD_IN_DNSWL_LOW,SPF_PASS
X-Spam-Check-By: apache.org
Received-SPF: pass (nike.apache.org: domain of jdebert@garlic.com designates 208.70.91.151 as permitted sender)
Received: from [208.70.91.151] (HELO cal1-mh785.smtproutes.com) (208.70.91.151)
by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 26 Jul 2014 22:10:53 +0000
X-Katharion-ID: 1406412606.73826.cal1-mh785
Received: from noc-auth1.garlic.com ([216.139.0.86]) by
cal1-mh785.smtproutes.com [(192.69.16.151)] with ESMTP via TCP
(TLSv1.2/TLS_DHE_RSA_WITH_AES_256_CBC_SHA); 26 Jul 2014 22:10:06 +0000
Received: from bakaboy.invalid (hermes.garlic.com [216.139.0.86])
by noc-auth1.garlic.com (Postfix) with ESMTP id C6368980040
for <users@spamassassin.apache.org>; Sat, 26 Jul 2014 15:09:43 -0700 (PDT)
Received: by bakaboy.invalid (Postfix, from userid 65534)
id 94FC5255F2; Sat, 26 Jul 2014 12:11:26 -0700 (PDT)
Received: from bakaboy.invalid (localhost [127.0.0.1])
by bakaboy.invalid (Postfix) with ESMTP id 0B315255CF
for <users@spamassassin.apache.org>; Sat, 26 Jul 2014 12:11:23 -0700 (PDT)
Date: Sat, 26 Jul 2014 12:11:23 -0700
From: jdebert <jdebert@garlic.com>
To: users@spamassassin.apache.org
Subject: Re: Alternate method to check for rule updates?
Message-ID: <20140726121123.0f595dca@bakaboy.invalid>
In-Reply-To: <1406255471.4847.137.camel@monkey>
References: <20140724173205.4b71ebff@bakaboy.invalid>
<1406251820.4847.100.camel@monkey>
<20140724185610.7417ea8f@bakaboy.invalid>
<1406255471.4847.137.camel@monkey>
X-Baka-WasBeen: yes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Virus-Checked: Checked by ClamAV on apache.org
X-Commtouch-ctIPd-RefID: tid=0001.0A0C0303.53D427C6.0081
X-Commtouch-ctasd-RefID: str=0001.0A0C0201.53D427C6.00FB:SCGSTAT1067355,ss=1,re=-4.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=1024
X-Commtouch: is not spam (Spam: Unknown, VOD: Medium)
X-NiceBayes: is spam (99.98%)
X-MailCleaner-Information: Please contact support@example.net for more information
X-MailCleaner-ID: 1XBACS-0003Me-7w
X-MailCleaner: Found to be clean
X-MailCleaner-SpamCheck: spam, NiceBayes (99.98%)
X-Auto-Response-Suppress: DR, NDR, RN, NRN, OOF, AutoReply

On Fri, 25 Jul 2014 04:31:11 +0200
Karsten Br=C3=A4ckelmann <guenther@rudersport.de> wrote:

>=20
> Run.
>=20
> Is that an option?

Not yet. And alternatives will cost at least double, for half of what
I get via sprint.

> Just to be clear -- and absolutely no excuse to tamper with raw
> traffic like this -- are we talking end-user / dial-up?

End user.

>=20
> Sprint really even messes with DNS TXT records? What for?

Who knows?

=20
> I understand home ISP switching might be difficult. In which case I
> guess Sprint would see exactly one type of traffic by me -- VPN
> traffic using their line into a trustworthy network.
>=20

They're about to see a whole lot more encrypted traffic.

jd