The report for spam messages encapsulates the spam in an rfc/822 email attachment, and the body of the enclosing email is generated from a template in 10_misc.cf. Note that this default template may be overridden in local.cf or user_prefs.
There are three reports—the safe report, the unsafe report, and the spamtrap report. The safe report is used whenever a spam is encountered but this feature can always be disabled. The unsafe report can have a different appearance to the safe report, and is always used when SpamAssassin detects some content that might harm the user if the email were opened—for example, web bugs. The spamtrap report is used in conjunction with a 'spamtrap' email address that is specifically created to receive only spam, and never legitimate email. This is discussed further in Chapter 11.
An example of a safe report is shown here:
Spam detection software, running on the system "hostname.domain.com", has identified this incoming email as possible spam. The original...
