SpamAssassin, by default, will automatically attempt to figure out which Received: headers were inserted by mailservers in your network, and which were not. This auto detection works pretty well for most networks, but when Network Address Translation (NAT) is involved there are two possible configurations that SpamAssassin cannot automatically detect the difference between.
'*Comment: auto detection appears to be broken in non-NAT networks as well. I'm seeing this in 3.1.x, but it may affect other versions. If you are having trouble with this, please follow the instructions to manually set TrustedNetworks and see if it fixes your problem.*'
The common symptoms of a broken Trust path include:
...