X-Spam-Flag issue- same score < kill but flagged as spam?

[jameztcc]

Hi,

anyone able to help figure why these 2 sets of emails received with different -negative tags (both still result < kill score), resulted in one flagged as Spam?


thanks a lot,
James





X-Spam-Flag: YES
X-Spam-Score: -16.106
X-Spam-Level:
X-Spam-Status: Yes, score=3.894-20 tag=-10 tag2=3.4 kill=3.4
tests=[DNS_FROM_RFC_ABUSE=0.2, DNS_FROM_RFC_POST=1.708,
HTML_90_100=0.113, HTML_ATTR_UNIQUE=0.639, HTML_FONT_FACE_BAD=0.156,
HTML_MESSAGE=0.001, HTML_TEXT_AFTER_BODY=0.115, NO_REAL_NAME=0.961,
UNPARSEABLE_RELAY=0.001]



--------------------------
X-Spam-Score: -6.106
X-Spam-Level:
X-Spam-Status: No, score=3.894-10 tagged_above=-10 required=3.4
tests=[DNS_FROM_RFC_ABUSE=0.2, DNS_FROM_RFC_POST=1.708,
HTML_90_100=0.113, HTML_ATTR_UNIQUE=0.639, HTML_FONT_FACE_BAD=0.156,
HTML_MESSAGE=0.001, HTML_TEXT_AFTER_BODY=0.115, NO_REAL_NAME=0.961,
UNPARSEABLE_RELAY=0.00

[veronica]

Could you provide the o/p of :-
zmprov gacf | grep -i spam
and /opt/zimbra/conf/salocal.cf

[jameztcc]

Hi Veronica,

here is the information, thanks a lot.

"zimbraCOSInheritedAttr: zimbraMailSpamLifetime
zimbraCOSInheritedAttr: zimbraPrefIncludeSpamInSearch
zimbraDomainAdminModifiableAttr: zimbraMailSpamLifetime
zimbraDomainAdminModifiableAttr: zimbraPrefIncludeSpamInSearch
zimbraSpamCheckEnabled: TRUE
zimbraSpamHeader: X-Spam-Flag
zimbraSpamHeaderValue: YES
zimbraSpamIsNotSpamAccount: yyyyy.@xxxx
zimbraSpamIsSpamAccount: yyyyy@xxxx
zimbraSpamKillPercent: 17
zimbraSpamSubjectTag: *** POSSIBLE SPAM ***
zimbraSpamTagPercent: 17
"

"# This is the right place to customize your installation of SpamAssassin.
#
# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
# tweaked.
#
################################################## #########################
#
# rewrite_header Subject *****SPAM*****
# report_safe 1
# trusted_networks xxxx
# lock_method flock

header DSPAM_SPAM X-DSPAM-Result =~ /^Spam$/
describe DSPAM_SPAM DSPAM claims it is spam
score DSPAM_SPAM 0.5

header DSPAM_HAM X-DSPAM-Result =~ /^Innocent$/
describe DSPAM_HAM DSPAM claims it is ham
score DSPAM_HAM -0.1

trusted_networks xxxx

rewrite_header Subject *SPAM* _STARS(*)_
bayes_auto_learn 1
bayes_min_spam_num 60
bayes_min_ham_num 60
clear_headers
add_header spam Flag _YESNOCAPS_
add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_ autolearn=_AUTOLEARN_ version=_VERSION_
add_header all Level _STARS(*)_
add_header all Checker-Version SpamAssassin _VERSION_ (_SUBVERSION_) on _HOSTNAME_
"

Originally Posted by veronica

Could you provide the o/p of :-
zmprov gacf | grep -i spam
and /opt/zimbra/conf/salocal.cf

[veronica]

i see the score in your header as:-

X-Spam-Status: Yes, score=3.894-20 tag=-10 tag2=3.4 kill=3.4

it says 3.894-20. what is this 20 is the question

[veronica]

Do you have MTA logs corresponsing to these messages ?

[jameztcc]

Hi Veronica,

that's the confusing part. The only minus should only be -10, not sure how or where this -20 got out from.

Is there any other config files I should look at to dig out that -20?

Originally Posted by veronica

i see the score in your header as:-

X-Spam-Status: Yes, score=3.894-20 tag=-10 tag2=3.4 kill=3.4

it says 3.894-20. what is this 20 is the question

[jameztcc]

Originally Posted by veronica

Do you have MTA logs corresponsing to these messages ?

I got these logs from the same message id for the "-20" item... ...

-----
./zimbra.log.11.gz:Jun 5 10:31:42 host1 postfix/cleanup[18604]: D46DDCF061D: message-id=<505CEE65C379E3489EB1D2A2FD53FC5B3DE4D8@sender. address>
./zimbra.log.11.gz:Jun 5 10:31:45 host1 postfix/cleanup[21403]: 3AAB5CF0630: message-id=<505CEE65C379E3489EB1D2A2FD53FC5B3DE4D8@sender. address>
./zimbra.log.11.gz:Jun 5 10:31:45 host1 postfix/cleanup[18604]: 48637CF0634: message-id=<505CEE65C379E3489EB1D2A2FD53FC5B3DE4D8@sender. address>
./zimbra.log.11.gz:Jun 5 10:31:45 host1 amavis[21421]: (21421-01) Passed SPAM, LOCAL [X.X.X.X] [Y.Y.Y.Y] <prvs=14004df1e0=AAA@sending.com> -> <BBB@receiving.com>,<CCC@receiving.com>,<DDD@recei ving.com>, quarantine: admin@receiving.com, Message-ID: <505CEE65C379E3489EB1D2A2FD53FC5B3DE4D8@sender.add ress>, mail_id: gpIDWLHa6D9y, Hits: 3.894-20, queued_as: 48637CF0634, 2469 ms
./zimbra.log.11.gz:Jun 5 10:31:45 host1 amavis[21421]: (21421-01) Blocked SPAM, LOCAL [X.X.X.X] [Y.Y.Y.Y] <prvs=14004df1e0=AAA@sending.com> -> <EEE@receiving.com>,<FFF@receiving.com>,<GGG@recei ving.com>,<HHH@receiving.com>,<III@receiving.com>, quarantine: admin@receiving.com, Message-ID: <505CEE65C379E3489EB1D2A2FD53FC5B3DE4D8@sender.add ress>, mail_id: gpIDWLHa6D9y, Hits: 3.894-20, 2469 ms

-----