Results 1 to 7 of 7

Thread: X-Spam-Flag issue- same score < kill but flagged as spam?

  1. #1
    jameztcc is offline Active Member
    Join Date
    May 2007
    Posts
    26
    Rep Power
    8

    Default X-Spam-Flag issue- same score < kill but flagged as spam?

    Hi,

    anyone able to help figure why these 2 sets of emails received with different -negative tags (both still result < kill score), resulted in one flagged as Spam?


    thanks a lot,
    James





    X-Spam-Flag: YES
    X-Spam-Score: -16.106
    X-Spam-Level:
    X-Spam-Status: Yes, score=3.894-20 tag=-10 tag2=3.4 kill=3.4
    tests=[DNS_FROM_RFC_ABUSE=0.2, DNS_FROM_RFC_POST=1.708,
    HTML_90_100=0.113, HTML_ATTR_UNIQUE=0.639, HTML_FONT_FACE_BAD=0.156,
    HTML_MESSAGE=0.001, HTML_TEXT_AFTER_BODY=0.115, NO_REAL_NAME=0.961,
    UNPARSEABLE_RELAY=0.001]



    --------------------------
    X-Spam-Score: -6.106
    X-Spam-Level:
    X-Spam-Status: No, score=3.894-10 tagged_above=-10 required=3.4
    tests=[DNS_FROM_RFC_ABUSE=0.2, DNS_FROM_RFC_POST=1.708,
    HTML_90_100=0.113, HTML_ATTR_UNIQUE=0.639, HTML_FONT_FACE_BAD=0.156,
    HTML_MESSAGE=0.001, HTML_TEXT_AFTER_BODY=0.115, NO_REAL_NAME=0.961,
    UNPARSEABLE_RELAY=0.00

  2. #2
    veronica is offline Outstanding Member
    Join Date
    Jun 2008
    Posts
    594
    Rep Power
    8

    Default

    Could you provide the o/p of :-
    zmprov gacf | grep -i spam
    and /opt/zimbra/conf/salocal.cf

  3. #3
    jameztcc is offline Active Member
    Join Date
    May 2007
    Posts
    26
    Rep Power
    8

    Default

    Hi Veronica,

    here is the information, thanks a lot.

    "zimbraCOSInheritedAttr: zimbraMailSpamLifetime
    zimbraCOSInheritedAttr: zimbraPrefIncludeSpamInSearch
    zimbraDomainAdminModifiableAttr: zimbraMailSpamLifetime
    zimbraDomainAdminModifiableAttr: zimbraPrefIncludeSpamInSearch
    zimbraSpamCheckEnabled: TRUE
    zimbraSpamHeader: X-Spam-Flag
    zimbraSpamHeaderValue: YES
    zimbraSpamIsNotSpamAccount: yyyyy.@xxxx
    zimbraSpamIsSpamAccount: yyyyy@xxxx
    zimbraSpamKillPercent: 17
    zimbraSpamSubjectTag: *** POSSIBLE SPAM ***
    zimbraSpamTagPercent: 17
    "

    "# This is the right place to customize your installation of SpamAssassin.
    #
    # See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
    # tweaked.
    #
    ################################################## #########################
    #
    # rewrite_header Subject *****SPAM*****
    # report_safe 1
    # trusted_networks xxxx
    # lock_method flock

    header DSPAM_SPAM X-DSPAM-Result =~ /^Spam$/
    describe DSPAM_SPAM DSPAM claims it is spam
    score DSPAM_SPAM 0.5

    header DSPAM_HAM X-DSPAM-Result =~ /^Innocent$/
    describe DSPAM_HAM DSPAM claims it is ham
    score DSPAM_HAM -0.1

    trusted_networks xxxx

    rewrite_header Subject *SPAM* _STARS(*)_
    bayes_auto_learn 1
    bayes_min_spam_num 60
    bayes_min_ham_num 60
    clear_headers
    add_header spam Flag _YESNOCAPS_
    add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_ autolearn=_AUTOLEARN_ version=_VERSION_
    add_header all Level _STARS(*)_
    add_header all Checker-Version SpamAssassin _VERSION_ (_SUBVERSION_) on _HOSTNAME_
    "


    Quote Originally Posted by veronica View Post
    Could you provide the o/p of :-
    zmprov gacf | grep -i spam
    and /opt/zimbra/conf/salocal.cf

  4. #4
    veronica is offline Outstanding Member
    Join Date
    Jun 2008
    Posts
    594
    Rep Power
    8

    Default

    i see the score in your header as:-

    X-Spam-Status: Yes, score=3.894-20 tag=-10 tag2=3.4 kill=3.4

    it says 3.894-20. what is this 20 is the question

  5. #5
    veronica is offline Outstanding Member
    Join Date
    Jun 2008
    Posts
    594
    Rep Power
    8

    Default

    Do you have MTA logs corresponsing to these messages ?

  6. #6
    jameztcc is offline Active Member
    Join Date
    May 2007
    Posts
    26
    Rep Power
    8

    Default

    Hi Veronica,

    that's the confusing part. The only minus should only be -10, not sure how or where this -20 got out from.

    Is there any other config files I should look at to dig out that -20?

    Quote Originally Posted by veronica View Post
    i see the score in your header as:-

    X-Spam-Status: Yes, score=3.894-20 tag=-10 tag2=3.4 kill=3.4

    it says 3.894-20. what is this 20 is the question

  7. #7
    jameztcc is offline Active Member
    Join Date
    May 2007
    Posts
    26
    Rep Power
    8

    Default

    Quote Originally Posted by veronica View Post
    Do you have MTA logs corresponsing to these messages ?
    I got these logs from the same message id for the "-20" item... ...

    -----
    ./zimbra.log.11.gz:Jun 5 10:31:42 host1 postfix/cleanup[18604]: D46DDCF061D: message-id=<505CEE65C379E3489EB1D2A2FD53FC5B3DE4D8@sender. address>
    ./zimbra.log.11.gz:Jun 5 10:31:45 host1 postfix/cleanup[21403]: 3AAB5CF0630: message-id=<505CEE65C379E3489EB1D2A2FD53FC5B3DE4D8@sender. address>
    ./zimbra.log.11.gz:Jun 5 10:31:45 host1 postfix/cleanup[18604]: 48637CF0634: message-id=<505CEE65C379E3489EB1D2A2FD53FC5B3DE4D8@sender. address>
    ./zimbra.log.11.gz:Jun 5 10:31:45 host1 amavis[21421]: (21421-01) Passed SPAM, LOCAL [X.X.X.X] [Y.Y.Y.Y] <prvs=14004df1e0=AAA@sending.com> -> <BBB@receiving.com>,<CCC@receiving.com>,<DDD@recei ving.com>, quarantine: admin@receiving.com, Message-ID: <505CEE65C379E3489EB1D2A2FD53FC5B3DE4D8@sender.add ress>, mail_id: gpIDWLHa6D9y, Hits: 3.894-20, queued_as: 48637CF0634, 2469 ms
    ./zimbra.log.11.gz:Jun 5 10:31:45 host1 amavis[21421]: (21421-01) Blocked SPAM, LOCAL [X.X.X.X] [Y.Y.Y.Y] <prvs=14004df1e0=AAA@sending.com> -> <EEE@receiving.com>,<FFF@receiving.com>,<GGG@recei ving.com>,<HHH@receiving.com>,<III@receiving.com>, quarantine: admin@receiving.com, Message-ID: <505CEE65C379E3489EB1D2A2FD53FC5B3DE4D8@sender.add ress>, mail_id: gpIDWLHa6D9y, Hits: 3.894-20, 2469 ms

    -----

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. [SOLVED] How do I raise the spam Kill score?
    By ttown in forum Administrators
    Replies: 14
    Last Post: 02-06-2009, 12:58 PM
  2. Weird behaviors and LOTS of spam.
    By zwvpadmin in forum Administrators
    Replies: 7
    Last Post: 01-02-2009, 10:26 AM
  3. Spam handling with RBL's
    By Priyantha Bleeker in forum Administrators
    Replies: 2
    Last Post: 04-18-2008, 09:52 AM
  4. Spam weirdness
    By dwmtractor in forum Administrators
    Replies: 7
    Last Post: 01-29-2008, 12:55 PM
  5. Some more simple tips for cutting spam. . .
    By dwmtractor in forum Administrators
    Replies: 14
    Last Post: 11-21-2007, 06:03 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •