Non-spam scores below threshold being sent to junk

[jkruger]

I am new to the administration Zimbra and SPAM Assassin and I am having trouble tracking down a problem. This started a week ago and appears to be random. We are having email ending up in the junk folder that has a score below the spam threshold. I was wondering if anyone had any suggestions on what to look for as far as configurations.

Below are a couple headers including the one from my registration for this Zimbra board that ended up in my junk folder this morning.

Return-Path: aibs_reston-report@aibs.org
Received: from tamago.aibs.org (LHLO tamago.aibs.org) (209.155.209.181) by
tamago.aibs.org with LMTP; Wed, 7 Apr 2010 09:24:58 -0400 (EDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
by tamago.aibs.org (Postfix) with ESMTP id CCF1114C0049;
Wed, 7 Apr 2010 09:24:57 -0400 (EDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.465
X-Spam-Level:
X-Spam-Status: No, score=-1.465 tagged_above=-10 required=6.6
tests=[ALL_TRUSTED=-1.8, AWL=-1.384, BAYES_00=-2.599,
DNS_FROM_OPENWHOIS=1.13, FH_DATE_PAST_20XX=3.188]
Received: from tamago.aibs.org ([127.0.0.1])
by localhost (tamago.aibs.org [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id ESVfC7ekSx15; Wed, 7 Apr 2010 09:24:57 -0400 (EDT)
Received: from aibs.org (aibs.org [209.155.209.182])
by tamago.aibs.org (Postfix) with ESMTP id F28F514C0048;
Wed, 7 Apr 2010 09:24:56 -0400 (EDT)
X-ListServer: CommuniGate Pro LIST 4.1.8
List-Unsubscribe: <mailto:**********@aibs.org>
List-ID: <********.aibs.org>
Message-ID: <list-8656024@aibs.org>
Sender: "Reston ListServ" <********@aibs.org>
To: "Reston ListServ" <********@aibs.org>
Precedence: list
X-Original-Message-Id: <p06240801c7e236f14761@[10.0.2.114]>
Date: Wed, 7 Apr 2010 09:21:02 -0400





Return-Path: forums@zimbra.com
Received: from tamago.aibs.org (LHLO tamago.aibs.org) (209.155.209.181) by
tamago.aibs.org with LMTP; Wed, 7 Apr 2010 09:54:51 -0400 (EDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
by tamago.aibs.org (Postfix) with ESMTP id 7B9C714C0044
for <********@aibs.org>; Wed, 7 Apr 2010 09:54:51 -0400 (EDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: 4.319
X-Spam-Level: ****
X-Spam-Status: No, score=4.319 tagged_above=-10 required=6.6
tests=[BAYES_50=0.001, DNS_FROM_OPENWHOIS=1.13,
FH_DATE_PAST_20XX=3.188]
Received: from tamago.aibs.org ([127.0.0.1])
by localhost (tamago.aibs.org [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id JLIxe1L7k-l0 for <jkruger@aibs.org>;
Wed, 7 Apr 2010 09:54:47 -0400 (EDT)
Received: from aibs.org (aibs.org [209.155.209.182])
by tamago.aibs.org (Postfix) with ESMTP id 67A0714C0047
for <jkruger@aibs.org>; Wed, 7 Apr 2010 09:54:47 -0400 (EDT)
Received: from [10.10.10.164] (HELO smtp2.aibs.org)
by aibs.org (CommuniGate Pro SMTP 4.1.8)
with ESMTP id 8656572 for ********@aibs.org; Wed, 07 Apr 2010 09:54:47 -0400
Received: from mta02.zimbra.com (mta02.zimbra.com [205.140.197.62])
by smtp2.aibs.org (Postfix) with ESMTP id E19FA198243
for <********@aibs.org>; Wed, 7 Apr 2010 09:51:54 -0400 (EDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
by mta02.zimbra.com (Postfix) with ESMTP id B09F7C78185
for <********@aibs.org>; Wed, 7 Apr 2010 06:50:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at zimbra.com
Received: from mta02.zimbra.com ([127.0.0.1])
by localhost (mta02.zimbra.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id bWahU3q-tcVQ for <********@aibs.org>;
Wed, 7 Apr 2010 06:49:50 -0700 (PDT)
Received: from www-prod-3.zimbra.com (www-prod-3.zimbra.com [10.113.62.162])
by mta02.zimbra.com (Postfix) with ESMTPS id 50565C78091
for <********@aibs.org>; Wed, 7 Apr 2010 06:49:50 -0700 (PDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
by www-prod-3.zimbra.com (8.13.8/8.13.8) with SMTP id o37DodNl005046
for <********@aibs.org>; Wed, 7 Apr 2010 06:50:40 -0700
Date: Wed, 07 Apr 2010 13:50:40 +0000
To: jkruger@aibs.org
From: "Zimbra - Forums" <forums@zimbra.com>
Auto-Submitted: auto-generated
Message-ID: <201004071339.5f6a3e331506@www.zimbra.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
X-Priority: 3
X-Mailer: vBulletin Mail via PHP
Subject: Action Required to Activate Membership for Zimbra - Forums
Content-Transfer-Encoding: quoted-printable

[uxbod]

Welcome to the forums

This has been covered many times recently :-

[SOLVED] FH_DATE_PAST_20XX - Spamassassin bug - incorrect tagging from Jan 1, 2010 on
[SOLVED] spamassassin: false positives from openwhois

[jkruger]

Thank you for the quick reply.

That flag got my attention but did not put the email over the threshold so I did not follow up on it. That is just the information I needed.

Thank you!

[ewilen]

Those should be corrected, but why would they cause his mail to go to Junk if its score is below the threshold?

Here's what I think could be going on: jkruger is using an IMAP or MAPI mail client such as Outlook, Mail.app, Thunderbird...and the client is doing its own spam classification.

Here's how to verify: for any given message that mysteriously appears in the Junk folder, see if it also ends up in the spam account. You might also look in zimbra.log and mailbox.log to check for the message being sent to spam and for the message being moved to Junk.

Messages that are identified as spam by amavisd are never forwarded to the spam account, and they never hit the inbox (they go straight to your Junk folder). So if you see any of the above, then I'll bet it's a mail client issue.