[SOLVED] Spamassassin not working as well

[markd]

Starting Jan 1st 2011, emails normally treated as spam seem to be making it
through to the Inbox. I thought this might be related to
FH_DATE_PAST_20XX - Spamassassin bug but that seems like it would
work against this issue.

Did something change how scoring works? We have not made any changes to the default install for this version 6.0.8. Correction: I changed score for
the.. DATA_PAST_20XX to 0.0 as suggested.

Can a user screw up the scoring for just themself ?

Here is an example,

Return-Path: denmark22938bump@tehrantimes.com
Received: from zimbra.mydomain.com (LHLO zimbra.mydomain.com)
(192.168.20.70) by zimbra.mydomain.com with LMTP; Thu, 6 Jan 2011
11:04:17 -0800 (PST)
Received: from localhost (localhost.localdomain [127.0.0.1])
by zimbra.mydomain.com (Postfix) with ESMTP id B552023A7A
for <example@mydomain.com>; Thu, 6 Jan 2011 11:04:17 -0800 (PST)
X-Spam-Flag: NO
X-Spam-Score: 6.194
X-Spam-Level: ******
X-Spam-Status: No, score=6.194 tagged_above=-10 required=6.6
tests=[BAYES_99=3.5, FSL_HELO_NON_FQDN_1=0.001, HK_NAME_DRUGS=0.552,
HTML_MESSAGE=0.001, RCVD_IN_BL_SPAMCOP_NET=1.347, RDNS_NONE=0.793]
autolearn=no
Received: from zimbra.mydomain.com ([127.0.0.1])
by localhost (zimbra.mydomain.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 3JYZimK4RWgi for <example@mydomain.com>;
Thu, 6 Jan 2011 11:04:13 -0800 (PST)
Received: from wainakh552fbba (unknown [195.54.52.66])
by zimbra.mydomain.com (Postfix) with SMTP id 18C7823A79
for <example@mydomain.com>; Thu, 6 Jan 2011 11:04:12 -0800 (PST)
Received: (qmail 2293 by uid 293); Thu, 6 Jan 2011 20:04:03 -0100
From: "Free ****** And Cialis" <denmark22938bump@tehrantimes.com>
To: <example@mydomain.com>
Subject: Don't suffer in silence with ED
Date: Thu, 6 Jan 2011 19:57:35 -0100
Message-ID: <003601cbade5$2eae9320$8c0bb960$@com>
MIME-Version: 1.0

[Krishopper]

One thing I did to help was made the RCVD_IN_BL_* scores a bit higher, as well as BAYES_99.

[markd]

Thanks, I will take a look at those values.

I would still like some insight to as why / what has changed.
It was working and then stopped or so it appears.

[markd]

Not sure what the default score is suppose to be for spam.
Many WIKI pages state 5.0. I noticed the current setting was 6.6
so I moved it back to 5.0. This helped although not the usual
great job. Then I added the following RBLs.

zimbraMtaRestriction: reject_invalid_hostname
zimbraMtaRestriction: reject_non_fqdn_sender
zimbraMtaRestriction: reject_unknown_sender_domain
zimbraMtaRestriction: reject_rbl_client bl.spamcop.net
zimbraMtaRestriction: reject_rbl_client zen.spamhaus.org

This helped a lot but still not the same so I looked to see if
the RBLs were working, I couldn't find any "Blocked" messages.

Ironically, I was working on a different DNS issue when I found the
following option was being used in DNSMasq - dd-wrt : "No DNS Rebind"
I believe this prevented the responses from the RBL from being returned.
After unchecking the option, we start to see the Blocking again.
Note, I don't recall the config option name in dnsmasq.conf as I used
the dd-wrt gui for setting / removing the option.

My bad, I changed routers about the same time. Not sure how the
option was set but it was.