Re: Negative spam score evaluated to positive.

In the immortal words of Colin Dick  on 09/05/08 08:46:
> Hi everyone..
>   First post to this list and recent production server Vexim user.  Wondering if anyone has had any issues with 
> negative spam scores being evaluated positive?  Here is the /var/log/maillog entry:
> 
> Aug 30 11:33:42 mail spamd[21633]: spamd: checking message 
> <[email protected]> for mailnull:26
> Aug 30 11:33:44 mail spamd[21633]: spamd: result: . -2 - BAYES_00,HTML_MESSAGE 
> scantime=2.0,size=3484,user=mailnull,uid=26,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=49548,mid=<B160ACF
> [email protected]>,bayes=0.000000,autolearn=ham
> 
>   And here is the portions of the message headers my users forwarded me:
> 
>> ***** Start of Included E-mail ***** 
>> Authentication-Results: domain.net 
>>          [email protected]; domainkeys=neutral (no sig) 
>> Subject: Please call me 
>> Date: Sat, 30 Aug 2008 11:33:17 -0700 
>> X-MS-Has-Attach: 
>> X-MS-TNEF-Correlator: 
>> Thread-Topic: Please call me 
>> thread-index: AckKzt9JChe3MWf/QbyZBG76ujzb4A== 
>> From: "Sender" <[email protected]> 
>> To: "Receiver" <[email protected]> 
>> X-Outbound-IP: 1.2.3.4 
>> X-Env-From: [email protected] 
>> X-Virus-Status: Scanned by VirusSMART (c) 
>> X-BTI-AntiSpam: 
>> score:50,sta:off,dcc:off,dnsbl:passed,sw:off,bsn:30/passed,spf:off,dk:passed,pbmf:none,ipr:0/1,trusted:no, 
>> ts:no,bs:no,ubl:off 
>>
>> X-Spam-Score: -2.6 (--) 
>> X-Spam-Report: Spam detection software, running on the system 
>> "receiverdomain.net", has 
>>          identified this incoming email as possible spam.  The original 
>> message 
>>          has been attached to this so you can view it (if it isn't spam) or 
>> label 
>>          similar future email.  If you have any questions, see 
>>          The administrator of that system for details. 
>>          Content preview:  Omitted [...] 
>>          Content analysis details:   (-2.6 points, 5.0 required) 
>>          pts rule name              description 
>>          ---- ---------------------- 
>> -------------------------------------------------- 
>>          -2.6 BAYES_00               BODY: Bayesian spam probability is 0 
>> to 1% 
>>          [score: 0.0000] 
>>          0.0 HTML_MESSAGE           BODY: HTML included in message 
>>
>> Omitted
>> ***** End of Included E-mail ***** 
> 
>   Thanks in advance if anyone has any suggestions.

Hi Colin,


The main question I have to ask is, was this email rejected by 
spamassassin, or allowed through?

The default settings within spamassassin put the warning header into 
every single email, regardless of it's spam status.  It's more of a tag 
to say it's been scanned, rather than classifying it as spam.  Generally 
you can safely ignore what the content of the header says, the score 
stands as the final result.

I've been meaning to add in some code to my exim config to remove any 
headers which are below a certain threshold, but I've been too lazy to 
actually do it.

Cheers

Tim



-- 
Tim Aslat <[email protected]>
Spyderweb Consulting
http://www.spyderweb.com.au
Mobile: +61 0401088479