Re: Negative spam score evaluated to positive.

Hi Tim,
  Thanks for the quick reply, wow.  The message was allowed through and it was only the header tags that were 
confusing us.  Your response clears things up I think ;).

  So the default message in the X-Spam-Report is a bit misleading then?  Do you know where that can be changed?

  I see there is code in the virtual_domains router to remove the headers if the message falls below sa_tag.  Perhaps 
your threshhold tweak is already handled in the default vexim-2.2.1 FreeBSD port configure:

virtual_domains:
  driver = redirect
  allow_fail
  data = ${lookup mysql{select smtp from users,domains \
                where localpart = '${quote_mysql:$local_part}' \
                and domain = '${quote_mysql:$domain}' \
                and domains.enabled = '1' \
                and users.enabled = '1' \
                and users.domain_id = domains.domain_id}}
  headers_add = ${if >{$spam_score_int}{${lookup mysql{select users.sa_tag * 10 from users,domains \
                where localpart = '${quote_mysql:$local_part}' \
                and domain = '${quote_mysql:$domain}' \
                and users.on_spamassassin = '1' \
                and users.domain_id=domains.domain_id }{$value}fail}} {X-Spam-Flag: YES\n}{} }
  headers_remove = ${if or { { <{$spam_score_int}{1} } \
                             { <{$spam_score_int}{${lookup mysql{select users.sa_tag * 10 from users,domains \
                               where localpart = '${quote_mysql:$local_part}' \
                               and domain = '${quote_mysql:$domain}' \
                               and users.on_spamassassin = 1 \
                               and users.domain_id=domains.domain_id}{$value}fail}} } \
                             { eq {0}{${lookup mysql{select users.sa_tag * 10 from users,domains \
                               where localpart = '${quote_mysql:$local_part}' \
                               and domain = '${quote_mysql:$domain}' \
                               and users.on_spamassassin = 0 \
                               and users.domain_id=domains.domain_id}{$value}fail}}} \
                           } {X-Spam-Score:X-Spam-Report} }
  local_part_suffix = -*
  local_part_suffix_optional
  retry_use_local_part
  file_transport = virtual_delivery
  reply_transport = address_reply
  pipe_transport = address_pipe

 In my case, the user had a on_forward set and the delivery was handled by dnslookup router (not .  Since I don't want 
to interfere with any downstream SA settings, I have changed dnslookup to remove the headers.  Do you see any problem 
with this.  Seems to work in testing (now ported to production):

dnslookup:
  driver = dnslookup
  domains = ! +local_domains
  headers_remove = X-Spam-Score:X-Spam-Report
  transport = remote_smtp
  ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8
  no_more

  Thanks in advance.  Hopefully you will know where to change that default message in the X-Spam-Report.

--
Colin Dick
OCIS Admin


On Fri, 05 Sep 2008 08:58:50 +0930, Tim Aslat wrote
> In the immortal words of Colin Dick  on 09/05/08 08:46:
> > Hi everyone..
> >   First post to this list and recent production server Vexim user.  Wondering if anyone has had any issues with 
> > negative spam scores being evaluated positive?  Here is the /var/log/maillog entry:
> > 
> > Aug 30 11:33:42 mail spamd[21633]: spamd: checking message 
> > <[email protected]> for mailnull:26
> > Aug 30 11:33:44 mail spamd[21633]: spamd: result: . -2 - BAYES_00,HTML_MESSAGE 
> > 
scantime=2.0,size=3484,user=mailnull,uid=26,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=49548,mid=<B160ACF
> > [email protected]>,bayes=0.000000,autolearn=ham
> > 
> >   And here is the portions of the message headers my users forwarded me:
> > 
> >> ***** Start of Included E-mail ***** 
> >> Authentication-Results: domain.net 
> >>          [email protected]; domainkeys=neutral (no sig) 
> >> Subject: Please call me 
> >> Date: Sat, 30 Aug 2008 11:33:17 -0700 
> >> X-MS-Has-Attach: 
> >> X-MS-TNEF-Correlator: 
> >> Thread-Topic: Please call me 
> >> thread-index: AckKzt9JChe3MWf/QbyZBG76ujzb4A== 
> >> From: "Sender" <[email protected]> 
> >> To: "Receiver" <[email protected]> 
> >> X-Outbound-IP: 1.2.3.4 
> >> X-Env-From: [email protected] 
> >> X-Virus-Status: Scanned by VirusSMART (c) 
> >> X-BTI-AntiSpam: 
> >> score:50,sta:off,dcc:off,dnsbl:passed,sw:off,bsn:30/passed,spf:off,dk:passed,pbmf:none,ipr:0/1,trusted:no, 
> >> ts:no,bs:no,ubl:off 
> >>
> >> X-Spam-Score: -2.6 (--) 
> >> X-Spam-Report: Spam detection software, running on the system 
> >> "receiverdomain.net", has 
> >>          identified this incoming email as possible spam.  The original 
> >> message 
> >>          has been attached to this so you can view it (if it isn't spam) or 
> >> label 
> >>          similar future email.  If you have any questions, see 
> >>          The administrator of that system for details. 
> >>          Content preview:  Omitted [...] 
> >>          Content analysis details:   (-2.6 points, 5.0 required) 
> >>          pts rule name              description 
> >>          ---- ---------------------- 
> >> -------------------------------------------------- 
> >>          -2.6 BAYES_00               BODY: Bayesian spam probability is 0 
> >> to 1% 
> >>          [score: 0.0000] 
> >>          0.0 HTML_MESSAGE           BODY: HTML included in message 
> >>
> >> Omitted
> >> ***** End of Included E-mail ***** 
> > 
> >   Thanks in advance if anyone has any suggestions.
> 
> Hi Colin,
> 
> The main question I have to ask is, was this email rejected by 
> spamassassin, or allowed through?
> 
> The default settings within spamassassin put the warning header into 
> every single email, regardless of it's spam status.  It's more of a tag 
> to say it's been scanned, rather than classifying it as spam.  Generally 
> you can safely ignore what the content of the header says, the score 
> stands as the final result.
> 
> I've been meaning to add in some code to my exim config to remove any 
> headers which are below a certain threshold, but I've been too lazy to 
> actually do it.
> 
> Cheers
> 
> Tim
> 
> -- 
> Tim Aslat <[email protected]>
> Spyderweb Consulting
> http://www.spyderweb.com.au
> Mobile: +61 0401088479
> 
> _______________________________________________
> Vexim mailing list
> [email protected]
> http://silverwraith.com/mailman/listinfo/vexim