Re: FW: spam scores being neutralized by bayes

I've noticed that the problem I have with spam getting through is the 
spamassassin rule RP_MATCHES_RCVD. This rule is set at -1.429 and 
spammers know this. My ham doesn't need this rule. I tried to change its 
value in local.cf (score RP_MATCHES_RCVD 0.01), but it isn't working. Is 
there something I need to do with maia? I know we don't use spamd so 
that can't be it. Any thoughts?

I don't think Bayes is the culprit with me. It's the RP_MATCHES rule the 
spammers are tripping.

Thanks,
Bob

On 7/14/2015 2:00 AM, Jason Street wrote:
> Thank you all,
>
> Joshua, I think this is the route I'll have to take, bayes just 
> appears to be problematic at this stage.  Any spam actually being 
> caught as spam, removing bayes is not going to do much score wise
>
> I have seen a massive increase in spam getting through, all coming 
> from .eu and .xyz addresses and all being allowed through thanks to 
> Bayes  doing a "-1.900 BAYES_00"
>
>
> Although maybe just as worryingly, I've had spam hit the bayes rule 
> *and*  "-2.200 RCVD_IN_IADB_VOUCHED".   Looks like the spammers are 
> getting better...
>
> 1.347     RCVD_IN_BL_SPAMCOP_NET     Received via a relay in 
> bl.spamcop.net
> 0.100     DKIM_SIGNED     Domain Keys Identified Mail: message has a 
> signature
> 0.010     T_REMOTE_IMAGE     (No description provided)
> 0.001     HTML_MESSAGE     HTML included in message
> -0.001     SPF_PASS     SPF: sender matches SPF record
> -0.001     RCVD_IN_IADB_LISTED     Participates in the IADB system
> -0.001     RCVD_IN_IADB_SENDERID     IADB: Sender publishes Sender ID 
> record
> -0.010     T_RP_MATCHES_RCVD     Envelope sender domain matches 
> handover relay domain
> -0.059     RCVD_IN_IADB_SPF     IADB: Sender publishes SPF record
> -0.100     DKIM_VALID     Message has at least one valid DKIM or DK 
> signature
> -0.235     RCVD_IN_IADB_RDNS     IADB: Sender has reverse DNS record
> -1.470     RCVD_IN_IADB_OPTIN     IADB: All mailing list mail is opt-in
> -1.900     BAYES_00     Bayesian spam probability is 0 to 1%
> -2.200     RCVD_IN_IADB_VOUCHED     ISIPP IADB lists as vouched-for 
> sender
>
>
>
> ¬¬JS
>
>
> On 2015-07-08 23:13, Joshua Small wrote:
>> Your point below was always my issue with Bayes. The whole "you just
>> need to train it" argument might be fine for users of this list, but
>> the customers running these products are comparing them to everything
>> else on the market, which "just works".
>>
>> Given I pretty much never saw Bayes trained correctly, I've only ever
>> seen bayes fall into these categories: Spam flagged as spam that would
>> have been captured by other rules anyway, spam that would have been
>> flagged and quarantined if not for an incorrect negative bayes score,
>> and mail flagged as spam by Bayes that was a false positive. In short,
>> I disabled bayes on all my environments.
>>
>> -----Original Message-----
>> From: Maia-users [mailto:[email protected]] On Behalf
>> Of Jason Street
>> Sent: Wednesday, 8 July 2015 9:13 PM
>> To: Blake Hudson
>> Cc: [email protected]
>> Subject: Re: [Maia-users] spam scores being neutralized by bayes
>>
>> On 2015-07-07 15:23, Blake Hudson wrote:
>>> Jason, it sounds like your Bayes database has learned SPAM. This could
>>> be from incorrect user reports (messages were reported as NOT SPAM
>>> when they were SPAM) or from auto learning.
>>
>> Potentially but the users are pretty hands off and ignore their cache
>> contents in the web interface, except for checking the spam cache for
>> anything valid caught.
>>
>> For the most occasion "non-spam cache" is ignored and left to be auto 
>> cleared.
>>
>>> My suggestion is to turn off auto learning (bayes_auto_learn 0 in
>>> local.cf) and use Maia's digest function to confirm HAM/SPAM daily in
>>> order to train bayes. To help speed up the learning you may want to
>>> clear out your current bayes db. You can do this with the
>>> maiadbtool.pl script and the --clear-bayes option.
>>
>> Forgive me ignorance  but how do I do the digest function you suggest?
>>
>> _______________________________________________
>> Maia-users mailing list
>> [email protected]
>> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>> _______________________________________________
>> Maia-users mailing list
>> [email protected]
>> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users
>
> _______________________________________________
> Maia-users mailing list
> [email protected]
> http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users

_______________________________________________
Maia-users mailing list
[email protected]
http://www.renaissoft.com/cgi-bin/mailman/listinfo/maia-users