Justin Kim wrote: >> Gary wrote: >> >> >>> Justin wrote: >>> >>>> Hello Everyone, >>>> I am using amavis with postfix+mysql setup. >>>> Amavis is scanning messages and is reinjecting messages to >>>> >> postfix through >> >>>> smtp. >>>> I would like to know how can I manage spam scores so that >>>> >> certain domain >> >>>> like yahoo.com is not getting high score. >>>> My user requested that there are false positive when it is sent from >>>> specific yahoo.com account. >>>> Please help! >>>> Justin >>>> >>> One way would be to use @score_sender_maps. If you don't have >>> this in amavisd.conf then look for it in amavisd.conf-sample >>> under the heading: >>> >>> # ENVELOPE SENDER SOFT-WHITELISTING / SOFT-BLACKLISTING >>> >>> Look at both the per-recipient and site-wide examples and place >>> your entries in the appropriate position(s). >>> >> Another possibly method is to determine exactly what particular rule >> is causing the false positive and then zero out the score of that >> rule in local.cf. >> >> score SOME_YAHOO_RULE 0 >> >> What version of SA? >> >> Gary V >> >> > Thanks Gary, > My SA version is 3.1.8 on redhat. > Amavisd-new version 2.4.5 > I couldn't find the yahoo score on /usr/share/spamassassin/50_scores.cf > > Spam scores are: > > X-Spam-Flag: YES > X-Spam-Score: 6.116 > X-Spam-Level: ****** > X-Spam-Status: Yes, score=6.116 tagged_above=-999 required=5 > tests=[BIZ_TLD=1.169, DNS_FROM_RFC_ABUSE=0.479, > DNS_FROM_RFC_POST=1.44, DNS_FROM_RFC_WHOIS=0.879, HTML_10_20=0.945, > HTML_MESSAGE=0.001, MAILTO_TO_SPAM_ADDR=0.276, > MSGID_FROM_MTA_ID=0.927] > > I do not know if I am on the right track to 0 out yahoo scores. >
MSGID_FROM_MTA_ID is intriguing. are you sure the mail came from yahoo? consider enabling Bayes and training on errors. You can lower the scores of DNS_FROM_RFC_* just enough so that the score gets below 5. Or you can write meta rules to cancel these if the sending domain is yahoo and the like (maybe too much work though). if you get enough legitimate mail related to .biz domains, you may consider lowering the score of BIZ_TLD. ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
