I'm tightening up spam protection and I have a weird mismatch between points.

By running from console:
su vpopmail -c "spamassassin -t < spammail.eml"

it outputs this:

Content analysis details:   (7.0 points, 5.0 required)

pts rule name              description
---- ---------------------- --------------------------------------------------
0.0 DK_POLICY_SIGNSOME     Domain Keys: policy says domain signs some mails
2.0 BAYES_80               BODY: Bayesian spam probability is 80 to 95%
                           [score: 0.8157]
4.0 RCVD_IN_UCEPROTECT1    RBL: Received via a blocked site in
                           dnsbl-1.uceprotect.net
                           [82.104.30.169 listed in dnsbl-1.uceprotect.net]
1.0 RCVD_IN_UCEPROTECT3    RBL: Received via a blocked site in
                           dnsbl-3.uceprotect.net
                           [82.104.30.169 listed in dnsbl-3.uceprotect.net]

But mail in my inbox shows this:

X-Spam-Status: No, score=2.4 required=5.0 tests=BAYES_00,DK_POLICY_SIGNSOME,
        RCVD_IN_UCEPROTECT1,RCVD_IN_UCEPROTECT3 autolearn=no version=3.1.8


Very interesting is the fact that it sees this email as BAYES_00, and in console test it recognises it as BAYES_80. Seems like in this case BAYES_00 probably gives negative value (-2.6 I presume) and that's why it doesn't get to the required 5.0 value. For info, this spam letter is very common and is very similar to bunch of others that have been learned manually before and that also have been identified correctly as spam in past. What could be the problem?

This is kinda spamassassin specific, but does anyone know if it's possible to configure that spamassassin puts scoretable into header, even thou it didn't exceed required hits (default 5.0).




---------------------------------------------------------------------
    QmailToaster hosted by: VR Hosted <http://www.vr.org>
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Reply via email to