On 08/12/2010 09:42 PM, Hajid wrote:
X-Spam-Status: No, score=-66.8 required=5.0 tests=AWL,BAYES_99,
FH_DATE_PAST_20XX,FH_FAKE_RCVD_LINE,FORGED_HOTMAIL_RCVD2,INVALID_MSGID,
MIME_BOUND_DD_DIGITS,MIME_QP_LONG_LINE,MISSING_HEADERS,MISSING_MIMEOLE,
MSGID_MULTIPLE_AT,RCVD_DOUBLE_IP_SPAM,RCVD_HELO_IP_MISMATCH,RCVD_IN_PBL,
RCVD_IN_SORBS_DUL,RCVD_NUMERIC_HELO,RDNS_NONE,SUBJECT_NEEDS_ENCODING,
SUBJ_ILLEGAL_CHARS,TVD_SPACE_RATIO,USER_IN_WHITELIST autolearn=no
The problem appears to be here:
USER_IN_WHITELIST
You have the user defined in your local.cf file as whitelisted, so
they start with a -100 score. As spamassassin adds together all of the
positive scores, they end up with a -66.8, so this user will never
have their mail deleted as spam.
Could it be a wildcard whitelist for hotmail in local.cf? Because I
doubt this user would have been manually added to local.cf.
Bharath
Possible. It would only be guessing until the local.cf is provided.
At local.cf I added whitelist_from *...@hotmail.com <mailto:*...@hotmail.com>.
My others question, why this server can be as spammer. This server not
openrelay.i still looking for this.
You whitelisted everyone at hotmail.com, so every email that comes from
someone at hotmail.com starts with a score of -100 (note that is a
NEGATIVE sign before the 100). So the incoming email hit all of these rules:
FH_DATE_PAST_20XX,FH_FAKE_RCVD_LINE,FORGED_HOTMAIL_RCVD2,INVALID_MSGID,
MIME_BOUND_DD_DIGITS,MIME_QP_LONG_LINE,MISSING_HEADERS,MISSING_MIMEOLE,
MSGID_MULTIPLE_AT,RCVD_DOUBLE_IP_SPAM,RCVD_HELO_IP_MISMATCH,RCVD_IN_PBL,
RCVD_IN_SORBS_DUL,RCVD_NUMERIC_HELO,RDNS_NONE,SUBJECT_NEEDS_ENCODING,
SUBJ_ILLEGAL_CHARS,TVD_SPACE_RATIO
Which added to a score of 33.2 which would normally cause the message to
be deleted, but since all users at hotmail.com start with a -100, it
only added the score to -66.8, which is still 71.8 points away from even
being marked as spam.
To stop these types of messages you need to remove the whitelisting for
hotmail.com (possibly only whitelist individual addresses?) and possibly
adjust your spam rules and their scoring.
The system worked as designed. It accepted a message (you have not shown
us enough of the headers to really know what was going on), and scored
it exactly how you told it to score messages.
