Re: Whitelisted, but marked as spam
Bret Miller wrote: > You would think that whitelist should be given a lower number than > -1.0. Otherwise, how does it counteract the many other rule additons. > > How about adding: > score USER_IN_WHITELIST -20 > score USER_IN_WHITELIST_TO -20 > to your local.cf so that it does actually "whitelist". > > Bret > Normally it would but the 50_scores.cf where this score is defined was removed.
RE: Whitelisted, but marked as spam
You would think that whitelist should be given a lower number than -1.0.
Otherwise, how does it counteract the many other rule additons.
How about adding:
score USER_IN_WHITELIST -20
score USER_IN_WHITELIST_TO -20
to your local.cf so that it does actually "whitelist".
Bret
> -Original Message-
> From: Thijs Koetsier | Exception IT
> [mailto:[EMAIL PROTECTED]
> Sent: Tuesday, September 27, 2005 11:44 AM
> To: users@spamassassin.apache.org
> Subject: RE: Whitelisted, but marked as spam
>
> In addition to my mail just send;
>
> This is the e-mail recieved by the user. Shouldn't
> "user_in_whitelist" to
> score -100 and "user_in_all_spam_to" be also at least more than -1.0?
>
> Spam detection software, running on the system
> "zoltar.exception.nl", has
> identified this incoming email as possible spam. The
> original message has
> been attached to this so you can view it (if it isn't spam)
> or label similar
> future email. If you have any questions, see the
> administrator of that
> system for details.
>
> Content preview: ASCI Technologies maillog 27-09-2005 ASCI
> Technologies
> Filialen in -Assen -Emmen -Enschede -Groningen -Tilburg -en
> Winschoten
> [...]
>
> Content analysis details: (5.4 points, 5.0 required)
>
> pts rule name description
> --
> --
> 1.0 MIME_BOUND_RKFINDY Spam tool pattern in MIME
> boundary (rfkindy)
> 1.0 X_LIBRARY Message has X-Library header
> -1.0 USER_IN_WHITELIST From: address is in the user's white-list
> -1.0 USER_IN_WHITELIST_TO User is listed in 'whitelist_to'
> -1.0 USER_IN_ALL_SPAM_TOUser is listed in 'all_spam_to'
> 1.0 HTML_60_70 BODY: Message is 60% to 70% HTML
> 1.0 HTML_BADTAG_00_10 BODY: HTML message is 0% to 10% bad tags
> 1.0 HTML_TAG_EXIST_TBODY BODY: HTML has "tbody" tag
> -1.0 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> [score: 0.] 1.0
> HTML_TAG_EXIST_MARQUEE
> BODY: HTML has "marquee" tag
> 1.0 MIME_HTML_MOSTLY BODY: Multipart message mostly
> text/html MIME
> 1.0 HTML_MESSAGE BODY: HTML included in message
> 1.0 MPART_ALT_DIFF BODY: HTML and text parts are different
> 1.0 HTML_NONELEMENT_00_10 BODY: 0% to 10% of HTML elements are
> non-standard
> 1.0 MIME_BOUND_NEXTPARTSpam tool pattern in MIME boundary
> -1.6 AWLAWL: From: address is in the auto
> white-list
>
> The original message was not completely plain text, and may
> be unsafe to
> open with some email clients; in particular, it may contain a
> virus, or
> confirm that your address can receive spam. If you wish to
> view it, it may
> be safer to save it to a file and open it with an editor.
>
> Cheers,
> Thijs
>
>
> -Oorspronkelijk bericht-
> Van: Thijs Koetsier | Exception IT
> [mailto:[EMAIL PROTECTED]
> Verzonden: dinsdag 27 september 2005 20:33
> Aan: users@spamassassin.apache.org
> Onderwerp: Whitelisted, but marked as spam
>
> Hi all,
>
> I'm having messages marked as spam, for users who are in my whitelist.
>
> In /etc/mail/spamassasin/whitelist.cf are these lines (among others):
> all_spam_to [EMAIL PROTECTED]
> whitelist_to [EMAIL PROTECTED]
> whitelist_to [EMAIL PROTECTED]
> Whitelist_from[EMAIL PROTECTED]
> (it is this thourough because I didn't get this to work)
>
> However, the user is still getting messages marked as spam,
> as is show in
> the header below.
> As you can see, the subject is rewritten with {Spam}, the
> spam status is
> 5.4, but below that also is marked as being in the all_spam,
> whitelist_from
> and whitelist_to.
>
> Return-path: <[EMAIL PROTECTED]>
> Envelope-to: [EMAIL PROTECTED]
> Delivery-date: Tue, 27 Sep 2005 19:17:11 +0200
> Received: from Debian-exim by zoltar.exception.nl with
> spam-scanned (Exim
> 4.52)
> id 1EKJ4o-0001TP-Rn
> for [EMAIL PROTECTED]; Tue, 27 Sep 2005 19:17:11 +0200
> Received: from localhost by zoltar.exception.nl
> with SpamAssassin (version 3.0.4);
> Tue, 27 Sep 2005 19:17:11 +0200
> From: "User1" <[EMAIL PROTECTED]>
> To: "User1" <[EMAIL PROTECTED]>
> Subject: {Spam} Maillog 27-09-2005
> Date: Tue, 27 Sep 2005 19:17:07 +0200
> X-Spam-Flag: YES
> X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on
> zoltar.exception.nl
> X-Spam-Level: *
> X-Spam-Status: Yes, score=5.4 required=5.0
> tests=AWL,BAYES
RE: Whitelisted, but marked as spam
Ehrm, yeah... Do you remember my thread some days earlier where Bob mentioned to remove any old .cf files who gave troubles linting? I guess you found the solution for my problem... Thanks! Sorry; I'm kinda new to this... Cheers, Thijs -Oorspronkelijk bericht- Van: Fred [mailto:[EMAIL PROTECTED] Verzonden: dinsdag 27 september 2005 20:49 Aan: [EMAIL PROTECTED] Onderwerp: Re: Whitelisted, but marked as spam It appears all of the rules are being scored 1.0, did you by chance remove the 50_scores.cf file? Fred
RE: Whitelisted, but marked as spam
In addition to my mail just send;
This is the e-mail recieved by the user. Shouldn't "user_in_whitelist" to
score -100 and "user_in_all_spam_to" be also at least more than -1.0?
Spam detection software, running on the system "zoltar.exception.nl", has
identified this incoming email as possible spam. The original message has
been attached to this so you can view it (if it isn't spam) or label similar
future email. If you have any questions, see the administrator of that
system for details.
Content preview: ASCI Technologies maillog 27-09-2005 ASCI Technologies
Filialen in -Assen -Emmen -Enschede -Groningen -Tilburg -en Winschoten
[...]
Content analysis details: (5.4 points, 5.0 required)
pts rule name description
--
--
1.0 MIME_BOUND_RKFINDY Spam tool pattern in MIME boundary (rfkindy)
1.0 X_LIBRARY Message has X-Library header
-1.0 USER_IN_WHITELIST From: address is in the user's white-list
-1.0 USER_IN_WHITELIST_TO User is listed in 'whitelist_to'
-1.0 USER_IN_ALL_SPAM_TOUser is listed in 'all_spam_to'
1.0 HTML_60_70 BODY: Message is 60% to 70% HTML
1.0 HTML_BADTAG_00_10 BODY: HTML message is 0% to 10% bad tags
1.0 HTML_TAG_EXIST_TBODY BODY: HTML has "tbody" tag
-1.0 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
[score: 0.] 1.0 HTML_TAG_EXIST_MARQUEE
BODY: HTML has "marquee" tag
1.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
1.0 HTML_MESSAGE BODY: HTML included in message
1.0 MPART_ALT_DIFF BODY: HTML and text parts are different
1.0 HTML_NONELEMENT_00_10 BODY: 0% to 10% of HTML elements are
non-standard
1.0 MIME_BOUND_NEXTPARTSpam tool pattern in MIME boundary
-1.6 AWLAWL: From: address is in the auto white-list
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus, or
confirm that your address can receive spam. If you wish to view it, it may
be safer to save it to a file and open it with an editor.
Cheers,
Thijs
-Oorspronkelijk bericht-
Van: Thijs Koetsier | Exception IT [mailto:[EMAIL PROTECTED]
Verzonden: dinsdag 27 september 2005 20:33
Aan: users@spamassassin.apache.org
Onderwerp: Whitelisted, but marked as spam
Hi all,
I'm having messages marked as spam, for users who are in my whitelist.
In /etc/mail/spamassasin/whitelist.cf are these lines (among others):
all_spam_to [EMAIL PROTECTED]
whitelist_to[EMAIL PROTECTED]
whitelist_to[EMAIL PROTECTED]
Whitelist_from [EMAIL PROTECTED]
(it is this thourough because I didn't get this to work)
However, the user is still getting messages marked as spam, as is show in
the header below.
As you can see, the subject is rewritten with {Spam}, the spam status is
5.4, but below that also is marked as being in the all_spam, whitelist_from
and whitelist_to.
Return-path: <[EMAIL PROTECTED]>
Envelope-to: [EMAIL PROTECTED]
Delivery-date: Tue, 27 Sep 2005 19:17:11 +0200
Received: from Debian-exim by zoltar.exception.nl with spam-scanned (Exim
4.52)
id 1EKJ4o-0001TP-Rn
for [EMAIL PROTECTED]; Tue, 27 Sep 2005 19:17:11 +0200
Received: from localhost by zoltar.exception.nl
with SpamAssassin (version 3.0.4);
Tue, 27 Sep 2005 19:17:11 +0200
From: "User1" <[EMAIL PROTECTED]>
To: "User1" <[EMAIL PROTECTED]>
Subject: {Spam} Maillog 27-09-2005
Date: Tue, 27 Sep 2005 19:17:07 +0200
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on
zoltar.exception.nl
X-Spam-Level: *
X-Spam-Status: Yes, score=5.4 required=5.0 tests=AWL,BAYES_00,HTML_60_70,
HTML_BADTAG_00_10,HTML_MESSAGE,HTML_NONELEMENT_00_10,
HTML_TAG_EXIST_MARQUEE,HTML_TAG_EXIST_TBODY,MIME_BOUND_NEXTPART,
MIME_BOUND_RKFINDY,MIME_HTML_MOSTLY,MPART_ALT_DIFF,
USER_IN_ALL_SPAM_TO,USER_IN_WHITELIST,USER_IN_WHITELIST_TO,X_LIBRARY
autolearn=no version=3.0.4
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="--=_43397E97.410A444D"
Message-Id: <[EMAIL PROTECTED]>
If anyone can enlighten this for me, it would be greatly appreciated!
Cheers,
Thijs
Re: Whitelisted, but marked as spam
Thijs Koetsier | Exception IT wrote: > X-Spam-Status: Yes, score=5.4 required=5.0 > tests=AWL,BAYES_00,HTML_60_70, > HTML_BADTAG_00_10,HTML_MESSAGE,HTML_NONELEMENT_00_10, > HTML_TAG_EXIST_MARQUEE,HTML_TAG_EXIST_TBODY,MIME_BOUND_NEXTPART, > MIME_BOUND_RKFINDY,MIME_HTML_MOSTLY,MPART_ALT_DIFF, > USER_IN_ALL_SPAM_TO,USER_IN_WHITELIST,USER_IN_WHITELIST_TO,X_LIBRARY Since you have AWL in there, I would check to see what AWL is scoring this message.
