Re: Score from command line is different from the one in the webmail
Thanks Mathus, I think this was the case. After running spamassassin -D as suggested in #spamassassin, DNS responses were mainly NXDOMAIN. I have put DNS related output in this gist : https://gist.githubusercontent.com/ychaouche/b412a7e5cb4c9501365c010734045eb9/raw/c3a69d7bf7dfdfe1d987489a15196488245d3b16/gistfile1.txt Sent with ProtonMail Secure Email. ‐‐‐ Original Message ‐‐‐ On July 15, 2018 4:12 PM, Matus UHLAR - fantomas wrote: > On 15.07.18 07:41, daniel_1...@protonmail.com wrote: > > > X-Spam-Status: No, score=2.621 tagged_above=-999 required=5 > > > > tests=[HTML_IMAGE_ONLY_08=1.781, HTML_IMAGE_RATIO_08=0.001, > > > > HTML_MESSAGE=0.001, HTML_SHORT_LINK_IMG_1=0.139, > > > > MAILING_LIST_MULTI=-1, SPF_PASS=-0.001, URIBL_BLACK=1.7] > > > > autolearn=no autolearn_force=no > > > At the end of X-Spam-Status, you can see URIBL_BLACK=1.7 > > > But when I scan the mail from the command line I have a different score of > > only 0.9 and no URIBL_BLACK match : > > it's quite common that some blacklist appear/disappear when checking the > > same mail after some time. > > > Why do I have different scores and how do I get same score on both > > configurations ? > > you can't get the same score when the URI is not in blacklist anymore. > > > -- > > Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ > > Warning: I wish NOT to receive e-mail advertising to this address. > > Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. > > Nothing is fool-proof to a talented fool.
Re: Score from command line is different from the one in the webmail
On 15.07.18 07:41, daniel_1...@protonmail.com wrote: X-Spam-Status: No, score=2.621 tagged_above=-999 required=5 tests=[HTML_IMAGE_ONLY_08=1.781, HTML_IMAGE_RATIO_08=0.001, HTML_MESSAGE=0.001, HTML_SHORT_LINK_IMG_1=0.139, MAILING_LIST_MULTI=-1, SPF_PASS=-0.001, URIBL_BLACK=1.7] autolearn=no autolearn_force=no At the end of X-Spam-Status, you can see URIBL_BLACK=1.7 But when I scan the mail from the command line I have a different score of only 0.9 and no URIBL_BLACK match : it's quite common that some blacklist appear/disappear when checking the same mail after some time. Why do I have different scores and how do I get same score on both configurations ? you can't get the same score when the URI is not in blacklist anymore. -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Nothing is fool-proof to a talented fool.
Re: Score from command line is different from the one in the webmail
daniel_1...@protonmail.com skrev den 2018-07-15 15:59: Postfix is run under postfix +1 Amavis is run under user amavis +1 I don't really know how spamassassin is run ? only root can drop priveledges maybe it's loaded as a library from amavis itself ? yes amavis loads perl modules of spamassaasin so spamassassin runs as amavis system user
Re: Score from command line is different from the one in the webmail
On July 15, 2018 12:57 PM, Antony Stone wrote: > On Sunday 15 July 2018 at 13:41:34, daniel_1...@protonmail.com wrote: > > I am running spamassassin through amavis as a content filter for postfix. > > Which user/s do those processes run as? > Postfix is run under postfix Amavis is run under user amavis I don't really know how spamassassin is run ? maybe it's loaded as a library from amavis itself ? root@messagerie[10.10.10.19] /etc/postfix # lsof -u amavis | grep spam /usr/sbin 1428 amavis memREG8,6 750728671620 /var/lib/spamassassin/compiled/5.020/3.004000/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so /usr/sbin 25702 amavis memREG8,6 750728671620 /var/lib/spamassassin/compiled/5.020/3.004000/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so /usr/sbin 28419 amavis memREG8,6 750728671620 /var/lib/spamassassin/compiled/5.020/3.004000/auto/Mail/SpamAssassin/CompiledRegexps/body_0/body_0.so root@messagerie[10.10.10.19] /etc/postfix # Here's the score as user amavis (I had to create a copy of the file in /tmp/ and make it world readable, because the owner is vmail, the user under which dovecot runs) : root@messagerie[10.10.10.19] /var/vmail/mydomain/a.chaouche/.Junk/cur # su amavis -c 'spamassassin -dt < /tmp/mailfrancoise' [...] Spam detection software, running on the system "messagerie-prep", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: It's incredibly confusing and drives me on simultaneously. Watch until I removed it from the access. Unsubscribe It's incredibly confusing and drives me on simultaneously. Watch until I removed it from the access. [...] Content analysis details: (0.9 points, 5.0 required) pts rule name description -- -- 0.0 HTML_IMAGE_RATIO_08BODY: HTML has a low ratio of text to image area 0.0 HTML_MESSAGE BODY: HTML included in message 1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words 0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image -1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager
Re: Score from command line is different from the one in the webmail
On Sunday 15 July 2018 at 13:41:34, daniel_1...@protonmail.com wrote: > Dear list, > > I am running spamassassin through amavis as a content filter for postfix. Which user/s do those processes run as? > But when I scan the mail from the command line I have a different score of > only 0.9 and no URIBL_BLACK match : > > root@messagerie So, you test the message as root (which I seriously hope is not the user your MTA and SA are being run as during normal mail processing). > Why do I have different scores and how do I get same score on both > configurations ? Try running the SA check as the correct user; if the scores and tests are still different, feel free to report back here. Regards, Antony. -- What do you call a dinosaur with only one eye? A Doyouthinkesaurus. Please reply to the list; please *don't* CC me.
