Re: SpamAssassin does not scan consistently
On 09.02.17 09:34, Motty Cruz wrote: Although both of this emails were blocked, both emails were really spammy; one received high score while the other was percentage point away from passing through. My question pertains to spamassassin not consistently given "razor score, URIBL, T_REMOTE_IMAGE" to all emails. It is not being more aggressive? Use greylisting to delay email, in order to allow URIBLs to first receive copies of the spam, so that it gets into their databases. In my case, I delay "suspicious" looking emails for a longer period of time. I define "suspicious" based on certain spamassassin rules, that by themselves, either have a low or no score (such as __FILL_THIS_FORM_SHORT). This is my customized method. I suspect other people are doing something similar. I had to do this, because I had complaints of real mail getting delayed for too long a time period. Mark London Natick, May
Re: SpamAssassin does not scan consistently
On 09.02.17 09:34, Motty Cruz wrote: Although both of this emails were blocked, both emails were really spammy; one received high score while the other was percentage point away from passing through. My question pertains to spamassassin not consistently given "razor score, URIBL, T_REMOTE_IMAGE" to all emails. It is not being more aggressive? network tests and BAYES change over time. early recipients don't get hits when mail is received, but they often do later. other rules change, when SA is updated with new rules... ## Optional Score Increases score DCC_CHECK 4.000 score RAZOR2_CHECK 2.500 DCC indicates bulkiness, while RAZOR indicated spamminess. I really wonder why you put DCC higher score than RAZOR... -- Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Silvester Stallone: Father of the RISC concept.
SpamAssassin does not scan consistently
Although both of this emails were blocked, both emails were really spammy; one received high score while the other was percentage point away from passing through. My question pertains to spamassassin not consistently given "razor score, URIBL, T_REMOTE_IMAGE" to all emails. It is not being more aggressive? X-Quarantine-ID: X-Spam-Flag: YES X-Spam-Score: 5.502 X-Spam-Level: * X-Spam-Status: Yes, score=5.502 tag=-999.9 tag2=5.4 kill=5.5 tests=[BAYES_999=0.2, BAYES_99=5.3, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001] autolearn=no autolearn_force=no Received: from m1.fqdn.com ([127.0.0.1]) X-Quarantine-ID: X-Spam-Flag: YES X-Spam-Score: 16.578 X-Spam-Level: X-Spam-Status: Yes, score=16.578 tag=-999.9 tag2=5.4 kill=5.5 tests=[BAYES_999=0.2, BAYES_99=5.3, HTML_MESSAGE=0.001, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E8_51_100=1.886, RAZOR2_CHECK=2.5, T_REMOTE_IMAGE=1.99, URIBL_BLACK=1.7, URIBL_DBL_SPAM=2.5, URI_TRY_USME=0.001] autolearn=no autolearn_force=no local.cf ## Optional Score Increases score DCC_CHECK 4.000 score RAZOR2_CHECK 2.500 score BAYES_99 5.300 score BAYES_90 4.500 score BAYES_80 4.000 # For scores have a look at /usr/local/share/spamassassin/50_scores.cf # file. score HTML_FONT_INVISIBLE 3 score HTML_FONTCOLOR_UNKNOWN 2 score ORDER_NOW 1.5 score CLICK_BELOW 1 score LIMITED_TIME_ONLY 1 # This rule might be extreme but html only spams get through too easy. # In other words, if you can't take the time to write something and are # posting an image only, then you're 86'd! score HTML_IMAGE_ONLY_02 2 score HTML_IMAGE_ONLY_04 2 score OFFERS_ETC 2 score HTML_LINK_CLICK_HERE 1 score LINES_OF_YELLING 1 score RP_MATCHES_RCVD 0 # adding more feb 8 2017 score BODY_ENHANCEMENT 5.213 Thanks, Motty
