From my point of view, it's very hard to comment because I don't see these.
Can you throw a spample with headers somewhere? Or email me privately if sensitive. Regards, KAM On November 5, 2017 6:50:47 AM EST, Cecil Westerhof <ce...@decebal.nl> wrote: >I think I get almost a year almost daily messages with this kind of >header: > Return-Path: <i...@vlanmail.be> >X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on >munus.decebal.nl > X-Spam-Level: ** > X-Spam-Status: No, score=2.9 required=3.0 tests=BAYES_80,DKIM_SIGNED, >DKIM_VALID,DKIM_VALID_AU,FROM_EXCESS_BASE64,HTML_MESSAGE,RP_MATCHES_RCVD > autolearn=no autolearn_force=no version=3.4.1 > Delivered-To: … > Received: … > X-Virus-Scanned: Debian amavisd-new at cloud01.kovoks.nl > Authentication-Results: cloud01.kovoks.nl (amavisd-new); dkim=pass > header.i=@vlanmail.be > Received: … > Received: from ms087.vlanmail.be (ms087.vlanmail.be [37.58.43.87]) > by … (Postfix) with SMTP id 365BC16808 > for …; Sun, 5 Nov 2017 09:25:03 +0100 (CET) > DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; > d=vlanmail.be; s=sim; i=@vlanmail.be; h=message-id:from:to: > subject:date:reply-to:mime-version:content-type; bh=XtMJ3izO2lWo > 5An6HMCFpeyDtfvMBO9ooY1MmNGmmXQ=; b=N8VZWvVTfocrtirzYIPRx7vKmzBO > B6dBLJaks3ElmXFY2T6n7EcIJVEf1mt2GY6j+W0ygbc6DaoClwiOuTzNgotp0Da4 > r9B/7t4rU3tJS/e6lczEJ4LUUJEESVJpRmDkrq9qBrFYp9UZbW/4vzXojDf1X7bQ > Vr9KPh7yT4tKnVs= >Message-ID: ><171105090150.sim_40ltogj_nmxc%2bxy6leeofd0mbcxu_gpwnuulrvadl6xwzwjfm1e8lz9aizvhtai7wgz1udkjolipopq0ynkadryvcnb...@ms087.vlanmail.be> > From: =?utf-8?B?QXV0b3ZsYW4uYmU=?= <i...@vlanmail.be> > To: <i...@decebal.nl> >Subject: >=?utf-8?B?QWNodGVydm9sZ2luZyB2YW4gZWVuIGtpbmQgLyBIaWogcmlqZHQgemljaHpl?= >=?utf-8?B?bGYgb212ZXIgLyBHZXZhYXJsaWprZSBidXNyYWNlIC8gSmVmZmVyc29uIGdl?= > =?utf-8?B?Y2FyamFja3QgLyBDYW1hcm8tY3Jhc2g=?= > Date: Sun, 05 Nov 2017 09:01:50 +0100 > Reply-To: =?utf-8?B?bm9yZXBseQ==?= <nore...@vlan.be> >X-MA-Reference: >SIM_40lTOgJ_nmXC%2BXy6LEeofd0mBCxu_gPwnUuLrVADL6xWzwjFM1E8lz9aiZvhtai7wgZ1uDkjolIpoPQ0YnkaDryvcNBuxf >X-MA-Instance: >SIM_40lTOgJ_nmXC%2BXy6LEeofd0mBCxu_gPwnUuLrVADL6xWzwjFM1E8lz9aiZvhtai7wgZ1uDkjolIpoPQ0YnkaDryvcNBuxf.5d2bd9318cf5475e12f554877d153c3b > MIME-Version: 1.0 > Content-Type: multipart/alternative; > boundary="----=_NexPart_000" > X-accepted: Decebal > >Any idea why SpamAssassin has so much difficulty recognising this as >spam? > >Everytime I get a message that is spam and not recognised as such I >put it in a directory SpamNotFound. And this is processed with: > if [[ mailToProcess -gt 0 ]] ; then > echo "${mailToProcess} berichten moeten worden verwerkt" > mkdirIfNotExist ${toProcessDir} > mkdirIfNotExist ${processedDir} > mv ${newDir}* ${toProcessDir} > error=0 > learned=0 > notLearned=0 > for i in $(/bin/ls -A ${toProcessDir}) ; do > set +e > message=$(spamc -L ${typeStr} <${toProcessDir}${i}) > errorCode=${?} > set -e > case ${message} in > 'Message successfully un/learned') > let "++learned" > ;; > 'Message was already un/learned') > let "++notLearned" > ;; > *) > let "++error" > case ${errorCode} in > 98) > echo "${i} was te groot om te worden verwerkt" > ;; > *) > echo "onbekende fout (${errorCode})" > ;; > esac > ;; > esac > done > echo "learned: ${learned}" > echo "NOT learned: ${notLearned}" > echo "error: ${error}" > mv ${toProcessDir}* ${processedDir} > (( ++processedDirs )) > else > echo Geen mails gevonden > fi > >And typeStr is of-course spam in this case. > >It is almost solved. Sometimes it even gets into spam, but I am just >curious. And maybe it can help to make SpamAssassin better. > >-- >Cecil Westerhof >Senior Software Engineer >LinkedIn: http://www.linkedin.com/in/cecilwesterhof