Dr Robert Young wrote:
> I have several spam that scored very low on SA 3.0.4 w/ milter-spamc 0.25
>
> *X-Spam-Status: * NO, hits=-145.70 required=5.00
> *X-Spam-Status: * NO, hits=-153.70 required=5.00
> *X-Spam-Status: * NO, hits=-146.00 required=5.00
> *X-Spam-Status: * NO, hits=-153.80 required=5.00
> X-Spam-Status: NO, hits=-153.90 required=5.00
>
>
> Since all the scores are similar, I am wondering if there is a common
> "cause" .? Are there any suggestions on how to investigate the source of
> the wildly "negative" score, or does it look familiar?
Looks like the messages are matching a whitelist_from or all_spam_to statement.
Commonly this is somebody doing the "simple" thing and adding:
whitelist_from [EMAIL PROTECTED]
Which unfortunately whitelists all spam that forges itself as being from an
address in your domain.
You'll want to use whitelist_from_rcvd instead, or better yet, modify your setup
so internal mail doesn't get fed to SA at all and remove the whitelist.
