> I have several spam that scored very low on SA 3.0.4 w/ milter-spamc 0.25
>
> X-Spam-Status: NO, hits=-145.70 required=5.00
> X-Spam-Status: NO, hits=-153.70 required=5.00
> X-Spam-Status: NO, hits=-146.00 required=5.00
> X-Spam-Status: NO, hits=-153.80 required=5.00
> X-Spam-Status: NO, hits=-153.90 required=5.00
>
> Since all the scores are similar, I am wondering if there is a common
> "cause" .
Almost certainly.
> Are > there any suggestions on how to investigate the source
> of the wildly "negative" score, or does it look familiar?
A score of -100 almost certainly indicates a whitelist hit of some sort or
other.
The 40..50 part of the score is harder to determine. I would guess these
are similar mails and are accumulating about the same hits, which could be
any old batch of rules.
Another possibility is they are hitting TWO whitelist rules and
getting -200, and then getting 50..60 points added back to the score from
other rule hits.
If you look at one of those messages (if you have it) it should show the
rules hit, even without the scores. Many of us could fairly quickly tell
you where the scores are coming from.
Loren
