On Thu, May 15, 2008 at 05:35:52PM +0200, Karsten Br?ckelmann wrote: > No DNSBLs in the original result... This *may* be due to the BLs > catching up, and the second run being done later. This specifically > seems to be the case for Razor (which hit in both run, just differently) > and likely for URIBL_BLACK, too. Maybe DNS timeout issues.
Perhaps... don't see any evidence in the logs, but I might not without lots of extra debugging enabled. Whatever is happening, it's a definite change from as recently as two weeks ago because other users on this system have reported a massive increase in spam not being properly classified as such. However, wrt to the comment about the BLs catching up, if I'm reading it right this host has been listed in at least DSBL since last year. Still could have been a timeout on my end, of course, but it seems unlikely that I've been having timeouts for the last two weeks or so. > Do you see hits URIBL_BLACK hits in the incoming stream at all? Not sure exactly what you're asking here... but I included the entire X-Spam-Status and X-Spam-Report headers, without removing any lines. So there was no URIBL_BLACK hit in the message as it was delivered to my inbox, but the same message, when run through SA manually a few minutes later, did trigger it. > AWL is a score averager. It *will* change by run, unless the difference > between the current score and the previous average is about 0. Ah, right... didn't think about the affect of running SA manually influencing the AWL on subsequent runs. The initial email scored 4.4, but when I ran SA manually it scored 10.3 or so, which means the AWL should have subtracted about 3 on the second exposure to that sender... and then down from there, etc. Sorry, my fault for not thinking that one through. --Jeff
