Sheeen, > We have an amavisd/spamassassin/clamav gateway before our Exchange server. > I've trained spamassassin with about 3500 hams / 3500 spams, it should work > correctly, and I'm training it regularly. > But we're receiving some spams yet. > > I've looked into the headers of spams received detected/undetected, and > some mails are tagged, some mails aren't tagged.
> SPAM header : > Received: from localhost (localhost.localdomain [127.0.0.1]) > by gateway.domain.local (Postfix) with ESMTP id 0D5F0370C01 > for <i...@domain.com>; Wed, 18 Mar 2009 11:07:16 +0100 (CET) > X-Virus-Scanned: amavisd-new at cpa.local > X-Spam-Flag: YES > X-Spam-Score: 42.9 > X-Spam-Level: ****************************************** > X-Spam-Status: Yes, score=42.9 tagged_above=-99 required=3 > tests=[BAYES_99=3.5, HTML_IMAGE_ONLY_28=1.561, > HTML_IMAGE_RATIO_02=0.383, HTML_MESSAGE=0.001, MIME_HTML_ONLY=1.457, > RCVD_IN_BL_SPAMCOP_NET=1.96, URIBL_AB_SURBL=7, URIBL_BLACK=1.955, > URIBL_JP_SURBL=7, URIBL_OB_SURBL=7, URIBL_RHS_DOB=1.083, URIBL_SBL=5, > URIBL_WS_SURBL=5] > > NO SPAM header : > Received: from localhost (localhost.localdomain [127.0.0.1]) > by gateway.domain.local (Postfix) with ESMTP id 5B6EE370C01 > for <i...@cdomain.com>; Wed, 18 Mar 2009 11:37:06 +0100 (CET) > X-Virus-Scanned: amavisd-new at cpa.local > X-Spam-Flag: NO > X-Spam-Score: 2.22 > X-Spam-Level: ** > X-Spam-Status: No, score=2.22 tagged_above=-99 required=3 > tests=[BAYES_50=0.001, TVD_SPACE_RATIO=2.219] > And for others undetected spams, I can't see headers like this, in my > opinion, every mail should be tagged, even ham. For mail to be tagged, the following must hold true: - SpamAssassin must see it: mail size must be below $sa_mail_body_size_limit and @bypass_spam_checks_maps for these recipients must be false; - recipient must be local (outbound mail is not tagged), check your @local_domains_maps - spam score must be above tag_level, or tag_level must be undef; check your $sa_tag_level_deflt, it is undef by default Mark
