Yeah that sender's email address had been forged for a bunch of spam I received. I used spamasassin --remove-addr-from-whitelist for that address Also I did not have internal_networks and trusted_networks lines in my local.cf, which I added. Hopefully that will help. Thanks!
On Mar 6, 2011, at 11:33 AM, Karsten Bräckelmann wrote: > On Sun, 2011-03-06 at 10:51 -0800, JP Kelly wrote: >> I just found an incoming message which is ham but marked as spam. >> It received a score of 14 because it is in the auto white-list. >> Shouldn't it receive a negative score? > > http://wiki.apache.org/spamassassin/AwlWrongWay > > Despite its name, the AWL is a score averager, based on the sender's > history (limited by net-block). > > > Given the rather high AWL score, this sender previously scored even much > higher. You (or the sender) didn't happen to use it for sending some > "test spam", checking SA is working? > > As a quick fix, I'd remove the AWL record for that address. Also see the > spamassassin-run man-page. > > spamasassin --remove-addr-from-whitelist=u...@example.net > > >> Content analysis details: (7.1 points, 5.0 required) >> >> pts rule name description >> ---- ---------------------- >> -------------------------------------------------- >> -4.0 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/, >> medium >> trust >> [72.21.212.35 listed in list.dnswl.org] >> -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1% >> [score: 0.0000] >> 14 AWL AWL: From: address is in the auto white-list > > -- > char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4"; > main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1: > (c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}} >
