On Tue, 12 Aug 2014, Greg Ledford wrote:
They may take a couple of different forms depending on how SA is hooked into
your mail infrastructure.
Basic SA headers start with "X-Spam", like X-Spam-Status and X-Spam-Report.
If you're using Amavis, then there would be some Amavis headers. (Note
that the mention of Amavis in the Received header that the sender added
- "Received: by 02942887.pygmyweed.somedaystoday.in" - is irrelevant.)
How is SpamAssassin hooked into your email infrastructure?
It should just be called by Amavis directly. Sometimes it scans and
sometimes it doesn't.
Bummer. That, however, is probably an issue in Amavis rather than SA.
I just found another obvious piece of email that SA and Amavis scanned
and missed.
I note that the tagged/required score has been increased from the SA
default. Was that done intentionally?
The SA base rules are scored with the assumption that the "spam" threshold
score is 5; if you increase that then FNs will necessarily increase.
I tried to attach the headers but they are so blatant that the list
kicked it back! I'll try to modify it to get them through for info
purposes.
Best practice is to paste the entire message to something like pastebin
and post the URL for that to the list.
Maybe there's a timeout issue between Amavis and SA that won't
allow it time to scan?
If that was the case I'd still expect to see Amavis headers - for example,
the virus scan isn't related to SA.
There may be an upper limit to the size of messages Amavis will scan,
check for that being set to an unrealistically small value.
X-Virus-Scanned: Debian amavisd-new at smtp.phhwtechnology.com
X-Spam-Flag: NO
X-Spam-Score: 5.945
X-Spam-Level: *****
X-Spam-Status: No, score=5.945 tagged_above=5.5 required=6
tests=[DCC_CHECK=1.1, RDNS_NONE=1.274, SPF_HELO_PASS=-0.001,
SPF_PASS=-0.001, THIS_AD=1.073, URIBL_DBL_SPAM=2.5]
autolearn=no autolearn_force=no
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Warning Labels we'd like to see #1: "If you are a stupid idiot while
using this product you may hurt yourself. And it won't be our fault."
-----------------------------------------------------------------------
3 days until the 69th anniversary of the end of World War II
