Am 24.02.2015 um 18:39 schrieb Jeremy McSpadden:
Usually scores are 6 low 10 high. Are you running any RBLs ?
I have the default settings plus the attached custom configuration. There are several RBLs among them.
-- Yves Goergen http://unclassified.software
# ==================== BAYES ==================== #auto_whitelist_path /var/spool/spamd/auto-whitelist bayes_path /var/spool/spamd/bayes lock_method flock # required_score 5.0 use_bayes 0 # bayes_auto_learn 1 bayes_ignore_header X-Spam-Score bayes_ignore_header X-Spam-dotforward-Info bayes_ignore_header X-Spam-Report # Temporarily disabled #bayes_auto_learn_threshold_spam 8.0 # default: 12.0 score BAYES_00 (1.5) score BAYES_05 (0.3) score BAYES_20 (0) score BAYES_40 (0) score BAYES_50 (0) score BAYES_60 (0.2) score BAYES_80 (0.5) score BAYES_95 (0.8) score BAYES_99 (1.0) clear_report_template report Content analysis details: report _SUMMARY_ # ==================== WHITELIST / BLACKLIST ==================== blacklist_from i...@info.globc-data.info blacklist_from i...@de.globc-data.info blacklist_from i...@i.glbdata.info blacklist_from i...@de.glbdata.info blacklist_from i...@i.dbc-data.info blacklist_from i...@i.gc-dbadressen.info blacklist_from tlakulamessa...@mail2southafrica.com blacklist_from john@*initrust* blacklist_from richard*@sehrwichtig.com # Emirates hält sich nicht an die Abmeldung von Werbung und wird deshalb # komplett blockiert. 2010-04-15 YG blacklist_from emirateshighstreet@e.emirates.travel # Immobilienwerbung, 2011-06-16 YG blacklist_from i...@timepost02b.com # eBay Fälschung, 2011-06-22 YG blacklist_from mem...@ehay.com # PayPal-Fälschung, 2011-07-02 YG blacklist_from info...@paiypal.com # Newsletter-Abmeldung funktioniert nicht, es kommt nur mehr Spam, 2013-04-22 YG blacklist_from *@lists.techtarget.com # ==================== DNS-BLACKLISTS ==================== # rfc-ignorant is useless for the real world, it doesn't catch spam but everything else! score DNS_FROM_RFC_ABUSE 0 score DNS_FROM_RFC_POST 0 score DNS_FROM_RFC_WHOIS 0 # Increase score for DNS list rules score URIBL_BLACK (4) score RCVD_IN_BL_SPAMCOP_NET (2.5) #score RCVD_IN_SORBS_WEB (2) #score RCVD_IN_WHOIS_BOGONS (1) #score RCVD_IN_SORBS_DUL (2) score DNS_FROM_RFC_ABUSE (1) # Temporary trouble with false positives from those rules: #score URIBL_RED 0 #score URIBL_GREY 0 #score URIBL_BLACK 0 # SURBL policy change as of 2008-11-10 score URIBL_AB_SURBL 0 score URIBL_JP_SURBL 0 score URIBL_OB_SURBL 0 score URIBL_PH_SURBL 0 score URIBL_SC_SURBL 0 score URIBL_WS_SURBL 0 # YG 2014-12-26 Spamhaus deaktiviert score RCVD_IN_ZEN 0 score RCVD_IN_SBL 0 score RCVD_IN_XBL 0 score RCVD_IN_PBL 0 # 2015-01-12 NiX-Spam-DNSBL ix.dnsbl.manitu.net hinzugefügt # Anleitung: http://www.heise.de/ix/foren/S-nixspam-dnsbl-in-spamassassin/forum-48292/msg-6404906/read/ header NIX_SPAM eval:check_rbl('nix-spam','ix.dnsbl.manitu.net') describe NIX_SPAM Listed in NIX_SPAM DNSBL (thanks to heise.de) tflags NIX_SPAM net score NIX_SPAM 3.0 # ==================== SCORE ADJUSTMENTS ==================== score FORGED_HOTMAIL_RCVD 0.0 score DEAR_FRIEND (2) score DRUGS_ERECTILE (2) # Looks like spam score RCVD_IN_DNSWL_LOW 0 # Enable bounce checks by adding this line: whitelist_bounce_relays dotforward.de score ANY_BOUNCE_MESSAGE 7 # YG 2011-07-06 (+1), 2015-01-12 (+0.5) score LOTS_OF_MONEY (1.5) # YG 2014-03-09 score KHOP_BIG_TO_CC 1 # ==================== MY PATTERNS ==================== # Uhren kaufen uri YG_URI_UHREN /redir\.ec\/[a-z]+/i score YG_URI_UHREN 5 # GlobData spam uri YG_URI_GLOBDATA /www\.(gl(ob)?-?(adressen|data)|(db(firmen)?|pr-)adressen|db-?glob(al)?|(bc|pr?o?|info)-aziende)\.(com|net|info)(\/.*)?/i score YG_URI_GLOBDATA 5 body __YG_GLOBDATA_01 /Adressen/ body __YG_GLOBDATA_02 /Adresskataloge/ body __YG_GLOBDATA_03 /Bewerbens/ body __YG_GLOBDATA_04 /Branche/ body __YG_GLOBDATA_05 /Datenbanken/ body __YG_GLOBDATA_06 /Datenbasis/ body __YG_GLOBDATA_07 /deutsche[nr]? Firmen/ body __YG_GLOBDATA_08 /Dienstleistungen/ body __YG_GLOBDATA_09 /Firma/ body __YG_GLOBDATA_10 /Firmen/ body __YG_GLOBDATA_11 /Firmenangaben/ body __YG_GLOBDATA_12 /gewinnen/ body __YG_GLOBDATA_13 /Glob[ -]*Contact/ body __YG_GLOBDATA_14 /Global[ -]*Contact/ body __YG_GLOBDATA_15 /GC[ -]*GROUP/ body __YG_GLOBDATA_16 /Kampagnen/ body __YG_GLOBDATA_17 /kostenlose/ body __YG_GLOBDATA_18 /personalisierte/ body __YG_GLOBDATA_19 /Postanschrift/ body __YG_GLOBDATA_20 /seriöses Geld/ body __YG_GLOBDATA_21 /Unternehmen/ body __YG_GLOBDATA_22 /verdienen/ body __YG_GLOBDATA_23 /Versendens/ body __YG_GLOBDATA_24 /Werbekampagnen/ body __YG_GLOBDATA_25 /Werbung/ body __YG_GLOBDATA_26 /Zielgruppen/ meta YG_GLOBDATA_5 (__YG_GLOBDATA_01 + __YG_GLOBDATA_02 + __YG_GLOBDATA_03 + __YG_GLOBDATA_04 + __YG_GLOBDATA_05 + __YG_GLOBDATA_06 + __YG_GLOBDATA_07 + __YG_GLOBDATA_08 + __YG_GLOBDATA_09 + __YG_GLOBDATA_10 + __YG_GLOBDATA_11 + __YG_GLOBDATA_12 + __YG_GLOBDATA_13 + __YG_GLOBDATA_14 + __YG_GLOBDATA_15 + __YG_GLOBDATA_16 + __YG_GLOBDATA_17 + __YG_GLOBDATA_18 + __YG_GLOBDATA_19 + __YG_GLOBDATA_20 + __YG_GLOBDATA_21 + __YG_GLOBDATA_22 + __YG_GLOBDATA_23 + __YG_GLOBDATA_24 + __YG_GLOBDATA_25 + __YG_GLOBDATA_26) >= 5 meta YG_GLOBDATA_7 (__YG_GLOBDATA_01 + __YG_GLOBDATA_02 + __YG_GLOBDATA_03 + __YG_GLOBDATA_04 + __YG_GLOBDATA_05 + __YG_GLOBDATA_06 + __YG_GLOBDATA_07 + __YG_GLOBDATA_08 + __YG_GLOBDATA_09 + __YG_GLOBDATA_10 + __YG_GLOBDATA_11 + __YG_GLOBDATA_12 + __YG_GLOBDATA_13 + __YG_GLOBDATA_14 + __YG_GLOBDATA_15 + __YG_GLOBDATA_16 + __YG_GLOBDATA_17 + __YG_GLOBDATA_18 + __YG_GLOBDATA_19 + __YG_GLOBDATA_20 + __YG_GLOBDATA_21 + __YG_GLOBDATA_22 + __YG_GLOBDATA_23 + __YG_GLOBDATA_24 + __YG_GLOBDATA_25 + __YG_GLOBDATA_26) >= 7 meta YG_GLOBDATA_9 (__YG_GLOBDATA_01 + __YG_GLOBDATA_02 + __YG_GLOBDATA_03 + __YG_GLOBDATA_04 + __YG_GLOBDATA_05 + __YG_GLOBDATA_06 + __YG_GLOBDATA_07 + __YG_GLOBDATA_08 + __YG_GLOBDATA_09 + __YG_GLOBDATA_10 + __YG_GLOBDATA_11 + __YG_GLOBDATA_12 + __YG_GLOBDATA_13 + __YG_GLOBDATA_14 + __YG_GLOBDATA_15 + __YG_GLOBDATA_16 + __YG_GLOBDATA_17 + __YG_GLOBDATA_18 + __YG_GLOBDATA_19 + __YG_GLOBDATA_20 + __YG_GLOBDATA_21 + __YG_GLOBDATA_22 + __YG_GLOBDATA_23 + __YG_GLOBDATA_24 + __YG_GLOBDATA_25 + __YG_GLOBDATA_26) >= 9 meta YG_GLOBDATA_11 (__YG_GLOBDATA_01 + __YG_GLOBDATA_02 + __YG_GLOBDATA_03 + __YG_GLOBDATA_04 + __YG_GLOBDATA_05 + __YG_GLOBDATA_06 + __YG_GLOBDATA_07 + __YG_GLOBDATA_08 + __YG_GLOBDATA_09 + __YG_GLOBDATA_10 + __YG_GLOBDATA_11 + __YG_GLOBDATA_12 + __YG_GLOBDATA_13 + __YG_GLOBDATA_14 + __YG_GLOBDATA_15 + __YG_GLOBDATA_16 + __YG_GLOBDATA_17 + __YG_GLOBDATA_18 + __YG_GLOBDATA_19 + __YG_GLOBDATA_20 + __YG_GLOBDATA_21 + __YG_GLOBDATA_22 + __YG_GLOBDATA_23 + __YG_GLOBDATA_24 + __YG_GLOBDATA_25 + __YG_GLOBDATA_26) >= 11 # Note: Rules with more matches include scores for rules with less matches! score YG_GLOBDATA_5 1 score YG_GLOBDATA_7 5 # = 6 score YG_GLOBDATA_9 4 # = 10 score YG_GLOBDATA_11 3 # = 13 header YG_SUB_SPAM Subject =~ /^\[SPAM\] / score YG_SUB_SPAM 4 header YG_ARBEIT_1 Subject =~ /^(Arbeit\s+zu\s+vergeben|Sie\s+koennen\s+eingestellt\s+werden|(Arbeiten|Verdienen)\s+Sie\s+mit\s+uns|(Betrieb|Konzern|Firma|Geschaeftsfuehrung|Gesellschaft)\s+sucht\s+(Beschaeftigte|Teammitglieder|Arbeitskraefte|Arbeitnehmer)|Freie\s+Stellen|Arbeitsmoeglichkeit|Nebenjob|Arbeit|Plaetze frei|Einkaufer gesucht|Re: Arbeitsgesuch|Mochten Sie sich was nebenbei Verdienen|Neue\s+Stellenausschreibung|Testkauf)$/ score YG_ARBEIT_1 4 header YG_ARBEIT_2 Subject =~ /^(Hallo|Job)$/ score YG_ARBEIT_2 1 # 2010-06-29 YG, http://forum.hetzner.de/wbb2/thread.php?postid=147185#post147185 header YG_ABUSE_AOL Subject =~ /^Abuse-Message \[AbuseID:[0-9A-Z:]+\]: AbuseAOL: Email Feedback Report for/ score YG_ABUSE_AOL 10 # ciomr.com Spam header YG_ARTHUR_SPAM From =~ /^Arthur Simmons <arthur@.*\.COM>$/ score YG_ARTHUR_SPAM 7 # 2015-01-12 YG header YG_EU_BUSINESS_REGISTER Subject =~ /^EU Business Register [0-9]{4}/ score YG_EU_BUSINESS_REGISTER 4
