After installing 2.60-cvs I've noticed a number of FPs resulting from SA misinterpreting dial-up RBL data.
In particular, it does not seem to recognise the source IP address as the originator of the message and so considers all the dial-up RBL scores that it hits as a spam indication.
SA is simply reporting that the offending IP is considered by several RBLs as being capable of sending spam (and having done so in the past?) The fact that 6 RBLs are reporting 172.130.105.86 as being a possible source of spam, only strengthens the case for it being such.
For example, in the attached message the source was an AOL dialup "AC826956.ipt.aol.com [172.130.105.86]" which hit 6 RBLs ;() (with 'dnsbl.njabl.org' being added TWICE).
You don't seem to be studying what is reported in the 2 NJABL evals with enough attention. They are both about different things. RCVD_IN_NJABL_DIALUP is complaining that 172.130.105.86 did not send smtp mail via its ISP, AOL, which many mail servers insist on for most dynamically allocated dialup IP numbers - since their source can not be verified - and many spammers use them for that reason.
If you want to cut out any given RBL test, simply give that test a score of 0 (zero) in your local.cf.
Also note the bayes score for this message, 90%, but there's almost nothing "spammish" about it.
Someone has taught Bayes on your system in the past that the content *or* the headers of the mail indicates spam. Bayes only judges on what's happened in the past, after having built up a reasonably-sized database. Bayes does not judge mails for their spammines - or lack of it.
Best,
Tony
-- Tony Earnshaw
I love the music of Wagner. The only sound that pleases me more is that of a cat outside my 9th floor window, trying to cling to the glass with its claws.
http://j-walk.com/blog/docs/conference.htm http://www.billy.demon.nl Mail: [EMAIL PROTECTED]
------------------------------------------------------- This SF.net email is sponsored by: VM Ware With VMware you can run multiple operating systems on a single machine. WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the same time. Free trial click here: http://www.vmware.com/wl/offer/345/0 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
