At Tue Oct 28 06:30:43 2003, wilma wrote: > > Thanks everybody! I will use "score FORGED_MUA_IMS 0" in local.cf > But could someone explain why SA looks to be inconsistent in its > tests (or maybe I'm missinterpreting): > > X-Spam-Status: No, hits=2.0 required=5.0 > tests=FORGED_MUA_IMS,HTML_MESSAGE, > HTML_TAG_BALANCE_BODY,HTML_TAG_BALANCE_HTML,HTML_TAG_BALANCE_TABLE > autolearn=no version=2.60
<snip> Content analysis details: (12.8 points, 5.0 required) > pts rule name description > ---- ---------------------- -------------------------------------------------- > 0.0 HTML_MESSAGE BODY: HTML included in message > 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts > 2.2 HTML_IMAGE_ONLY_02 BODY: HTML: images with 0-200 bytes of words > 0.7 MIME_HTML_NO_CHARSET RAW: Message text in HTML without charset > 1.1 FORGED_MUA_IMS Forged mail pretending to be from IMS > 4.3 FORGED_IMS_HTML IMS can't send HTML message only > 4.3 FORGED_IMS_TAGS IMS mailers can't send HTML in this format > > First it says "No, hits 2.0", and then it scores the mail to 12.8!? The normal reason for this is that you're running the message through spamassassin twice. The first run gets a higher score because it's examining the headers of the original spam. The spam is then encapsulated as an attachment, and the second run scans the new message. The new message does not have spammy headers and hence gets a lower score. I'm puzzled as to how both got the FORGED_MUA_IMS, though, if the encapsulation did happen. Martin -- Martin Radford | "Only wimps use tape backup: _real_ [EMAIL PROTECTED] | men just upload their important stuff -o) Registered Linux user #9257 | on ftp and let the rest of the world /\\ - see http://counter.li.org | mirror it ;)" - Linus Torvalds _\_V ------------------------------------------------------- This SF.net email is sponsored by: SF.net Giveback Program. Does SourceForge.net help you be more productive? Does it help you create better code? SHARE THE LOVE, and help us help YOU! Click Here: http://sourceforge.net/donate/ _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
