I see that makes sense. Thanks for the clarity. However how do you get to 150?
good DKIM = 100 good SPF = 100 That totals 200 On 01/28/2018 02:53 PM, David Jones wrote: > On 01/28/2018 12:36 PM, Chip wrote: >> I have the following in local.cf >> >> shortcircuit DKIM_VALID_AU on >> shortcircuit SPF_PASS on >> score DKIM_VALID_AU -100 >> score SPF_PASS -100 >> > > Just to be clear about these settings above for new SA users, this is > not recommended. This is a very special need that he has to classify > good SPF and DKIM emails. This has nothing to do with ham or spam so > don't use these settings in a real mail filtering environment. > > >> The question is are all triggers reported in headers (DKIM and SPF), >> or just some? >> > > The Shortcircuit plugin is going to skip many checks (hence the plugin > name) and therefore not all rules will show up. If you want to see > all of the rule hits, then remove the shortcircuit and keep the scores > at -100 like you have them. Then anything less than -50 would be good > on either SPF or DKIM and anything less than -150 should be good on > both SPF and DKIM. > > >> A look at the logs and SA headers shows: >> >> Logs: >> >> 2018-01-28 13:24:05 1efrcb-00016p-3g DKIM: d=gmail.com s=20161025 >> c=relaxed/relaxed a=rsa-sha256 b=2048 [verification succeeded] >> 2018-01-28 13:24:10 1efrcb-00016p-3g H=mail-wm0-f51.google.com >> [74.125.82.51]:52869 Warning: "SpamAssassin as XXXXXXXXXX detected >> message as NOT spam (-100.0)" >> >> However headers in message only show: >> >> X-Spam-Status: No, score=-100.0 >> X-Spam-Score: -999 >> X-Spam-Bar: --------------------------------------------------- >> X-Ham-Report: Spam detection software, running on the system >> "XXXXX.com", >> has NOT identified this incoming email as spam. The original >> message has been attached to this so you can view it or label >> similar future email. If you have any questions, see >> root\@localhost for details. >> >> Content preview: so what are you going to do today? >> >> >> Content analysis details: (-100.0 points, 5.0 required) >> >> pts rule name description >> ---- ---------------------- >> -------------------------------------------------- >> -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at >> http://www.dnswl.org/, no >> trust >> [74.125.82.51 listed in list.dnswl.org] >> -0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3) >> [74.125.82.51 listed in wl.mailspike.net] >> -0.0 SHORTCIRCUIT Not all rules were run, due to a >> shortcircuited rule >> -100 SPF_PASS SPF: sender matches SPF record <------ okay, >> great. Where is the DKIM message or is only one trigger reported? >> X-Spam-Flag: NO >> >> >> > >
