This message does not hit any naughty words rules for me either (tested
3.1.0 and 3.0.3). SA doesn't generally have rules that hit a single
word. To avoid FPs, it is better to check for phrases and obfuscations.
However, the message does hit BAYES_99 and several networks tests on my
system giving it a score of 31.5. Of course, network tests do tend to
work better when you are investigating why a message got through than
when the message first hits your mail server.
Jim Smith wrote:
I'm getting lots of spam that are skipping rules. One that came in recently
with lots of porn only got tagged for SORBS, NUMERIC HELO, and UNPARSEABLE
RELAY (I don't know what unparseable relay means but seems like many emails
have that lately). The full headers & message (uncensored) of that example
is at www.blarneystone.com/spam/spam.txt if that helps.
If you look at it you can tell that it should have kicked off lots of porn
tags but none were there and it sailed through with a 3.2 score. This has
only happened since I upgraded to SA 3.1.0.
I've run SA --lint -D without errors. I thought it might be some
configuration left over from my older SA when I upgraded so I did a clean
install on a new machine and still have the same issue with skipping of
rules. BTW, I know the rules aren't missing from the installation because
they show up in other emails. A sporadic problem... my favorite <sigh>. Any
suggestions?
Thanks,
Jim Smith
