On 26.02.08 11:56, Russell Jones wrote: > For some reason spamd is not scoring email nearly as high as > spamassassin scores if you run the message through manually. I do not > understand this, and it is causing spam to get through that should have > been blocked. As you can see when running spamassassin manually it > scored it a 7.5, but spamd scored it only a 4.5 when it first came in. > > Below is the message spamassassin shows when I run it through manually, > and you can see the original email as well as the original score spamd > gave it towards the bottom of the message. > > X-Spam-Status: Yes, score=7.5 required=5.0 tests=BAYES_50,RCVD_IN_PBL, > RCVD_IN_XBL,RDNS_NONE,URIBL_JP_SURBL,URIBL_SC_SURBL,URIBL_WS_SURBL > autolearn=disabled version=3.2.0
> 3.0 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL > X-Spam-Status: No, score=4.5 required=5.0 > tests=BAYES_50,RCVD_IN_PBL,RDNS_NONE, > URIBL_JP_SURBL,URIBL_SC_SURBL,URIBL_WS_SURBL autolearn=disabled > version=3.2.0 > Received: from localhost by server1.eggycrew.com > with SpamAssassin (version 3.2.0); > Tue, 26 Feb 2008 11:43:09 -0600 the only difference is RCVD_IN_XBL, checking XBL reveals that the IP (60.10.108.162) was listed in XBL after it appeared in CBL, which was at 2008-02-26 11:00 GMT (+/- 30 minutes) - 6 hours after the mail entered your mailserver and was checked by SA. When you manually checked it again, the address was in XBL, which meaned 3 points more. Many rules start hitting after some delay, mostly network tests. You can delay receiving messages for some time (12 hours) if you want higher scores ;-) -- Matus UHLAR - fantomas, [EMAIL PROTECTED] ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. Depression is merely anger without enthusiasm.
