Chris schrieb:
http://pastebin.com/m5e126ea
This came to one of my address where what I usually get is 99% spam and
was scored as ham, no matter what I've done I can't get it to score the
minimum +5 points. After learning it as spam with sa-learn and using
spamassassin -r to report to razor/pyzor/dcc and removing the senders
address from the AWL with spamassassin --remove-addr-from-whitelist it
still scores below the required:
Content analysis details: (1.6 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
-0.1 RCVD_IN_JMF_W RBL: JunkEmailFilter: relay in white list
(first pass)
[66.114.171.113 listed in
hostkarma.junkemailfilter.com]
-4.0 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/,
medium
trust
[66.114.171.113 listed in list.dnswl.org]
5.0 BAYES_99 BODY: Bayesian spam probability is 99 to
100%
[score: 1.0000]
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 DK_SIGNED Domain Keys: message has a signature
0.0 DKIM_SIGNED Domain Keys Identified Mail: message has a
signature
0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html
MIME
0.0 HTML_MESSAGE BODY: HTML included in message
0.7 MPART_ALT_DIFF BODY: HTML and text parts are different
2.2 DCC_CHECK listed in DCC
(http://rhyolite.com/anti-spam/dcc/)
[localhost 1201; Body=many Fuz1=many]
[Fuz2=many]
-2.2 KHOP_RCVD_TRUST DNS-Whitelisted sender is verified
These are few and far between however there were two today that made it
past. Any suggestions would be appreciated
what about
header webex1 Received =~ /webexmailer.com/i
describe webex1 Mail from webexmailer
score webex1 10.0
header webex2 Received =~ /webex.com/i
describe webex2 Mail from webexmailer
score webex2 10.0
It seems webexmailer is a trusted mass-mailer so you have to overrule
the trusted whitelists (JMF, DNSWL, KHOP)
Ralph
