On Thu, 2011-01-13 at 10:40 -0800, Brendan Murtagh wrote:
> [...] As long as its being sent from the device, it's being tagged
> with some of the tests listed below. The emails are arriving, however they
> are being delivered into the Spam folder and not the Inbox due to our mail
> server settings which append to the Subject line the spam score and move it
> to the Spam folder for email scored 3.0+
This description was much better than your subject. :) SA does not
block mail, and as you just described, it doesn't even quarantine
identified spam either on its own. Anyway...
> X-spam-flag: YES
> X-spam-status: Yes, hits=3.01 required=3.00
The default required_score threshold is 5.0, and stock SA rules' scores
have been generated with that in mind.
> tests=HTML_MESSAGE=0.00,
> RATWARE_RCVD_BONUS_SPC=1.00,VOWEL_URI_5=1.00,NO_RDNS2=0.01,MR_DIFF_MID=1.00
The *only* rule that is in the stock SA rules is the first one, and
scoring merely informational.
All rules but the first one are your local rules, accounting for a score
of 3.01 -- which by default would not exceed the threshold. Even worse,
by default the overall score would be a positive 0.0.
Your own rules, together with your low required_score setting, are
causing your FPs.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
