> On 12 Feb 2015, at 19:05 , David B Funk <dbf...@engineering.uiowa.edu> wrote: > > On Thu, 12 Feb 2015, LuKreme wrote: > >> An email from the New York times daily headlines service is hitting Bayes_99 >> and Bayes_999 >> >> pts rule name description >> ---- ---------------------- >> -------------------------------------------------- >> 4.0 BAYES_99 BODY: Bayes spam probability is 99 to 100% >> [score: 1.0000] >> 0.2 BAYES_999 BODY: Bayes spam probability is 99.9 to 100% >> [score: 1.0000] >> 0.7 MIME_HTML_ONLY BODY: Message only has text/html MIME parts >> 0.0 HTML_MESSAGE BODY: HTML included in message >> -0.1 DKIM_VERIFIED No description available. >> -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from >> author's >> domain >> 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not >> necessarily valid >> 3.0 DCC_CHECK Detected as bulk mail by DCC (dcc-servers.net) >> -0.1 DKIM_VALID Message has at least one valid DKIM or DK >> signature >> 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines >> 0.5 MISSING_MID Missing Message-Id: header >> >> I’m curious about the two bayes hits and also the 3 points for bulk mail for >> something that I can’t see anyone would consider to be actual spam. Oh, and >> why is babes_999 so low scoring? > > Where'd you get that score of 3.0 for DCC_CHECK, mine is 1.1. DCC is a bulk > mail > detection service, not spam detection.
Probably in local.cf then. I’ve commented out all the score adjustments in there for right now. > Those BAYES_99 & BAYES_999 hits for a bulk-but-solicted mail really say > "mis-trained Bayes". > For New York Times subscriptions my users usually hit either BAYES_00 or > BAYES_05. Yeah, in my own email NYT hits bayes_00. I just switched to using spamass-milter: /usr/local/sbin/spamass-milter -f -p /var/run/spamass-milter.sock -u spamd -r 9 -- -s 5242880 And it occurs to me that maybe it is not picking up bayes properly. Should I train bayes as the spamd user? use_bayes 1 bayes_auto_learn 1 bayes_store_module Mail::SpamAssassin::BayesStore::SQL bayes_sql_dsn DBI:mysql:bayes:localhost:3306 bayes_sql_username user bayes_sql_password *pass* bayes_sql_override_username user > That BAYES_999 is an addition to BAYES_99 thus the small score. It's more > intended to be used as "meta fodder" (or re-scored based on your trust of > your Bayes). OK, that makes sense. When I make changes to local.cf do I need to restart SA or does it relied that file if it sees it’s changed? -- "Any man who says he can see through women is really missing a lot." - Groucho Marx
