help diagnose a mis-tagged email (not spam, tagged as spam)

[Matt Kettler]

I'm not positive, but from a glance it looks like it got bumped up by the
auto-whitelist feature of SpamAssassin, which despite its name, acts more
commonly as an auto-black/greylist.

What the AWL really does is try to push the score of an email towards the
historical average for that user. If that user sent some email that got
tagged for legit reasons, they probably have a high average and thus get
their score bumped up.

Recommendations to get around this:

1) don't use the AWL, or reduce the AWL factor.
2) don't SA scan emails that were actually delivered from IPs in your local
domain. (use MailScanner's "accept spam from" to prevent local users mail
from being scanned.)
3) delete that user's AWL entry using spamassassin -R and hope they don't
send more spam-like mail.


At 04:15 PM 7/24/2002 -0500, Jason wrote:
>howdy
>
>I'm posting this to both the mailscanner and spamassassin lists since I'm
>not sure where the problem lies.
>
>A user forwarded me a non-spam email that was tagged as spam.  Here's the
>spamcheck header:
>
>X-MailScanner-SpamCheck: SpamAssassin (score=11.9, required 9,
>FROM_NAME_NO_SPACES, AWL)
>
>this is from an internal user, to an internal user, and the subject and
>body look like:
>
>-------------
>Subject: {PROBABLY SPAM} come to server room pretty please
>
>
>we need to put a cd in edi-dev, cabinet looks locked?
>-------------
>
>anyone have any idea how that happened?  And is there a way with
>mailscanner + spamassassin to not scan mail originating from my network?
>
>--
>Jason Burnett
>jason at jnj.org
>~ No witty signature available at this time ~