"Required SpamAssassin Score" and Bayes

[Randal, Phil]

Steve Freegard wrote:

> I too have seen similar patterns of spam scoring strangely
> low and spent
> some time over the weekend using MailWatch to work out why this was
> happening.
>
> I checked the 'Received:' headers IP addresses via
> OpenRBL.org and realised
> that although these messages were listed in quite a few RBL's
> - SpamAssassin
> had not picked up on this - further debugging via:
>
> spamassassin -D rbl=-3 -p /etc/MailScanner/spam.assassin.prefs.conf <
> message 2>&1 | less
>
> and I discovered that for some reason SA was 'trusting' the
> first host on
> the received line and not checking it against the RBL's.  I
> ended up adding:
>
> trusted_networks 127.0.0.1 10/8 172.16/12 192.168/16 <<external mx>>
> <<external mx>>
>
> in spam.assassin.prefs.conf and double-checked the settings
> by running SA in
> debug across a range of messages to make sure that SA was
> checking the RBL's
> as expected.
>
> For good measure I also added:
>
> # Manually add in the CBL until SA has it by default
> header RCVD_IN_CBL      eval:check_rbl_txt('cbl', 'cbl.abuseat.org.')
> describe RCVD_IN_CBL    Received via a relay in cbl.abuseat.org
> tflags RCVD_IN_CBL      net
> score RCVD_IN_CBL       5
>
> And where these low-scoring spam were once slipping through -
> they aren't
> now!
>
> Hope this helps.
>
> Kind regards,
> Steve.

Thanks Steve, I'd seen the same problem with omitted RBL checks but hadn't
got around to investigating further.  Good catch!

Cheers,

Phil
---------------------------------------------
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK