Why is this mail spam?

[Julian Field]

At 11:25 03/03/2004, you wrote:
>Hi!
>
>I've implemented mailscanner yesterday, and it seems to work fine.
>However, I have a some mails, that are marked as spam and are _under_
>the spamscore of 5. I have even increased "Spam Lists To Reach High
>Score" to 3 instead of 2 (the mails that are marked as spam are found in
>only 1 Spam List.

If it is found in 1 spam list it is still marked as spam. As the option
name says, it is "Spam Lists to reach **High** score". High-scoring spam is
handled according to the "High Scoring Spam Actions" actions. Normal spam
is handled according to the "Spam Actions" setting.


>Here is an example from the logfile:
>
>Mar  3 03:09:59 watt MailScanner[3426]: New Batch: Scanning 1 messages,
>4177 bytes
>Mar  3 03:09:59 watt MailScanner[3426]: MCP Checks completed at 4177
>bytes per second
>Mar  3 03:09:59 watt MailScanner[3426]: Spam Checks: Starting
>Mar  3 03:10:01 watt MailScanner[3426]: RBL checks: 1AyLpd-0000tK-VF
>found in spamhaus.org
>Mar  3 03:10:05 watt MailScanner[3426]: Message 1AyLpd-0000tK-VF from
>69.42.78.187 (bdbiflciclcdbagglbgabcgeba at dc41.com) to anecon.com is
>spam, spamhaus.org, SpamAssassin (score=3.634, required 5, BAYES_90
>2.10, HTML_MESSAGE 0.10, MIME_HTML_ONLY 0.32, RCVD_IN_SBL 1.11)
>Mar  3 03:10:05 watt MailScanner[3426]: Spam Checks: Found 1 spam messages
>Mar  3 03:10:05 watt MailScanner[3426]: Spam Actions: message
>1AyLpd-0000tK-VF actions are store,deliver,striphtml
>Mar  3 03:10:05 watt MailScanner[3426]: Spam Checks completed at 696
>bytes per second
>
>
>As you can see, 5 points are required and this mail got 3.634 and was
>only in 1 RBL.
>What could trigger this? I have nothing special configured (no
>whitelists, no blacklists,..)

Appearance in 1 RBL causes the message to be marked as spam. If you don't
like that, set "Spam List =" (i.e. set it to nothing) and just use the RBL
functionality that is provided by SpamAssassin.

--
Julian Field
www.MailScanner.info
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654