{Spam?} Re: All mail treated as spam?

[Remy de Ruysscher]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]


 Remy de Ruysscher wrote:

  

 Hi,

I noticed something odd. As of today almost all of my mail treated as
spam. My configuration hasn't changed
in the last of weeks. The funny thing is, spam isn't caught anymore, it
scores very low. I'm receiving tons of spam right now.

I'm running MS 4.40.11 with SA 3.02 on FreeBSD 6-CURRENT.

Apr 28 21:06:03 unix-asp MailScanner[89231]: Message CBE144B8E4.3F20A
from 80.126.112.129 (owner-mailscanner at jiscmail.ac.uk) to unix-asp.com
is spam, RFC-IGNORANT-WHOIS, SpamAssassin (score=4.639, required 7, AWL
0.66, INFO_TLD 0.48, VIRUS_WARNING62 3.50)
    

 That's happening because you are using rfc-ignorant in your MailScanner
spam lists.

  

Thanks for the reply.

Yes, I saw the headers. I'm just wondered why this happened suddenly.

Why does MailScanner tags mail as spam, when it hits only 1 spam list
(and the spam score is below the threshold)? See my config below.


spam, RFC-IGNORANT-WHOIS,    SpamAssassin (score=0.805, required 7, AWL
0.27,    FORGED_RCVD_HELO 0.05, INFO_TLD 0.48)


#
Spam List = ORDB-RBL spamhaus.org spamhaus-XBL SBL+XBL spamcop.net
SORBS-DNSBL SORBS-DUL CBL RSL DSBL BLITZEDALL


# This is the list of spam domain blacklists which you are using
# (such as the "rfc-ignorant" domains). See the "Spam List Definitions"
# file for more information about what you can put here.
# This can also be the filename of a ruleset.
Spam Domain List = RFC-IGNORANT-DSN RFC-IGNORANT-BOGUSMX
RFC-IGNORANT-IPWHOIS RFC-IGNORANT-ABUSE

# If a message appears in at least this number of "Spam Lists" (as
defined
# above), then the message will be treated as "High Scoring Spam" and so
# the "High Scoring Spam Actions" will happen. You probably want to set
# this to 2 if you are actually using this feature. 5 is high enough that
# it will never happen unless you use lots of "Spam Lists".
# This can also be the filename of a ruleset.
Spam Lists To Reach High Score = 3

 rfc-ignorant currently lists the JISCMAIL.AC.UK domain, and has since
august 2004.

They take exception with the fact that the whois record for jiscmail
doesn't have any contact information at all. No address, No phone, No
email, Nothing.

You might want to not use rfc-ignorant as a spam-list.

In fact, IMHO, you shouldn't use MailScanner's spam-list at all. I've
yet to find any RBL that I find suitably low in false positives to be
trusted as a sole criteria for spam.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!
  


 --
met vriendelijke groet / with kind regards,

Remy de Ruysscher
remy at unix-asp.com
----

Microsoft: Where do you want to go today?
Linux: Where do you want to go tomorrow?
FreeBSD: Are you guys coming or what?
------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/)
and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2, "S/MIME Cryptographic Signature"  ]
    [ Application/X-PKCS7-SIGNATURE  3.9KB. ]
    [ Unable to print this part. ]