small spam score, but defined as spam

[James Gray]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Mon, 14 Mar 2005 02:16 pm, Jason wrote:
> Hi,
>
> Sometimes I recieve emails marked to be spam without enough spam score.
> The follow header is from an email (actually a spam). MailScanner
> correctly defines it as spam, but the score is just -0.125. So does
> MailScanner does not only rely on spam score? What else then?
>
> X-MailScanner-SpamCheck: spam, spamhaus-XBL, SpamAssassin (score=-0.125,
>  required 5, ALL_TRUSTED -3.30, BAYES_50 0.00, HTML_30_40 0.02,
>  HTML_MESSAGE 0.00, INVALID_DATE 0.24, MIME_HTML_ONLY 0.18,
>  MIME_QP_LONG_LINE 0.04, MSGID_OUTLOOK_INVALID 2.70)
> X-MailScanner-From: vang_fp at email.australia.edu
>
> Jason

Notice the ...SpamCheck: spam, spamhaus-XBL, SpamAssassin...
              ^ Header   ^     ^MS RBL       ^SA
                         |
                       Spam/Not spam "status"

After the spam check header, MailScanner is telling you it's classified it
as spam for two reasons:
1. the message was matched against spamhaus-XBL list
2. Spamassassin's score

Note it's an "OR" relationship, not "AND".  In other words, if you have
configured RBL's in MailScanner.conf AND MailScanner to use SpamAssassin,
then the first one to identify spam, wins.  If neither identify it as spam,
it's considered clean (ham).

If you want to rely on SpamAssassin ONLY, take out the RBL's in
MailScanner.conf.  Then your mail will only be identified as spam if
SpamAssassin scores above 5.  SA also uses RBL's (many more than
MailScanner in fact) so you wont be "loosing" anything, but you will be
able to adjust the scores of RBL's you trust etc from the
spam.assassin.prefs.conf file, or by custom rules etc.

HTH,

James
--
Just when you thought you were winning the rat race, along comes a
faster rat!!!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!