"spam" with negative score. What settings do I need to change?

[Chris W. Parker]

Hello,

I had an email come in today with a negative score of 2.60. I searched
the archives and read that it's probably because the email was found on
a (some) RBL(s). I think this is in fact the reason it was marked as
spam.

1. If an email gets a negative score shouldn't it NOT be considered
spam, even if it does reach 'Spam Lists To Be Spam = 1'? In this case it
is a legitimate piece of mail that usually isn't found on the two lists
(SORBS-DNSBL and SORBS-SPAM).

2. I can't be sure of why it got a negative spam score because it wasn't
included in the mail headers and it's not in the maillog either. Notice
below that the line that USUALLY shows the scores and rules that were
tripped is cutoff. (I marked the line with ***) It just says "to
swatgear.com is" and that's it.

Oct 18 11:05:06 localhost sendmail[24018]: j9II55g5024018:
from=<abc at hotmail.com>, size=2188, class=0, nrcpts=1,
msgid=<BAY104-F34DD7766D08FCE76EDD471BB7
10 at phx.gbl>, proto=ESMTP, daemon=MTA,
relay=bay104-f34.bay104.hotmail.com [65.54.175.44]
Oct 18 11:05:06 localhost sendmail[24018]: j9II55g5024018:
to=<xyz at swatgear.com>, delay=00:00:01, mailer=esmtp, pri=32188,
stat=queued
Oct 18 11:05:11 localhost MailScanner[22139]: New Batch: Scanning 1
messages, 2683 bytes
Oct 18 11:05:11 localhost MailScanner[22139]: Spam Checks: Starting
Oct 18 11:05:14 localhost MailScanner[22139]: RBL checks: j9II55g5024018
found in SORBS-DNSBL, SORBS-SPAM
*** Oct 18 11:05:17 localhost MailScanner[22139]: Message j9II55g5024018
from 65.54.175.44 (abc at hotmail.com) to swatgear.com is
Oct 18 11:05:17 localhost MailScanner[22139]: Spam Checks: Found 1 spam
messages
Oct 18 11:05:17 localhost MailScanner[22139]: Spam Actions: message
j9II55g5024018 actions are deliver
Oct 18 11:05:18 localhost MailScanner[22139]: Virus and Content
Scanning: Starting

I've since whitelisted this email address in the hopes that even if it
does get found in an RBL (or two or three) it will not have the spam
message added to the subject. Is this true?

And some output from 'MailScanner -v':

This is CentOS release 4.1 (Final)
This is Perl version 5.008005 (5.8.5)
This is MailScanner version 4.46.2


Thanks!
Chris.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!