"spam" with negative score. What settings do I need to change?

[Matt Kettler]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Chris W. Parker wrote:
> Hello,
> 
> I had an email come in today with a negative score of 2.60. I searched
> the archives and read that it's probably because the email was found on
> a (some) RBL(s). I think this is in fact the reason it was marked as
> spam.

Yes, spam lists in MailScanner.conf will cause the message to be marked as spam,
no matter what the spamassassin score is. They are absolute.

> 
> 1. If an email gets a negative score shouldn't it NOT be considered
> spam, even if it does reach 'Spam Lists To Be Spam = 1'? In this case it
> is a legitimate piece of mail that usually isn't found on the two lists
> (SORBS-DNSBL and SORBS-SPAM).

No. If you trust a DNSBL enough to use it as a MailScanner spam list, then you
should trust it all the time.

If the DNSBL isn't sufficiently accurate for you to trust it, it shouldn't be in
the spam lists, instead it should be called by SA and factored into the score.

> > 2. I can't be sure of why it got a negative spam score because it wasn't
> included in the mail headers and it's not in the maillog either. Notice
> below that the line that USUALLY shows the scores and rules that were
> tripped is cutoff. (I marked the line with ***) It just says "to
> swatgear.com is" and that's it.

That's weird, but I don't know why that would happen.

> I've since whitelisted this email address in the hopes that even if it
> does get found in an RBL (or two or three) it will not have the spam
> message added to the subject. Is this true?

If you whitelisted it using MailScanner's whitelist, yes. If you used
SpamAssassin's whitelist (whitelist_from, etc) then no.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!