"spam" with negative score. What settings do I need to change?

[Julian Field]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Edit /usr/lib/MailScanner/MailScanner/RBLs.pm.
Right at the bottom of the file, edit the last few lines so that they 
look like this:

- -----SNIP-----
  # The return from the pipe is a measure of how spammy it was
  MailScanner::Log::InfoLog("RBL checks: %s found in %s", $message->{id},
                            join(', ', @HitList))
    if @HitList && MailScanner::Config::Value('logspam');
  MailScanner::Log::DebugLog("RBL Checks: returned $PipeReturn");

  # No point actually using $PipeReturn, as we want to get a
  # useful result even when the child never reached its exit()
  #$PipeReturn = $PipeReturn>>8;
  # JKF 3/10/2005
  my $temp = @HitList;
  $temp = $temp + 0;
  return ($temp, join(', ', @HitList));
}

1;
- -----SNIP-----

The new bit is the JKF 3/10/2005 bit. This gets around a Perl bug, the 
same one has happened several times before. This should fix it for you.

Note that you will of course need to restart MailScanner after making 
this change. Before you do this, it is worth syntax-checking your new 
file to be sure you haven't missed a ";" or anything like that:
    perl -c RBLs.pm
That shouldn't output anything much at all. If that is okay, then do a 
"service MailScanner restart".


Chris W. Parker wrote:

>Hello,
>
>I had an email come in today with a negative score of 2.60. I searched
>the archives and read that it's probably because the email was found on
>a (some) RBL(s). I think this is in fact the reason it was marked as
>spam.
>
>1. If an email gets a negative score shouldn't it NOT be considered
>spam, even if it does reach 'Spam Lists To Be Spam = 1'? In this case it
>is a legitimate piece of mail that usually isn't found on the two lists
>(SORBS-DNSBL and SORBS-SPAM).
>
>2. I can't be sure of why it got a negative spam score because it wasn't
>included in the mail headers and it's not in the maillog either. Notice
>below that the line that USUALLY shows the scores and rules that were
>tripped is cutoff. (I marked the line with ***) It just says "to
>swatgear.com is" and that's it.
>
>Oct 18 11:05:06 localhost sendmail[24018]: j9II55g5024018:
>from=<abc at hotmail.com>, size=2188, class=0, nrcpts=1,
>msgid=<BAY104-F34DD7766D08FCE76EDD471BB7
>10 at phx.gbl>, proto=ESMTP, daemon=MTA,
>relay=bay104-f34.bay104.hotmail.com [65.54.175.44]
>Oct 18 11:05:06 localhost sendmail[24018]: j9II55g5024018:
>to=<xyz at swatgear.com>, delay=00:00:01, mailer=esmtp, pri=32188,
>stat=queued
>Oct 18 11:05:11 localhost MailScanner[22139]: New Batch: Scanning 1
>messages, 2683 bytes
>Oct 18 11:05:11 localhost MailScanner[22139]: Spam Checks: Starting
>Oct 18 11:05:14 localhost MailScanner[22139]: RBL checks: j9II55g5024018
>found in SORBS-DNSBL, SORBS-SPAM
>*** Oct 18 11:05:17 localhost MailScanner[22139]: Message j9II55g5024018
>from 65.54.175.44 (abc at hotmail.com) to swatgear.com is
>Oct 18 11:05:17 localhost MailScanner[22139]: Spam Checks: Found 1 spam
>messages
>Oct 18 11:05:17 localhost MailScanner[22139]: Spam Actions: message
>j9II55g5024018 actions are deliver
>Oct 18 11:05:18 localhost MailScanner[22139]: Virus and Content
>Scanning: Starting
>
>I've since whitelisted this email address in the hopes that even if it
>does get found in an RBL (or two or three) it will not have the spam
>message added to the subject. Is this true?
>
>And some output from 'MailScanner -v':
>
>This is CentOS release 4.1 (Final)
>This is Perl version 5.008005 (5.8.5)
>This is MailScanner version 4.46.2
>
>
>Thanks!
>Chris.
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the Wiki (http://wiki.mailscanner.info/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>  
>

- -- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.0.2 (Build 2424)

iQA/AwUBQ1aBCRH2WUcUFbZUEQKnwQCgjhkmwCc5xVvvQ7tGhX8x99cbiaUAoIPZ
I3R4z3u33vSDVhTbSVoFvoVA
=arLi
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!