Spam score is negative, yet message is still marked as spam

[am.lists]

On 3/12/07, Jonathan B Bayer <jbayer at bayertechnologygroup.com> wrote:
> Hello mailscanner,
>
> Hello all.
>
> I have a new installation of MailScanner installed on a new mail
> server.  The basic configuration is:
>
> RedHat Enterprise 3
> Postfix 2.1.3
> Mailscanner 4.58.9-1
>
> One of the users has been sending messages to the company president.
> These messages are being marked as spam and moved to the spam folder.
>
> However, when I examined the message headers, I found the following:
>
> X-*****************_com-MailScanner-Information: Please contact the ISP for more information
> X-*****************_com-MailScanner: Found to be clean
> X-*****************_com-MailScanner-SpamCheck: spam, spamhaus-ZEN,
>  SpamAssassin (not cached, score=-4.17, required 6,
>  autolearn=not spam, ALL_TRUSTED -1.80, BAYES_00 -2.60,
>  HTML_MESSAGE 0.00, HTML_TAG_BALANCE_BODY 0.23)
> X-*****************_com-MailScanner-From: dmakhijani@*****************.com
> X-Spam-Status: Yes
>
>
> and the subject had the {Spam?}  inserted.
>
> Why would this be marked as spam, if the score is -4.17 ?
>
> What's even stranger is that the user's computer connects directly
> with the mail server to send the email, so it isn't even going through
> another relay.

I think you nailed it right there. The user's computer connected
directly to the mail server. -- I'm guessing (without seeing the IP or
a log) that you had a RBL lookup notice that the client computer was a
dial-up or otherwise dynamic IP and flagged it as an RBL.

RBL hits will trigger the low-score spam action, even if the SA score is below.

Angelo