SA+MS miss spam, scored with 0.00.

[Scott Silva]

on 6-5-2009 5:51 PM Steve Barnes spake the following:
> Hi
> 
> MS 4.77.7
> SA 3.2.5
> Postfix 2.6.0
> FreeBSD 7.2
> 
> I'm trying to understand why MS and SA missed a spam the first time
> round (scored with 0.00). Resubmitting from quarantine as root with:
> 
> spamassassin -x -D <
> /var/spool/MailScanner/quarantine/20090605/nonspam/8F54D11485.A3CE1
> 
> it was scored at 11.2. I don't believe it's a case of online checks
> "catching up" since the majority of rules that matched 2nd time round
> aren't time-related:
> 
>  pts rule name              description
> ---- ----------------------
> --------------------------------------------------
>  1.8 SUBJ_ALL_CAPS          Subject is all capitals
>  1.6 MISSING_HEADERS        Missing To: header
>  1.4 DCC_CHECK              Listed in DCC
> (http://rhyolite.com/anti-spam/dcc/)
>  1.5 MSGID_FROM_MTA_HEADER  Message-Id was added by a relay
>  0.7 MSOE_MID_WRONG_CASE    MSOE_MID_WRONG_CASE
>  4.2 FORGED_MUA_OUTLOOK     Forged mail pretending to be from MS Outlook
> 
> Even without DCC_CHECK, it should have scored 9.8. The SA report contains:
> 
> not spam, SpamAssassin (not cached, score=0, required 6, autolearn=)
> 
> I keep seeing this "autolearn=)" truncation in cases where spam is
> missed. Can anyone else confirm seeing it in their maillog? Otherwise,
> MS + SA are catching 99% of the other spams coming in. I've included
> the corresponding maillog entry at the bottom of this message.
> 
> Thanks
> 
> Steve
> 
>
I think you need the latest version (4.77-10) to fix a bug that crept into
postfix support.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 258 bytes
Desc: OpenPGP digital signature
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20090608/021e35a0/signature.bin