Bug with HTML messages?

[Denis Beauchemin]

Le 2010-07-29 17:09, Alex Broens a écrit :
> On 2010-07-29 21:04, Denis Beauchemin wrote:
>>
>>
>> Le 2010-07-29 14:57, Alex Broens a écrit :
>>> On 2010-07-29 20:07, Denis Beauchemin wrote:
>>>>  Oops, I switched those 2:
>>>>
>>>>> SA scoring with HTML-only email: (not cached, score=12.639, requis 
>>>>> 4.5, autolearn=spam, DEAR_SOMETHING 1.60, DRUGS_ERECTILE 0.28, 
>>>>> DRUGS_ERECTILE_OBFU 1.23, DRUG_ED_CAPS 0.32, HTML_MESSAGE 0.00, 
>>>>> KAM_VIAGRA1 3.00, KAM_VIAGRA5 3.10, KAM_VIAGRA6 3.10)
>>>>>
>>>>> SA scoring with HTML+TXT email: (not cached, score=7.181, requis 
>>>>> 4.5, DCC_CHECK 2.17, HTML_MESSAGE 0.00, HTML_TAG_BALANCE_HEAD 
>>>>> 1.33, MIME_HTML_ONLY 1.46, TVD_SPACE_RATIO 2.22)
>>>>>
>>>>
>>>> SA scoring with HTML+TXT email: (not cached, score=12.639, requis 
>>>> 4.5, autolearn=spam, DEAR_SOMETHING 1.60, DRUGS_ERECTILE 0.28, 
>>>> DRUGS_ERECTILE_OBFU 1.23, DRUG_ED_CAPS 0.32, HTML_MESSAGE 0.00, 
>>>> KAM_VIAGRA1 3.00, KAM_VIAGRA5 3.10, KAM_VIAGRA6 3.10)
>>>>
>>>> SA scoring with HTML-only email: (not cached, score=7.181, requis 
>>>> 4.5, DCC_CHECK 2.17, HTML_MESSAGE 0.00, HTML_TAG_BALANCE_HEAD 1.33, 
>>>> MIME_HTML_ONLY 1.46, TVD_SPACE_RATIO 2.22)
>>>>
>>>
>>> you are not feeding it consistent content.
>>> where is the problem?
>>>
>>> get a real spam wich was tagged as spam and dumped in your quaratine.
>>> feed that to spamassassin (without MS), is the result consistent?
>>>
>>> if not, its usually due to MS's msg chunk settings
>>>
>>>
>>
>> Alex,
>>
>> When I feed the emails to SA they get scored much higher than through 
>> MS.
>>
>> My point is that an HTML-only email with quite common spam words are 
>> not being scored, while an HTML+TXT email with the same spam words 
>> get scored.  This looks quite suspicious to me.
>>
>> Denis
>>
>
> what are your MS "chunk" settings?
> are you sure MS is sending the full message to SA?
>
> pls post the sample message you're using in pastebin so ppl can try to 
> reproduce.
>
> Alex
>

Alex,

I don't think my chunk settings really matter since the email is really 
short: http://pastebin.com/sMf7rW6s for the HTML-only version and 
http://pastebin.com/eiTTWuer for the HTML+TXT version.

Some MS settings that were changed from the default values:
Max Spam Check Size = 500000
Max SpamAssassin Size = 200k trackback

Thanks!

Denis

-- 
Denis Beauchemin, analyste
Université de Sherbrooke, S.T.I.
T: 819.821.8000x62252 F: 819.821.8045