All messages getting marked as Spam

[Sumit Bhattacharjee]

The problem has disappeared on its own two days after starting.  Jules, I
had downloaded the tarball for the 4.83.4-1 build, but didn't get the chance
to upgrade before the issue corrected itself.  I am thinking that it could
be an issue with DNS resolution as Alex had earlier pointed out (although
that seems unlikely to me because none of my other machines/services had any
DNS issues) or that SpamAssassin update process picked up some bad file
which for a couple of days kept reporting spam for practically every
message, until it got rewritten in a subsequent update.

Thanks for your suggestions and help folks!

Cheers,
Sumit 

-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Jules Field
Sent: Wednesday, March 23, 2011 11:55 AM
To: MailScanner discussion
Subject: {Spam?} Re: All messages getting marked as Spam

I have just published an update to MailScanner which resolves this problem.

Thanks to Steve Freegard for his invaluable help!

Cheers,
Jules.

On 23/03/2011 06:41, Alex Broens wrote:
> On 2011-03-23 1:47, Sumit Bhattacharjee wrote:
>> Hello All,
>>
>> I have been using MailScanner for several months now and it has been 
>> working very well.  However, since yesterday, almost all inbound 
>> messages are getting marked marked as Spam.  I have the SpamAssassin 
>> threshold set to 6 (default I believe), and following are a couple of 
>> examples of the spam report (email from different domains/IP's):
>>
>> X-cospringsitcom-MailScanner-SpamCheck: spam, SpamAssassin (not cached,
>>   score=7.983, required 6, FREEMAIL_FROM 0.00, HTML_MESSAGE 0.00,
>>   MIME_QP_LONG_LINE 0.00, RCVD_IN_DNSWL_NONE -0.00,
>>   T_TO_NO_BRKTS_FREEMAIL 0.01, URIBL_BLACK 1.77, URIBL_RED 0.00,
>>   URIBL_RHS_DOB 0.28, URIBL_SEM_FRESH 0.81, URIBL_SEM_FRESH_10 1.01,
>>   URIBL_SEM_FRESH_15 4.10)
>> X-cospringsitcom-MailScanner-SpamScore: 7
>>
>> X-cospringsitcom-MailScanner-SpamCheck: spam, SpamAssassin (not cached,
>>   score=9.235, required 6, HTML_MESSAGE 0.00, RCVD_IN_DNSWL_NONE -0.00,
>>   URIBL_BLACK 1.77, URIBL_RED 0.00, URIBL_RHS_DOB 0.28, URIBL_SEM 1.26,
>>   URIBL_SEM_FRESH 0.81, URIBL_SEM_FRESH_10 1.01,
>>   URIBL_SEM_FRESH_15 4.10, URIBL_SEM_RED 0.00)
>> X-cospringsitcom-MailScanner-SpamScore: 9
>>
>> The commonality that I am seeing is that the URIBL_BLACK  is 1.77 for 
>> almost all messages and URIBL_SEM_FRESH_15 is 4.10.  But I am not 
>> sure what has changed (nothing should have).
>>
>> I'd much appreciate any debugging steps recommended by experts on 
>> this list.
>
> either ALL your mail has blacklisted URLs in it (highly unlikely) or 
> you have a DNS issue. Are you using a local resolver or your ISP's 
> recursor?

Jules

--
Julian Field MEng CITP CEng
www.MailScanner.info

Buy the MailScanner book at www.MailScanner.info/store Need help customising
MailScanner? Contact me!

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654 Follow me
at twitter.com/JulesFM

'All programs have a desire to be useful' - Tron, 1982


--
This message has been scanned for viruses and dangerous content by
MailScanner, and is believed to be clean.

--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website! 

--
This message has been scanned for viruses and dangerous content by
MailScanner, and is believed to be clean.




This electronic mail (including any attachments) may contain information that is privileged, confidential, and/or otherwise protected from disclosure to anyone other than its intended recipient(s). Any dissemination or use of this electronic email or its contents (including any attachments) by persons other than the intended recipient(s) is strictly prohibited. If you have received this message in error, please notify us immediately by reply email so that we may correct our internal records. Please then delete the original message (including any attachments) in its entirety. Thank you.