<br><br><div class="gmail_quote">On 21 July 2010 20:15, <span dir="ltr"><<a href="mailto:derek.winkler@algorithmics.com">derek.winkler@algorithmics.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p class="MsoNormal">I just upgraded from 4.69.9 to 4.79.11, SA from 3.2.5 to SA
3.3.1.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Everything lints fine, can’t find any problems.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I’m getting spam that when processed by MS scores
quite low,</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">X-Algo-MailScanner-SpamCheck: not spam, SpamAssassin
(score=0.5,</p>
<p class="MsoNormal"> required
4.5, autolearn=disabled, RCVD_IN_BRBL 0.50)</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">but when tested with SA within minutes on the same server
scores quite high,</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Content analysis details: (23.7 points, 5.0
required)</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> pts rule
name
description</p>
<p class="MsoNormal">---- ----------------------
--------------------------------------------------</p>
<p class="MsoNormal"> 0.5
RCVD_IN_BRBL RBL:
Received via a relay in BRBL</p>
<p class="MsoNormal">
[198.7.242.169 listed in <a href="http://b.barracudacentral.org" target="_blank">b.barracudacentral.org</a>]</p>
<p class="MsoNormal"> 1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay
in <a href="http://bl.spamcop.net" target="_blank">bl.spamcop.net</a></p>
<p class="MsoNormal">
[Blocked - see <<a href="http://www.spamcop.net/bl.shtml?198.7.242.169" target="_blank">http://www.spamcop.net/bl.shtml?198.7.242.169</a>>]</p>
<p class="MsoNormal"> 1.6 RCVD_IN_BRBL_LASTEXT RBL:
RCVD_IN_BRBL_LASTEXT</p>
<p class="MsoNormal">
[198.7.242.169 listed in <a href="http://bb.barracudacentral.org" target="_blank">bb.barracudacentral.org</a>]</p>
<p class="MsoNormal"> 0.7
RCVD_IN_XBL
RBL: Received via a relay in Spamhaus XBL</p>
<p class="MsoNormal">
[198.7.242.169 listed in <a href="http://zen.spamhaus.org" target="_blank">zen.spamhaus.org</a>]</p>
<p class="MsoNormal"> 2.7 RCVD_IN_PSBL
RBL: Received via a relay in PSBL</p>
<p class="MsoNormal">
[198.7.242.169 listed in <a href="http://psbl.surriel.com" target="_blank">psbl.surriel.com</a>]</p>
<p class="MsoNormal"> 4.5
URIBL_AB_SURBL Contains an URL
listed in the AB SURBL blocklist</p>
<p class="MsoNormal">
[URIs: <a href="http://erectgardiner81b.ru" target="_blank">erectgardiner81b.ru</a>]</p>
<p class="MsoNormal"> 1.7
URIBL_WS_SURBL Contains an URL
listed in the WS SURBL blocklist</p>
<p class="MsoNormal">
[URIs: <a href="http://erectgardiner81b.ru" target="_blank">erectgardiner81b.ru</a>]</p>
<p class="MsoNormal"> 1.9
URIBL_JP_SURBL Contains an URL
listed in the JP SURBL blocklist</p>
<p class="MsoNormal">
[URIs: <a href="http://erectgardiner81b.ru" target="_blank">erectgardiner81b.ru</a>]</p>
<p class="MsoNormal"> 1.7
URIBL_DBL_SPAM Contains an URL
listed in the DBL blocklist</p>
<p class="MsoNormal">
[URIs: <a href="http://erectgardiner81b.ru" target="_blank">erectgardiner81b.ru</a>]</p>
<p class="MsoNormal">-0.0 T_RP_MATCHES_RCVD
Envelope sender domain matches handover relay</p>
<p class="MsoNormal">
domain</p>
<p class="MsoNormal"> 0.9 SPF_HELO_SOFTFAIL
SPF: HELO does not match SPF record (softfail)</p>
<p class="MsoNormal"> 0.6
URIBL_SBL
Contains an URL listed in the SBL blocklist</p>
<p class="MsoNormal">
[URIs: <a href="http://erectgardiner81b.ru" target="_blank">erectgardiner81b.ru</a>]</p>
<p class="MsoNormal"> 0.0 HTML_IMAGE_ONLY_32 BODY:
HTML: images with 2800-3200 bytes of words</p>
<p class="MsoNormal"> 0.6 HTML_IMAGE_RATIO_04 BODY: HTML
has a low ratio of text to image area</p>
<p class="MsoNormal"> 0.0
HTML_MESSAGE BODY:
HTML included in message</p>
<p class="MsoNormal"> 1.7
RAZOR2_CHECK Listed
in Razor2 (<a href="http://razor.sf.net/" target="_blank">http://razor.sf.net/</a>)</p>
<p class="MsoNormal"> 2.4 RAZOR2_CF_RANGE_E8_51_100 Razor2 gives engine 8
confidence level</p>
<p class="MsoNormal">
above 50%</p>
<p class="MsoNormal">
[cf: 100]</p>
<p class="MsoNormal"> 0.4 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence
level above 50%</p>
<p class="MsoNormal">
[cf: 100]</p>
<p class="MsoNormal"> 0.4
RDNS_DYNAMIC
Delivered to internal network by host with</p>
<p class="MsoNormal">
dynamic-looking rDNS</p>
<p class="MsoNormal"> 0.0
T_SURBL_MULTI2 T_SURBL_MULTI2</p>
<p class="MsoNormal"> 0.0
T_SURBL_MULTI1 T_SURBL_MULTI1</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Any ideas why?</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Using Sendmail on RHEL4.</p>
</div>
</div>
<br>--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
<br></blockquote></div><br>Derek<br><br>I'd check your mailscanner is checking against the correct spamassassin and not using cruft from the old version.<br><br clear="all"><br>-- <br>Martin Hepworth<br>Oxford, UK<br>