<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: Arial; font-size: 10pt; color: #000000'>Yes as you see in the headers below, the mail has been classified as spam:<br><br>> X-Spam-Status: Yes<br><br>Either configure your mail client to put mails with the x-spam-status header in a spam folder, or handle it with actions in MS.<br><br>Setting mails with scoring > 3 to delete, is in my opinion *very* aggressive<br><br>The options you have now is reasonable (maybe a too low Required score), just configure your client to handle the header and you should be fine!<br><br>/Markus<br><br><hr id="zwchr"><div style="color: rgb(0, 0, 0); font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;"><b>Från: </b>"Mike's List" <mikelist@leawood.com><br><b>Till: </b>"MailScanner discussion" <mailscanner@lists.mailscanner.info><br><b>Skickat: </b>måndag, 10 okt 2011 16:01:51<br><b>Ämne: </b>Re: Not Catching Spams and Config<br><br><br>Required SA = 3<br>High SA Score = 10<br>Spam Actions = deliver header "X-Spam-Status: Yes"<br>High Scoring Spam Actions = store<br>Non Spam Actions = deliver header "X-Spam-Status: No"<br><br>I see. So I need to modify my "Spam Actions" and "High Scoring Spam<br>Actions" to that of "= delete" to remove spams and not store, i.e.<br>deliver with {spam?} status?<br><br>Thank you.<br><br><br>Mike<br><br><br>On Mon, 10 Oct 2011, Markus Nilsson wrote:<br><br>> Hi,<br>> <br>> SA does not trust DKIM, but you can use it to whitelist (or blacklist) certain senders that are using DKIM.<br>> <br>> If you check the scoring, you see that DKIM gives a (close to) 0 result.<br>> <br>> DKIM_SIGNED 0.10<br>> DKIM_VALID -0.10<br>> DKIM_VALID_AU -0.10<br>> <br>> I'd guess that your MS setting for scoring is not correctly set, what does your options<br>> <br>> Required SpamAssassin Score =<br>> High SpamAssassin Score =<br>> Spam Actions =<br>> High Scoring Spam Actions =<br>> Non Spam Actions =<br>> <br>> say?<br>> <br>> /Markus<br>> <br>> ______________________________________________________________________________________________________________________________________________________________________<br>> Från: "Mike's List" <mikelist@leawood.com><br>> Till: "MailScanner discussion" <mailscanner@lists.mailscanner.info><br>> Skickat: måndag, 10 okt 2011 14:59:26<br>> Ämne: Re: Not Catching Spams and Config<br>> <br>> <br>> I reset my Bayesian filter daily, 86400 sec, so this seems to help a<br>> bit. Additionally, I noticed spams are getting through even though<br>> I set my required score at 3 and the score > 3, example below.<br>> Furtheremore, there seems to be a pattern that spams are using DKIM<br>> to bypass SpamAssassin?<br>> <br>> All the spams that got through used servers with DKIM signature. This<br>> is not a MailScanner issue but probably SpamAssassin issue with allowing<br>> and/or trusting mail servers with DKIM?<br>> <br>> Get on SA mailing list and notify?<br>> <br>> <br>> DKIM-Signature: v=1;<br>> a=rsa-sha1; c=relaxed/relaxed; d=usmortgagehelper.com; s=gamma;<br>> t=1318215904; bh=VEP5C3Xju7bl6QtMCTmnJKkE8pk=; h=To:From;<br>> b=TVBqyP5jfRrp1f5hxil8Dmyz5n5d6WFoeiI/33/3N/8+NJXy9uKfEdJBLqplEsykz<br>> BvGivaUFmcXyTP1eprjGHcWBLeKcdxfxwe9uHQh3hlqP9mxqQkcnj8RoU5Une/B<br>> DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;<br>> s=gamma; d=usmortgagehelper.com;<br>> h=To:From;<br>> b=CwjXvg9wNQhJ4hhquqk+9iYNi8RvvejnDQx7DAp8/UwUYjeudyDovC2eVW1vpRrGU<br>> uKSNCL3cffKOWrM1XsQ/97JRsyHNwFlw2M69JQdReaxiFwBxY5aJS0ZAkmY/tUO;<br>> Received: from vargas.desylva.onlinejobhelpers.info by<br>> vargas.desylva.onlinejobhelpers.info with local (Exim 4.63)<br>> id 683438-q83a1858095-34<br>> for root@desylva.onlinejobhelpers.info; 09 Oct 2011 23:05:04 -0400<br>> Received: from usmortgagehelper.com (localhost.localdomain [127.0.0.1])<br>> by vargas.desylva.onlinejobhelpers.info (Postfix) with ESMTP id<br>> 44q83a1858095<br>> for root@localhost; 09 Oct 2011 23:05:04 -0400<br>> Message-ID: <1318215904.olhnweddetoyjhlvanr@usmortgagehelper.com><br>> Precedence: bulk<br>> List-Unsubscribe: <mailto:list@usmortgagehelper.com?subject=unsubscribe><br>> Content-Language: en-US<br>> Content-type: multipart/alternative;<br>> boundary="__MailScanner_found_Cyrus_boundary_substring_problem__"<br>> X-ORG-MailScanner-Information: Please contact the ISP for more<br>> information<br>> X-ORG-MailScanner-ID: p9A35PY9014111<br>> X-ORG-MailScanner: Found to be clean<br>> X-ORG-MailScanner-SpamCheck: spam, SpamAssassin (not cached,<br>> score=5.149,<br>> required 3, DCC_CHECK 1.10, DKIM_SIGNED 0.10, DKIM_VALID -0.10,<br>> DKIM_VALID_AU -0.10, HTML_IMAGE_RATIO_02 0.81, HTML_MESSAGE 0.00,<br>> LOTS_OF_MONEY 0.00, RCVD_IN_BRBL_LASTEXT 1.64, SPF_HELO_PASS -0.00,<br>> SPF_PASS -0.00, URIBL_DBL_SPAM 1.70)<br>> X-ORG-MailScanner-SpamScore: sssss<br>> X-ORG-MailScanner-From: rate.alert@usmortgagehelper.com<br>> X-Spam-Status: Yes<br>> <br>> <br>> On Sun, 9 Oct 2011, Mike's List wrote:<br>> <br>> ><br>> > I'm getting lots of spams, even though I have lowered the SA required<br>> > scores in the MailScanner.conf to that of 3. It seems like some spams<br>> > are not even being check by SpamAssassin? B<br>> ><br>> ><br>> > From /etc/MailScanner/MailScanner.conf<br>> > Required SpamAssassin Score = 3<br>> ><br>> ><br>> > Header: X-YOURORG-MailScanner-SpamCheck: not spam, SpamAssassin<br>> > (not cached, score=0, required 3, autolearn=not spam)<br>> ><br>> ><br>> > How can spams be getting a score of 0 if it is run through all those<br>> > RBLs, Pyzor, Razor, DCC, etc.?<br>> ><br>> ><br>> > I ran sa-update, and looked at /etc/sysconfig/update_spamassassin file<br>> > and saw the below. However, the below scripts are no where in /usr/bin<br>> > but in /usr/local/bin.<br>> ><br>> > MSSAUPDATE=/usr/sbin/update_spamassassin<br>> > SAUPDATE=/usr/bin/sa-update<br>> > SACOMPILE=/usr/bin/sa-compile<br>> > SAUPDATEARGS=""<br>> ><br>> ><br>> > I can make the change, etc. but I'm wondering what else I need to modify<br>> > to make this work? Is there like a "global" setting that missed<br>> > somewhere during Clam-SA installation, i.e. with the install.sh script?<br>> ><br>> > All inputs are welcome. Thank you.<br>> ><br>> ><br>> > Mike<br>> ><br>> > --<br>> > MailScanner mailing list<br>> > mailscanner@lists.mailscanner.info<br>> > http://lists.mailscanner.info/mailman/listinfo/mailscanner<br>> ><br>> > Before posting, read http://wiki.mailscanner.info/posting<br>> ><br>> > Support MailScanner development - buy the book off the website!<br>> --<br>> MailScanner mailing list<br>> mailscanner@lists.mailscanner.info<br>> http://lists.mailscanner.info/mailman/listinfo/mailscanner<br>> <br>> Before posting, read http://wiki.mailscanner.info/posting<br>> <br>> Support MailScanner development - buy the book off the website!<br>> <br>> <br>> <br>><br>-- <br>MailScanner mailing list<br>mailscanner@lists.mailscanner.info<br>http://lists.mailscanner.info/mailman/listinfo/mailscanner<br><br>Before posting, read http://wiki.mailscanner.info/posting<br><br>Support MailScanner development - buy the book off the website! <br></div><br></div></body></html>