<p>And start using the digest tests! DCC and razor at least, and probably pyzor as well.</p>
<p>But as Markus says... Fix your trust path (and corresponding MailScanner setting) first!!! A simple search will givevthe details on how (SA has a good wiki article...).</p>
<p>Cheers<br>
-- <br>
-- Glenn</p>
<div class="gmail_quote">Den 18 nov 2011 17:19 skrev "Martin Hepworth" <<a href="mailto:maxsec@gmail.com">maxsec@gmail.com</a>>:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
and you're running stock spamassassin rules with no alterations? and running sa-update at least once per day?<div><br></div><div>I'd turn on a couple of RBL's (zen and spamcop are useful), enable the rbl's and make sure all but the ones you want are given a zero score in <a href="http://local.cf" target="_blank">local.cf</a> and they won't run.</div>
<div><br clear="all">-- <br>Martin Hepworth<br>Oxford, UK<br>
<br><br><div class="gmail_quote">On 18 November 2011 13:11, eric le corre <span dir="ltr"><<a href="mailto:eric_le_corre@msn.com" target="_blank">eric_le_corre@msn.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>Martin Hepworth <maxsec <at> <a href="http://gmail.com" target="_blank">gmail.com</a>> writes:<br>
<br>
><br>
><br>
> yes disable auto learn by commenting out the plugin in one of <br>
</div>the /usr/local/spamassassin/*.cf filesyou need to know WHAT spamassassin rule<br>
<div>is dragging the score down, you should be able to see this in Mailwatch or<br>
alter the following settings in MailWatch.conf and you'll get more info in the<br>
email headers to help diagnose..<br>
><br>
> Spam Score Number Format = %5.2f<br>
><br>
><br>
><br>
> Detailed Spam Report = yes<br>
><br>
><br>
><br>
> Include Scores In SpamAssassin Report = yes<br>
><br>
><br>
><br>
> Always Include SpamAssassin Report = yes<br>
><br>
><br>
><br>
> Spam Score Number Format = %5.2f<br>
><br>
</div>> -- Martin HepworthOxford, UKOn 17 November 2011 10:31, eric le corre<br>
<div><eric_le_corre <at> <a href="http://msn.com" target="_blank">msn.com</a>> wrote:<br>
> Spamassassin configuration is in autolearning. So there has to be found in<br>
> spam HAM.<br>
> Occasionally, I learn to SpamAssassin manually.<br>
> But this problem has been the case since I installed mailscanner. Since the<br>
> beginning I have negative cores.<br>
> Do I have to disable the AutoLearn, how?<br>
> how can your remove the old tokens?<br>
> <br>
> --<br>
</div>> MailScanner mailing listmailscanner <at><br>
lists.mailscanner.infohttp://<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanne" target="_blank">lists.mailscanner.info/mailman/listinfo/mailscanne</a><br>
<div>r<br>
> Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
> Support MailScanner development - buy the book off the website!<br>
><br>
<br>
<br>
</div>for example, example of spam that is not considered as spam by spamassasin<br>
with score 4.90<br>
in spam report, i can see :<br>
<br>
cached not<br>
score=4.904<br>
5 requis<br>
3.50 BAYES_99 Bayes spam probability is 99 to 100%<br>
0.00 FROM_12LTRDOM<br>
1.39 HTML_COMMENT_SAVED_URL HTML message is a saved web page<br>
0.00 HTML_MESSAGE HTML included in message<br>
0.00 SPF_FAIL SPF: sender does not match SPF record (fail)<br>
0.01 T_KHOP_FOREIGN_CLICK<br>
<br>
an other one :<br>
cached not<br>
score=1.58<br>
5 requis<br>
0.80 BAYES_50 Bayes spam probability is 40 to 60%<br>
0.10 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid<br>
-0.10 DKIM_VALID Message has at least one valid DKIM or DK signature<br>
0.00 HTML_MESSAGE HTML included in message<br>
0.78 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)<br>
<br>
<br>
thanks<br>
<div><div><br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
</div></div></blockquote></div><br></div>
<br>--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website!<br>
<br></blockquote></div>