<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 2017-06-08 01:02 PM, Mark Sapiro
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:29738945-d2a0-6379-f3d4-7296c7ec0a48@msapiro.net">
<pre wrap="">On 06/08/2017 09:10 AM, Gao wrote:
</pre>
<blockquote type="cite">
<pre wrap="">
There are several cases that MailScanner give high score for incoming
email send from Blackberry device. I don't know how to deal with this. I
set the spam score is 5.0 and those blackberry email seems always get
identified as spam.
</pre>
</blockquote>
<pre wrap="">
What version of SpamAssassin is this?
...>
envelope-from=<a class="moz-txt-link-rfc2396E" href="mailto:SRS0=HaG/vD=5N=mydomain.com=gjv@srs.bis6.us.blackberry.com">"SRS0=HaG/vD=5N=mydomain.com=gjv@srs.bis6.us.blackberry.com"</a>;
...
</pre>
<blockquote type="cite">
<pre wrap="">Jun 7 23:16:32 zeta MailScanner[27196]: Message 449B320030FB3.A5EA6
from 74.82.85.4
(<a class="moz-txt-link-abbreviated" href="mailto:srs0=hag/vd=5n=mydomain.com=gjv@srs.bis6.us.blackberry.com">srs0=hag/vd=5n=mydomain.com=gjv@srs.bis6.us.blackberry.com</a>) to
mydomain.com is spam, SpamAssassin (not cached, score=5.08, required 4,
BAYES_00 -1.90, FSL_HELO_BARE_IP_2 1.00, HEADER_FROM_DIFFERENT_DOMAINS
1.00, RATWARE_EFROM 3.00, RCVD_IN_DNSWL_NONE -0.00, RDNS_DYNAMIC 0.98,
SPF_PASS -0.00, XPRIO_SHORT_SUBJ 1.00)
</pre>
</blockquote>
<pre wrap="">
Your largest score is RATWARE_EFROM 3.00. Without it the message would
score 2.08.
The reason I ask about version is this score comes from
Mail::SpamAssassin::Plugin::HeaderEval::check_ratware_envelope_from()
Which in SA 3.4.1 at least has
return 0 if $from =~ /^SRS\d=/;
per
<a class="moz-txt-link-rfc2396E" href="https://fossies.org/dox/Mail-SpamAssassin-3.4.1/classMail_1_1SpamAssassin_1_1Plugin_1_1HeaderEval.html#ab8531c37621db88b28eb3c7dc5c97d58"><https://fossies.org/dox/Mail-SpamAssassin-3.4.1/classMail_1_1SpamAssassin_1_1Plugin_1_1HeaderEval.html#ab8531c37621db88b28eb3c7dc5c97d58></a>
which seems to be designed to exempt envelope senders beginning with
SRS, a digit and = as this message does.
If the issue is an older SA and you can't upgrade, you can always set
the score for RATWARE_EFROM to zero.
</pre>
</blockquote>
<span style="color: rgb(0, 0, 0); font-family: verdana, sans-serif;
font-size: medium; font-style: normal; font-variant-ligatures:
normal; font-variant-caps: normal; font-weight: normal;
letter-spacing: normal; orphans: 2; text-align: start;
text-indent: 0px; text-transform: none; white-space: normal;
widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;
text-decoration-style: initial; text-decoration-color: initial;
display: inline !important; float: none;">Thank you for the help.<br>
I am using SpamAssassin Version:3.4.0. I am not sure where to
check for the code you mentioned. I'll make a rule to adjust the
RATWARE_EFROM score.<br>
<br>
Gao<span> <br>
</span></span>
</body>
</html>