X-Spam-Flag issue- same score < kill but flagged as spam?

Discuss your pilot or production implementation with other Zimbra admins or our engineers.
Post Reply
jameztcc
Posts: 26
Joined: Fri Sep 12, 2014 10:33 pm

X-Spam-Flag issue- same score < kill but flagged as spam?

Post by jameztcc »

Hi,
anyone able to help figure why these 2 sets of emails received with different -negative tags (both still result


thanks a lot,

James


X-Spam-Flag: YES

X-Spam-Score: -16.106

X-Spam-Level:

X-Spam-Status: Yes, score=3.894-20 tag=-10 tag2=3.4 kill=3.4

tests=[DNS_FROM_RFC_ABUSE=0.2, DNS_FROM_RFC_POST=1.708,

HTML_90_100=0.113, HTML_ATTR_UNIQUE=0.639, HTML_FONT_FACE_BAD=0.156,

HTML_MESSAGE=0.001, HTML_TEXT_AFTER_BODY=0.115, NO_REAL_NAME=0.961,

UNPARSEABLE_RELAY=0.001]

--------------------------

X-Spam-Score: -6.106

X-Spam-Level:

X-Spam-Status: No, score=3.894-10 tagged_above=-10 required=3.4

tests=[DNS_FROM_RFC_ABUSE=0.2, DNS_FROM_RFC_POST=1.708,

HTML_90_100=0.113, HTML_ATTR_UNIQUE=0.639, HTML_FONT_FACE_BAD=0.156,

HTML_MESSAGE=0.001, HTML_TEXT_AFTER_BODY=0.115, NO_REAL_NAME=0.961,

UNPARSEABLE_RELAY=0.00
veronica
Outstanding Member
Outstanding Member
Posts: 592
Joined: Fri Sep 12, 2014 11:35 pm

X-Spam-Flag issue- same score < kill but flagged as spam?

Post by veronica »

Could you provide the o/p of :-

zmprov gacf | grep -i spam

and /opt/zimbra/conf/salocal.cf
jameztcc
Posts: 26
Joined: Fri Sep 12, 2014 10:33 pm

X-Spam-Flag issue- same score < kill but flagged as spam?

Post by jameztcc »

Hi Veronica,
here is the information, thanks a lot.
"zimbraCOSInheritedAttr: zimbraMailSpamLifetime

zimbraCOSInheritedAttr: zimbraPrefIncludeSpamInSearch

zimbraDomainAdminModifiableAttr: zimbraMailSpamLifetime

zimbraDomainAdminModifiableAttr: zimbraPrefIncludeSpamInSearch

zimbraSpamCheckEnabled: TRUE

zimbraSpamHeader: X-Spam-Flag

zimbraSpamHeaderValue: YES

zimbraSpamIsNotSpamAccount: yyyyy.@xxxx

zimbraSpamIsSpamAccount: yyyyy@xxxx

zimbraSpamKillPercent: 17

zimbraSpamSubjectTag: *** POSSIBLE SPAM ***

zimbraSpamTagPercent: 17

"
"# This is the right place to customize your installation of SpamAssassin.

#

# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be

# tweaked.

#

###########################################################################

#

# rewrite_header Subject *****SPAM*****

# report_safe 1

# trusted_networks xxxx

# lock_method flock
header DSPAM_SPAM X-DSPAM-Result =~ /^Spam$/

describe DSPAM_SPAM DSPAM claims it is spam

score DSPAM_SPAM 0.5
header DSPAM_HAM X-DSPAM-Result =~ /^Innocent$/

describe DSPAM_HAM DSPAM claims it is ham

score DSPAM_HAM -0.1
trusted_networks xxxx
rewrite_header Subject *SPAM* _STARS(*)_

bayes_auto_learn 1

bayes_min_spam_num 60

bayes_min_ham_num 60

clear_headers

add_header spam Flag _YESNOCAPS_

add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTS_ autolearn=_AUTOLEARN_ version=_VERSION_

add_header all Level _STARS(*)_

add_header all Checker-Version SpamAssassin _VERSION_ (_SUBVERSION_) on _HOSTNAME_

"


[quote user="veronica"]Could you provide the o/p of :-

zmprov gacf | grep -i spam

and /opt/zimbra/conf/salocal.cf[/QUOTE]
veronica
Outstanding Member
Outstanding Member
Posts: 592
Joined: Fri Sep 12, 2014 11:35 pm

X-Spam-Flag issue- same score < kill but flagged as spam?

Post by veronica »

i see the score in your header as:-
X-Spam-Status: Yes, score=3.894-20 tag=-10 tag2=3.4 kill=3.4
it says 3.894-20. what is this 20 is the question
veronica
Outstanding Member
Outstanding Member
Posts: 592
Joined: Fri Sep 12, 2014 11:35 pm

X-Spam-Flag issue- same score < kill but flagged as spam?

Post by veronica »

Do you have MTA logs corresponsing to these messages ?
jameztcc
Posts: 26
Joined: Fri Sep 12, 2014 10:33 pm

X-Spam-Flag issue- same score < kill but flagged as spam?

Post by jameztcc »

Hi Veronica,
that's the confusing part. The only minus should only be -10, not sure how or where this -20 got out from.
Is there any other config files I should look at to dig out that -20?
[quote user="veronica"]i see the score in your header as:-
X-Spam-Status: Yes, score=3.894-20 tag=-10 tag2=3.4 kill=3.4
it says 3.894-20. what is this 20 is the question[/QUOTE]
jameztcc
Posts: 26
Joined: Fri Sep 12, 2014 10:33 pm

X-Spam-Flag issue- same score < kill but flagged as spam?

Post by jameztcc »

[quote user="veronica"]Do you have MTA logs corresponsing to these messages ?[/QUOTE]
I got these logs from the same message id for the "-20" item... ...
-----

./zimbra.log.11.gz:Jun 5 10:31:42 host1 postfix/cleanup[18604]: D46DDCF061D: message-id=

./zimbra.log.11.gz:Jun 5 10:31:45 host1 postfix/cleanup[21403]: 3AAB5CF0630: message-id=

./zimbra.log.11.gz:Jun 5 10:31:45 host1 postfix/cleanup[18604]: 48637CF0634: message-id=

./zimbra.log.11.gz:Jun 5 10:31:45 host1 amavis[21421]: (21421-01) Passed SPAM, LOCAL [X.X.X.X] [Y.Y.Y.Y] -> ,,, quarantine: admin@receiving.com, Message-ID: , mail_id: gpIDWLHa6D9y, Hits: 3.894-20, queued_as: 48637CF0634, 2469 ms

./zimbra.log.11.gz:Jun 5 10:31:45 host1 amavis[21421]: (21421-01) Blocked SPAM, LOCAL [X.X.X.X] [Y.Y.Y.Y] -> ,,,,, quarantine: admin@receiving.com, Message-ID: , mail_id: gpIDWLHa6D9y, Hits: 3.894-20, 2469 ms
-----
Post Reply