Why did this mail get any score at all?

[Mathias Homann <ad...@eregion.de>]

Hi,


here's the headers of a mail that got scored (ok, not very high but it 
should get no score at all):

Return-Path: <XXX>
X-Sieve: cmu-sieve 2.0
Return-Path: <XXX>
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on 
	celebrimbor.eregion.home
X-Spam-Status: No, score=1.7 required=5.0 tests=ALL_TRUSTED,BAYES_00,
	DCC_CHECK,SUBJECT_EXCESS_QP autolearn=no version=3.1.0
X-Spam-Level: *
Received: from www.eregion.de (unknown [127.0.0.1])
	by www.eregion.de (Postfix on SuSE Linux 8.0 (i386)) with ESMTP id 
12A20147BB
	for <XXX>; Fri,  4 Nov 2005 05:50:06 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
	by www.eregion.de (Postfix on SuSE Linux 8.0 (i386)) with ESMTP id 
AE31313FF6
	for <XXX>; Fri,  4 Nov 2005 06:50:05 +0100 (CET)
Delivery-Date: Fri, 04 Nov 2005 06:45:40 +0100
Received: from pop.1und1.de [212.227.15.162]
	by localhost with POP3 (fetchmail-5.9.0)
	for XXX (multi-drop); Fri, 04 Nov 2005 06:50:05 +0100 (CET)
Received: from [62.27.46.11] (helo=mailagent.jobpilot.de)
	by mx.kundenserver.de (node=mxeu8) with ESMTP (Nemesis),
	id 0MKt1w-1EXuOR3vX0-0000lO for XXX; Fri, 04 Nov 2005 06:45:39 +0100
From: jobpilot <XXX>
Subject: 
=?iso-8859-1?q?Karriere-Journal:=20Eingewaehlt=20und=20abgezockt?=
Errors-To: XXX
To: XXX
Reply-To: jobpilot <XXX>
X-Template-ID: 329
X-Server-ID: 1
X-Language-ID: 2
X-Templatetype: newsletter
MIME-Version: 1.0


What really bugs me are the scores for ALL_TRUSTED and 
SUBJECT_EXCESS_QP.
my local.cf contains this:
trusted_networks 192.168/16 127/8
internal_networks 192.168/16 127/8

and the question marks in the subject are because of the encoding...

Any hints?


bye,
	MH

-- 
gpg key fingerprint: 5F64 4C92 9B77 DE37 D184  C5F9 B013 44E7 27BD 
763C

Re: Why did this mail get any score at all?

[Matt Kettler <mk...@comcast.net>]

At 01:23 AM 11/4/2005, Mathias Homann wrote:
>Hi,
>
>
>here's the headers of a mail that got scored (ok, not very high but it
>should get no score at all):

<snip>


>What really bugs me are the scores for ALL_TRUSTED and
>SUBJECT_EXCESS_QP.

Why does the score for ALL_TRUSTED bug you here? that's a NEGATIVE scoring 
rule.


As for  SUBJECT_EXCESS_QP, that rule is disabled by default in SA 3.1.0.. 
so perhaps you should ask yourself why you turned it on by forcing a 
nonzero score.

 From SA 3.1.0's 50_scores.cf:

score SUBJECT_EXCESS_QP 0

(A score of 0 completely disables a rule)