Re: I need help with false spam (ham flagged as spam)

[Paolo Cravero as2594 <pc...@as2594.net>]

Liviu Lalescu wrote:


> Spamassassin is reporting it as spam, with a score of 5.6, but it is surely 
> not spam. I have also used a "sa-learn --ham" on it, but even after that the 
> message is still flagged as spam. I have done "sa-learn --ham timetabling" 
> and after that "spamassassin -t < timetabling >timetabling.out", obtaining 
> also a 5.6 score.

> I can mention that I have used learning (sa-learn) for about 8000 ham messages 
> and for 14 spam messages.

Thus Bayesian does not kick in: obvious since no BAYES_* test gets reported.

Anyway, SpamAssassin is NOT guilty at all in this false positive.

>  pts rule name              description
> ---- ---------------------- --------------------------------------------------
> -0.0 SPF_HELO_PASS          SPF: HELO matches SPF record
>  0.9 MSGID_FROM_MTA_ID      Message-Id for external message added locally
> -0.0 SPF_PASS               SPF: sender matches SPF record
>  1.9 DATE_IN_FUTURE_96_XX   Date: is 96 hours or more after Received: date

Your correspondant sent a message dated 19 *JANUARY* *2006*. This alone 
would let the message through.


>  0.5 DNS_FROM_RFC_ABUSE     RBL: Envelope sender in abuse.rfc-ignorant.org
>  0.9 DNS_FROM_RFC_WHOIS     RBL: Envelope sender in whois.rfc-ignorant.org
>  1.4 DNS_FROM_RFC_POST      RBL: Envelope sender in
>                             postmaster.rfc-ignorant.org

Paulo's provider has been listed in rfc-ignorant.org lists. Go to those 
websites to understand why.

Then, take some time to finish your Bayesian engine training and feed 
it/him/her some good ol' spam, so that is starts working.

Last but not least, add Paulo in whitelisted senders.

Paolo

Re: I need help with false spam (ham flagged as spam)

[Liviu Lalescu <li...@lalescu.ro>]

Thank you very much for your quick response! I will tell the person to fix his 
date problem.


On Monday 19 December 2005 14:39, Paolo Cravero as2594 wrote:
> Liviu Lalescu wrote:
> > Spamassassin is reporting it as spam, with a score of 5.6, but it is
> > surely not spam. I have also used a "sa-learn --ham" on it, but even
> > after that the message is still flagged as spam. I have done "sa-learn
> > --ham timetabling" and after that "spamassassin -t < timetabling
> > >timetabling.out", obtaining also a 5.6 score.
> >
> > I can mention that I have used learning (sa-learn) for about 8000 ham
> > messages and for 14 spam messages.
>
> Thus Bayesian does not kick in: obvious since no BAYES_* test gets
> reported.
>
> Anyway, SpamAssassin is NOT guilty at all in this false positive.
>
> >  pts rule name              description
> > ---- ----------------------
> > -------------------------------------------------- -0.0 SPF_HELO_PASS    
> >      SPF: HELO matches SPF record
> >  0.9 MSGID_FROM_MTA_ID      Message-Id for external message added locally
> > -0.0 SPF_PASS               SPF: sender matches SPF record
> >  1.9 DATE_IN_FUTURE_96_XX   Date: is 96 hours or more after Received:
> > date
>
> Your correspondant sent a message dated 19 *JANUARY* *2006*. This alone
> would let the message through.
>
> >  0.5 DNS_FROM_RFC_ABUSE     RBL: Envelope sender in
> > abuse.rfc-ignorant.org 0.9 DNS_FROM_RFC_WHOIS     RBL: Envelope sender in
> > whois.rfc-ignorant.org 1.4 DNS_FROM_RFC_POST      RBL: Envelope sender in
> >                             postmaster.rfc-ignorant.org
>
> Paulo's provider has been listed in rfc-ignorant.org lists. Go to those
> websites to understand why.
>
> Then, take some time to finish your Bayesian engine training and feed
> it/him/her some good ol' spam, so that is starts working.
>
> Last but not least, add Paulo in whitelisted senders.
>
> Paolo