Message clean as a whistle, still 30.6 hits.

["me@bauchladen.at" <me...@bauchladen.at>]

Hello List,

I had several false positives like this one coming from a list and i 
don't have a clue. Can somebody, please, help me interpret this 
headers? I don't understand where the 30.6 hits come from and why 
autolearn=ham if Spamflag is YES.

X-Spam-Flag: 	YES
X-Spam-Checker-Version: 	SpamAssassin 2.63 (2004-01-11) on  
myserver.mydomain.mytld
X-Spam-Level: 	******************************
X-Spam-Status: 	Yes, hits=30.6 required=4.0 tests=AWL,BAYES_00 
autolearn=ham  version=2.63
X-Spam-Report: 	* -4.9 BAYES_00 BODY: Bayesian spam probability is 0 to 
1% *      [score: 0.0000] *   36 AWL AWL: Auto-whitelist adjustment

thanks,
michael einem

Re: Message clean as a whistle, still 30.6 hits.

[Kevin Peuhkurinen <ke...@hepcoe.com>]

AWL does auto-blacklisting as well as whitelisting and it looks like it 
is blacklisting the sender of this email to the tune of 35.5 (rounded up 
to 36 for the report) points.   The BAYES_00 then brings the total down 
to 30.6.    You may want to turn AWL off for a while until you figure 
out the problem.

me@bauchladen.at wrote:

> Hello List,
>
> I had several false positives like this one coming from a list and i 
> don't have a clue. Can somebody, please, help me interpret this 
> headers? I don't understand where the 30.6 hits come from and why 
> autolearn=ham if Spamflag is YES.
>
> X-Spam-Flag:     YES
> X-Spam-Checker-Version:     SpamAssassin 2.63 (2004-01-11) on  
> myserver.mydomain.mytld
> X-Spam-Level:     ******************************
> X-Spam-Status:     Yes, hits=30.6 required=4.0 tests=AWL,BAYES_00 
> autolearn=ham  version=2.63
> X-Spam-Report:     * -4.9 BAYES_00 BODY: Bayesian spam probability is 
> 0 to 1% *      [score: 0.0000] *   36 AWL AWL: Auto-whitelist adjustment
>
> thanks,
> michael einem
>
>

Re: Message clean as a whistle, still 30.6 hits.

[Bob George <ma...@ttlexceeded.com>]

me@bauchladen.at wrote:

>  I had several false positives like this one coming from a list and i
>  don't have a clue. Can somebody, please, help me interpret this
>  headers? I don't understand where the 30.6 hits come from and why
>  autolearn=ham if Spamflag is YES.


Spend some time using check_whitelist (i.e. check_whitelist 
~/.spamassassin/auto-whitelist) to see what's in your auto-generated 
list. This sounds very much like a problem I had last year where I 
carelessly managed to have a list mail learned as spam, only to poison 
the entire list. This can also work the other way, allowing spam through 
on a list that tends to be spammed. Perhaps somebody sent test spams to 
an otherwise legit list?

The trick was to do spamassassin 
--remove-addr-from-whitelist=<na...@domain> to remove the bogus entries. 
Auto-whitelist can be problematic when use in conjunction with 
whitelist_from and blacklist_from in your .cf files. Be particularly 
careful with mailing lists.

- Bob