You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Screaming Eagle <te...@gmail.com> on 2006/04/11 05:00:09 UTC
Internal email marked as spam...
All,
Emailing with outlook and from internal network is marked as spam:
pts rule name description
---- ----------------------
--------------------------------------------------
-1.8 ALL_TRUSTED Passed through trusted hosts only via SMTP
1.1 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
1.0 HTML_MESSAGE BODY: HTML included in message
0.1 HTML_90_100 BODY: Message is 90% to 100% HTML
3.0 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
[score: 0.0002]
2.8 RATWARE_OUTLOOK_NONAME Bulk email fingerprint (Outlook no name)
found
1.9 RATWARE_MS_HASH Bulk email fingerprint (msgid ms hash) found
1.7 MSGID_DOLLARS Message-Id has pattern used in spam
-0.8 AWL AWL: From: address is in the auto white-list
I think the RATWARE_OUTLOOK_NOMAME, RATWARE_MS_HASH,and MSGID_DOLLARS is
skewing the score. I have only seen this score if you use MS OUTLOOK. Any
idea why and if there is work around for this? Thanks.
Re: Internal email marked as spam...
Posted by Matt Kettler <mk...@comcast.net>.
Philip Prindeville wrote:
> Daryl C. W. O'Shea wrote:
>
>
>> Screaming Eagle wrote:
>>
>>
>>
>>> All,
>>> Emailing with outlook and from internal network is marked as spam:
>>> pts rule name description
>>> ---- ----------------------
>>> --------------------------------------------------
>>> -1.8 ALL_TRUSTED Passed through trusted hosts only via SMTP
>>> 1.1 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
>>> 1.0 HTML_MESSAGE BODY: HTML included in message
>>> 0.1 HTML_90_100 BODY: Message is 90% to 100% HTML
>>> 3.0 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
>>> [score: 0.0002]
>>> 2.8 RATWARE_OUTLOOK_NONAME Bulk email fingerprint (Outlook no name)
>>> found
>>> 1.9 RATWARE_MS_HASH Bulk email fingerprint (msgid ms hash) found
>>> 1.7 MSGID_DOLLARS Message-Id has pattern used in spam
>>> -0.8 AWL AWL: From: address is in the auto white-list
>>>
>>> I think the RATWARE_OUTLOOK_NOMAME, RATWARE_MS_HASH,and MSGID_DOLLARS
>>> is skewing the score. I have only seen this score if you use MS
>>> OUTLOOK. Any idea why and if there is work around for this? Thanks.
>>>
>>>
>>>
>>
>>> 3.0 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
>>> [score: 0.0002]
>>>
>> Whoever set the score for BAYES_00 to 3.0 must have been high!
>>
>> Daryl
>>
>>
>>
>
> That's true, but you'd still be over 5.0 even without it.
>
>
No, it would not be over 5.0 if BAYES_00 hadn't been screwed with.
Because the default for BAYES_00 is a negative number, not 0.
This message adds to 8.9. Based on the scores of the other rules, this
is 3.1.x with set3.
In that set, BAYES_00 should score -2.599 instead of +3.0. That would
make the message score somewhere around 3.3 (I'm not adding all the
rules out to the thousandth, so I could be off by 0.1)
HTML_MESSAGE also should be 0.1, not 1.0.
The real score: 2.3.
While I do admit that the rules screaming eagle points out are a
problem, the shifting the scores of BAYES_00 and HTML_MESSAGE by a total
of +6.599 from its default is a bigger problem. (the 3 cited rules total
6.403 points, which is a smaller impact than the score fiddling has caused.)
Re: Internal email marked as spam...
Posted by mouss <us...@free.fr>.
jdow wrote:
>>
>> That's true, but you'd still be over 5.0 even without it.
>
> Why did you modify it? Bayes zero should typically have a fairly hefty
> negative score.
>
It seems that the art of "error and ignore" has replaced the art of
trial and error.
<humor>
Given the OP From display, we can only say: scream, eagle. scream.
</humour>
Re: Internal email marked as spam...
Posted by jdow <jd...@earthlink.net>.
From: "Philip Prindeville" <ph...@redfish-solutions.com>
> Daryl C. W. O'Shea wrote:
>
>>Screaming Eagle wrote:
>>
>>
>>>All,
>>>Emailing with outlook and from internal network is marked as spam:
>>>pts rule name description
>>>---- ----------------------
>>>--------------------------------------------------
>>>-1.8 ALL_TRUSTED Passed through trusted hosts only via SMTP
>>> 1.1 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
>>> 1.0 HTML_MESSAGE BODY: HTML included in message
>>> 0.1 HTML_90_100 BODY: Message is 90% to 100% HTML
>>> 3.0 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
>>> [score: 0.0002]
>>> 2.8 RATWARE_OUTLOOK_NONAME Bulk email fingerprint (Outlook no name)
>>> found
>>> 1.9 RATWARE_MS_HASH Bulk email fingerprint (msgid ms hash) found
>>> 1.7 MSGID_DOLLARS Message-Id has pattern used in spam
>>>-0.8 AWL AWL: From: address is in the auto white-list
>>>
>>>I think the RATWARE_OUTLOOK_NOMAME, RATWARE_MS_HASH,and MSGID_DOLLARS
>>>is skewing the score. I have only seen this score if you use MS
>>>OUTLOOK. Any idea why and if there is work around for this? Thanks.
>>>
>>>
>>
>>
>> > 3.0 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
>> > [score: 0.0002]
>>
>>Whoever set the score for BAYES_00 to 3.0 must have been high!
>>
>>Daryl
>>
>>
>
> That's true, but you'd still be over 5.0 even without it.
Why did you modify it? Bayes zero should typically have a fairly hefty
negative score.
{^_^}
Re: Internal email marked as spam...
Posted by Philip Prindeville <ph...@redfish-solutions.com>.
Daryl C. W. O'Shea wrote:
>Screaming Eagle wrote:
>
>
>>All,
>>Emailing with outlook and from internal network is marked as spam:
>>pts rule name description
>>---- ----------------------
>>--------------------------------------------------
>>-1.8 ALL_TRUSTED Passed through trusted hosts only via SMTP
>> 1.1 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
>> 1.0 HTML_MESSAGE BODY: HTML included in message
>> 0.1 HTML_90_100 BODY: Message is 90% to 100% HTML
>> 3.0 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
>> [score: 0.0002]
>> 2.8 RATWARE_OUTLOOK_NONAME Bulk email fingerprint (Outlook no name)
>> found
>> 1.9 RATWARE_MS_HASH Bulk email fingerprint (msgid ms hash) found
>> 1.7 MSGID_DOLLARS Message-Id has pattern used in spam
>>-0.8 AWL AWL: From: address is in the auto white-list
>>
>>I think the RATWARE_OUTLOOK_NOMAME, RATWARE_MS_HASH,and MSGID_DOLLARS
>>is skewing the score. I have only seen this score if you use MS
>>OUTLOOK. Any idea why and if there is work around for this? Thanks.
>>
>>
>
>
> > 3.0 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> > [score: 0.0002]
>
>Whoever set the score for BAYES_00 to 3.0 must have been high!
>
>Daryl
>
>
That's true, but you'd still be over 5.0 even without it.
-Philip
Re: Internal email marked as spam...
Posted by "Daryl C. W. O'Shea" <sp...@dostech.ca>.
Screaming Eagle wrote:
> All,
> Emailing with outlook and from internal network is marked as spam:
> pts rule name description
> ---- ----------------------
> --------------------------------------------------
> -1.8 ALL_TRUSTED Passed through trusted hosts only via SMTP
> 1.1 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
> 1.0 HTML_MESSAGE BODY: HTML included in message
> 0.1 HTML_90_100 BODY: Message is 90% to 100% HTML
> 3.0 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> [score: 0.0002]
> 2.8 RATWARE_OUTLOOK_NONAME Bulk email fingerprint (Outlook no name)
> found
> 1.9 RATWARE_MS_HASH Bulk email fingerprint (msgid ms hash) found
> 1.7 MSGID_DOLLARS Message-Id has pattern used in spam
> -0.8 AWL AWL: From: address is in the auto white-list
>
> I think the RATWARE_OUTLOOK_NOMAME, RATWARE_MS_HASH,and MSGID_DOLLARS
> is skewing the score. I have only seen this score if you use MS
> OUTLOOK. Any idea why and if there is work around for this? Thanks.
> 3.0 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> [score: 0.0002]
Whoever set the score for BAYES_00 to 3.0 must have been high!
Daryl