You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Tao Lin <li...@gmail.com> on 2006/07/27 06:16:05 UTC
SpamAssassin 3.0.3 and MIME_BOUND_RKFINDY
Hi,
I am using SpamAssassin 3.0.3 with Exim 3.35 under Debian woody. When
I send a test html email to my own mail server, SpamAssassin treat it
as a spam. Here is the message header:
======================================================
Content-Type: multipart/alternative;
boundary="=_NextPart_2rfkindysadvnqw3nerasdf"
MIME-Version: 1.0
Date: Thu, 27 Jul 2006 14:20:41 +1200
X-Priority: 3
Message-Id: <E1...@host>
X-Scanner: exiscan *1G5wBd-0004dy-00*ZEI0kL0Ak92*hello.com
X-Scanner: exiscan *1G5vbP-00069Q-00*OL.qBOjzrMw*hello.com
X-Spam-Prev-Subject: Course Progress Report For OS1
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.3 (2005-04-27) on metis
X-Spam-Level: **
X-Spam-Status: Yes, score=2.4 required=2.0 tests=BAYES_00,HTML_80_90,
HTML_MESSAGE,MIME_BOUND_NEXTPART,MIME_BOUND_RKFINDY,MIME_HTML_MOSTLY,
MPART_ALT_DIFF,NO_REAL_NAME,PRIORITY_NO_NAME autolearn=no
version=3.0.3
X-Spam-Report:
* 2.7 MIME_BOUND_RKFINDY Spam tool pattern in MIME boundary (rfkindy)
* 0.0 NO_REAL_NAME From: does not include a real name
* 0.1 HTML_80_90 BODY: Message is 80% to 90% HTML
* 1.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 0.1 MPART_ALT_DIFF BODY: HTML and text parts are different
* -2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
* [score: 0.0000]
* 0.0 MIME_BOUND_NEXTPART Spam tool pattern in MIME boundary
* 1.1 PRIORITY_NO_NAME Message has priority, but no X-Mailer/User-Agent
======================================================
I don't why my email score so high on MIME_BOUND_RKFINDY, and what it
mean. How can I make my html email get through the SpamAssassin?
Cheers,
--
Tao Lin
Re: SpamAssassin 3.0.3 and MIME_BOUND_RKFINDY
Posted by jdow <jd...@earthlink.net>.
From: "Theo Van Dinter" <fe...@apache.org>
> FWIW, BAYES_50 actually has a tiny tiny non-zero score so it'll show up as a
> rule hit. Otherwise, people went crazy not understanding why there were no
> BAYES_* hits.
Gee, I can take out my BAYES_50 tweak.
{^_-}
Re: SpamAssassin 3.0.3 and MIME_BOUND_RKFINDY
Posted by Theo Van Dinter <fe...@apache.org>.
On Fri, Jul 28, 2006 at 10:21:11AM -0700, Ninja Dude wrote:
> In other words, Bayes looks at it, says, "I have no idea whether this is
> spam-like or not." So 0 is the appropriate score for BAYES_50.
FWIW, BAYES_50 actually has a tiny tiny non-zero score so it'll show up as a
rule hit. Otherwise, people went crazy not understanding why there were no
BAYES_* hits.
--
Randomly Generated Tagline:
"... before engaging in a battle of wits, one must ensure that one's opponent
is armed." - Jamie Zawinkski
Re: SpamAssassin 3.0.3 and MIME_BOUND_RKFINDY
Posted by Ninja Dude <ni...@speed.net>.
Golden, James wrote:
> I have several SPAM messages that are trigerring
> Bayes_50 but are getting a score of 0.00.
BAYES_50 means Bayes thinks the message has a 50% chance of being spam.
Which is the same as a 50% chance of being ham.
In other words, Bayes looks at it, says, "I have no idea whether this is
spam-like or not." So 0 is the appropriate score for BAYES_50.
Re: SpamAssassin 3.0.3 and MIME_BOUND_RKFINDY
Posted by jdow <jd...@earthlink.net>.
Visit the wiki for information on changing scores and how the four score
numbers are used. http://wiki.apache.org/spamassassin/
You can learn about the specific BAYES_ scores in this file:
/usr/share/spamassassin/50_scores.cf
Do not change the scores there.
The four scores listed are used under these conditions in left to right
order: no network rules and no bayes, network rules but no bayes,
bayes but no network rules, and both network rules and Bayes active.
For Bayes scores you usually want to tweak the final rule since you
DO run network tests, don't you? {^_-} Hit the "SCORING OPTIONS"
paragraphs in "man Mail::SpamAssassin::Conf" for more details.
You might change this in user_prefs if you are not using site wide
rules and scores or you might change them in "local.cf", usually
as /etc/mail/spamassassin/local.cf although ymmv. The lines might
look like:
score BAYES_50 0 0 1.567 0.001
score BAYES_99 0 0 5.001 5.001
Oh yeah - I very slightly tweaked BAYES_50 so that hits on it show
in the scores. That way I know for sure it is running. Silly me. But
mommies like to keep tabs on their children's activities. {^_-}
Now, I set the score all the way up over 5 ever so slightly in
increments. I kept increasing it until I got over 5 or started
getting hams marked as spams WITH BAYES_99 involved in the markup.
With my particular setup I have not had on my account, at least,
(can't speak for Loren here "fer shure") a BAYES_99 on anything but
genuine spam. So it climbed up there. (If Loren gets some BAYES_99
spams he can reduce the BAYES_99 spam score slightly in his user
prefs. {^_-})
{^_^}
----- Original Message -----
From: "Golden, James" <jg...@ci.grand-rapids.mi.us>
> Excuse my ignorance, but I have seen mention of raising scores for
> Bayes_99, Bayes_95, and I have several SPAM messages that are trigerring
> Bayes_50 but are getting a score of 0.00. What are the differences
> between these and how do I go about raising the scores? I can't seem to
> find any documentation, so if you can point me at some I would greatly
> appreciate it!
>
> Thanks,
>
> James
>
>
> On Thu, 2006-07-27 at 20:12 -0700, jdow wrote:
>
>> Tao, make sure your Bayes tests are working correctly. Then raise the
>> score for BAYES_99 almost to 5, if it is not hitting more than one
>> item ultimately scored as ham per day, and slightly boost the BAYES_95
>> score. With that and a nice juicy selection of SARE rules 5 is a rather
>> nice number to work with. Those two changes are what has caused 5.0
>> to be such a good choice here. Very VERY little ham reaches 5.0. And
>> most spam is above 6.5 or 7 with about one or two in 100 under 6.5.
>>
>> Without the well trained Bayes I don't think I'd be doing near as well
>> as I am at the moment.
>>
>> (The other trick involves a small set of meta rules that fires if I
>> have a mailing list that is "open" and gets some spam flowing through
>> it. This amplifies the difference from the BAYES_50 score for most of
>> the other BAYES_xxx scores. This one change killed off most of the
>> errors I was getting from things like the FreeBSD, LKML, and other
>> such mailing lists. I should write it up and share it through SARE
>> pretty soon. I am pretty happy with it right now, although it is
>> awkward to maintain. It may need a plugin to snarf up the list of
>> list identifier tests that should be used at a given site.)
>>
>> {^_^}
>> ----- Original Message -----
>> From: "Tao Lin" <li...@gmail.com>
>>
>>
>> > Hi, John
>> >
>> > Now I understand what MIME_BOUND_RKFINDY mean. It means my email is
>> > generated by Indy component. And I have some misuse of the Indy component
>> > that it gen the html email is not so clean. Once I fix it, my email score
>> > from 2.4 downto 0.5!
>> >
>> > And I think I will keep my cutoff score as 2 because I get so many spam
>> > every day and some of them just score 2.3!
>> >
>> > Cheers,
>> >
>> > Tao
>> >
>> > On 7/27/06, John Andersen <js...@pen.homeip.net> wrote:
>> >>
>> >> On Wednesday 26 July 2006 20:16, Tao Lin wrote:
>> >> > Hi,
>> >> >
>> >> > I am using SpamAssassin 3.0.3 with Exim 3.35 under Debian woody. When
>> >> > I send a test html email to my own mail server, SpamAssassin treat it
>> >> > as a spam. Here is the message header:
>> >>
>> >> > version=3.0.3
>> >> > X-Spam-Report:
>> >> > * 2.7 MIME_BOUND_RKFINDY Spam tool pattern in MIME boundary (rfkindy)
>> >>
>> >> > ======================================================
>> >> >
>> >> > I don't why my email score so high on MIME_BOUND_RKFINDY, and what it
>> >> > mean. How can I make my html email get through the SpamAssassin?
>> >> >
>> >> > Cheers,
>> >>
>> >> You can find out what the tests are here:
>> >> http://spamassassin.apache.org/tests_3_1_x.html
>> >>
>> >> Your cutoff is pretty low:
>> >> >X-Spam-Status: Yes, score=2.4 required=2.0
>> >>
>> >> Your cutoff is less than half the recommended 5.0. You will be
>> >> rejecting a lot of valid mail (as you have seen).
>> >>
>> >>
>> >>
>> >> --
>> >> _____________________________________
>> >> John Andersen
>> >>
>> >>
>> >>
>> >
>> >
>> > --
>> > Tao Lin
>> >
>
Re: SpamAssassin 3.0.3 and MIME_BOUND_RKFINDY
Posted by "Golden, James" <jg...@ci.grand-rapids.mi.us>.
Excuse my ignorance, but I have seen mention of raising scores for
Bayes_99, Bayes_95, and I have several SPAM messages that are trigerring
Bayes_50 but are getting a score of 0.00. What are the differences
between these and how do I go about raising the scores? I can't seem to
find any documentation, so if you can point me at some I would greatly
appreciate it!
Thanks,
James
On Thu, 2006-07-27 at 20:12 -0700, jdow wrote:
> Tao, make sure your Bayes tests are working correctly. Then raise the
> score for BAYES_99 almost to 5, if it is not hitting more than one
> item ultimately scored as ham per day, and slightly boost the BAYES_95
> score. With that and a nice juicy selection of SARE rules 5 is a rather
> nice number to work with. Those two changes are what has caused 5.0
> to be such a good choice here. Very VERY little ham reaches 5.0. And
> most spam is above 6.5 or 7 with about one or two in 100 under 6.5.
>
> Without the well trained Bayes I don't think I'd be doing near as well
> as I am at the moment.
>
> (The other trick involves a small set of meta rules that fires if I
> have a mailing list that is "open" and gets some spam flowing through
> it. This amplifies the difference from the BAYES_50 score for most of
> the other BAYES_xxx scores. This one change killed off most of the
> errors I was getting from things like the FreeBSD, LKML, and other
> such mailing lists. I should write it up and share it through SARE
> pretty soon. I am pretty happy with it right now, although it is
> awkward to maintain. It may need a plugin to snarf up the list of
> list identifier tests that should be used at a given site.)
>
> {^_^}
> ----- Original Message -----
> From: "Tao Lin" <li...@gmail.com>
>
>
> > Hi, John
> >
> > Now I understand what MIME_BOUND_RKFINDY mean. It means my email is
> > generated by Indy component. And I have some misuse of the Indy component
> > that it gen the html email is not so clean. Once I fix it, my email score
> > from 2.4 downto 0.5!
> >
> > And I think I will keep my cutoff score as 2 because I get so many spam
> > every day and some of them just score 2.3!
> >
> > Cheers,
> >
> > Tao
> >
> > On 7/27/06, John Andersen <js...@pen.homeip.net> wrote:
> >>
> >> On Wednesday 26 July 2006 20:16, Tao Lin wrote:
> >> > Hi,
> >> >
> >> > I am using SpamAssassin 3.0.3 with Exim 3.35 under Debian woody. When
> >> > I send a test html email to my own mail server, SpamAssassin treat it
> >> > as a spam. Here is the message header:
> >>
> >> > version=3.0.3
> >> > X-Spam-Report:
> >> > * 2.7 MIME_BOUND_RKFINDY Spam tool pattern in MIME boundary (rfkindy)
> >>
> >> > ======================================================
> >> >
> >> > I don't why my email score so high on MIME_BOUND_RKFINDY, and what it
> >> > mean. How can I make my html email get through the SpamAssassin?
> >> >
> >> > Cheers,
> >>
> >> You can find out what the tests are here:
> >> http://spamassassin.apache.org/tests_3_1_x.html
> >>
> >> Your cutoff is pretty low:
> >> >X-Spam-Status: Yes, score=2.4 required=2.0
> >>
> >> Your cutoff is less than half the recommended 5.0. You will be
> >> rejecting a lot of valid mail (as you have seen).
> >>
> >>
> >>
> >> --
> >> _____________________________________
> >> John Andersen
> >>
> >>
> >>
> >
> >
> > --
> > Tao Lin
> >
Re: SpamAssassin 3.0.3 and MIME_BOUND_RKFINDY
Posted by jdow <jd...@earthlink.net>.
Tao, make sure your Bayes tests are working correctly. Then raise the
score for BAYES_99 almost to 5, if it is not hitting more than one
item ultimately scored as ham per day, and slightly boost the BAYES_95
score. With that and a nice juicy selection of SARE rules 5 is a rather
nice number to work with. Those two changes are what has caused 5.0
to be such a good choice here. Very VERY little ham reaches 5.0. And
most spam is above 6.5 or 7 with about one or two in 100 under 6.5.
Without the well trained Bayes I don't think I'd be doing near as well
as I am at the moment.
(The other trick involves a small set of meta rules that fires if I
have a mailing list that is "open" and gets some spam flowing through
it. This amplifies the difference from the BAYES_50 score for most of
the other BAYES_xxx scores. This one change killed off most of the
errors I was getting from things like the FreeBSD, LKML, and other
such mailing lists. I should write it up and share it through SARE
pretty soon. I am pretty happy with it right now, although it is
awkward to maintain. It may need a plugin to snarf up the list of
list identifier tests that should be used at a given site.)
{^_^}
----- Original Message -----
From: "Tao Lin" <li...@gmail.com>
> Hi, John
>
> Now I understand what MIME_BOUND_RKFINDY mean. It means my email is
> generated by Indy component. And I have some misuse of the Indy component
> that it gen the html email is not so clean. Once I fix it, my email score
> from 2.4 downto 0.5!
>
> And I think I will keep my cutoff score as 2 because I get so many spam
> every day and some of them just score 2.3!
>
> Cheers,
>
> Tao
>
> On 7/27/06, John Andersen <js...@pen.homeip.net> wrote:
>>
>> On Wednesday 26 July 2006 20:16, Tao Lin wrote:
>> > Hi,
>> >
>> > I am using SpamAssassin 3.0.3 with Exim 3.35 under Debian woody. When
>> > I send a test html email to my own mail server, SpamAssassin treat it
>> > as a spam. Here is the message header:
>>
>> > version=3.0.3
>> > X-Spam-Report:
>> > * 2.7 MIME_BOUND_RKFINDY Spam tool pattern in MIME boundary (rfkindy)
>>
>> > ======================================================
>> >
>> > I don't why my email score so high on MIME_BOUND_RKFINDY, and what it
>> > mean. How can I make my html email get through the SpamAssassin?
>> >
>> > Cheers,
>>
>> You can find out what the tests are here:
>> http://spamassassin.apache.org/tests_3_1_x.html
>>
>> Your cutoff is pretty low:
>> >X-Spam-Status: Yes, score=2.4 required=2.0
>>
>> Your cutoff is less than half the recommended 5.0. You will be
>> rejecting a lot of valid mail (as you have seen).
>>
>>
>>
>> --
>> _____________________________________
>> John Andersen
>>
>>
>>
>
>
> --
> Tao Lin
>
Re: SpamAssassin 3.0.3 and MIME_BOUND_RKFINDY
Posted by Vincent Li <vi...@gmail.com>.
On 27-Jul-06, at 7:46 PM, Tao Lin wrote:
> Hi, John
>
> Now I understand what MIME_BOUND_RKFINDY mean. It means my email is
> generated by Indy component. And I have some misuse of the Indy
> component that it gen the html email is not so clean. Once I fix it,
> my email score from 2.4 downto 0.5!
>
> And I think I will keep my cutoff score as 2 because I get so many
> spam every day and some of them just score 2.3!
>
You can train your bayes to learn the false negative email as spam, get
some SARE custom rules, enable network test.
> Cheers,
>
> Tao
>
Vincent
System Administrator
The Biomedical Research Centre
University of British Columbia
Re: SpamAssassin 3.0.3 and MIME_BOUND_RKFINDY
Posted by Tao Lin <li...@gmail.com>.
Hi, John
Now I understand what MIME_BOUND_RKFINDY mean. It means my email is
generated by Indy component. And I have some misuse of the Indy component
that it gen the html email is not so clean. Once I fix it, my email score
from 2.4 downto 0.5!
And I think I will keep my cutoff score as 2 because I get so many spam
every day and some of them just score 2.3!
Cheers,
Tao
On 7/27/06, John Andersen <js...@pen.homeip.net> wrote:
>
> On Wednesday 26 July 2006 20:16, Tao Lin wrote:
> > Hi,
> >
> > I am using SpamAssassin 3.0.3 with Exim 3.35 under Debian woody. When
> > I send a test html email to my own mail server, SpamAssassin treat it
> > as a spam. Here is the message header:
>
> > version=3.0.3
> > X-Spam-Report:
> > * 2.7 MIME_BOUND_RKFINDY Spam tool pattern in MIME boundary (rfkindy)
>
> > ======================================================
> >
> > I don't why my email score so high on MIME_BOUND_RKFINDY, and what it
> > mean. How can I make my html email get through the SpamAssassin?
> >
> > Cheers,
>
> You can find out what the tests are here:
> http://spamassassin.apache.org/tests_3_1_x.html
>
> Your cutoff is pretty low:
> >X-Spam-Status: Yes, score=2.4 required=2.0
>
> Your cutoff is less than half the recommended 5.0. You will be
> rejecting a lot of valid mail (as you have seen).
>
>
>
> --
> _____________________________________
> John Andersen
>
>
>
--
Tao Lin
Re: SpamAssassin 3.0.3 and MIME_BOUND_RKFINDY
Posted by John Andersen <js...@pen.homeip.net>.
On Wednesday 26 July 2006 20:16, Tao Lin wrote:
> Hi,
>
> I am using SpamAssassin 3.0.3 with Exim 3.35 under Debian woody. When
> I send a test html email to my own mail server, SpamAssassin treat it
> as a spam. Here is the message header:
> version=3.0.3
> X-Spam-Report:
> * 2.7 MIME_BOUND_RKFINDY Spam tool pattern in MIME boundary (rfkindy)
> ======================================================
>
> I don't why my email score so high on MIME_BOUND_RKFINDY, and what it
> mean. How can I make my html email get through the SpamAssassin?
>
> Cheers,
You can find out what the tests are here:
http://spamassassin.apache.org/tests_3_1_x.html
Your cutoff is pretty low:
>X-Spam-Status: Yes, score=2.4 required=2.0
Your cutoff is less than half the recommended 5.0. You will be
rejecting a lot of valid mail (as you have seen).
--
_____________________________________
John Andersen