Problematic Results of Mailspike Rules RCVD_IN_MSPIKE_Lx

[Lutz Petersen <lp...@shlink.de>]

We today received multiple requests from customers why legitimate Mails
are suddenly marked as Spam. After checking individual Mails the reason
where all the same:

Mailspike is blocking the IP 81.169.146.176 (= mo-p04-ob.rzone.de), a
heavy used Mailserver in Germany. This host is listed in dnswl.org and
in our whitelist too - if using these whitelists no Mail would be blocked
by the Mailspike Blacklist Entry.

But: All Mails that comes in from this IP in SpamAssassing get a score
of 4.0 because in SA the Score of RCVD_IN_MSPIKE_L4 gives such a high
negative score - that is Nonsense in my Opinion.

We just decided to locally reduce these MSPIKE_Lx SA Scores to zero.
Why are the Mailspike Rules scored so much more than the similar Spamcop
Rule RCVD_IN_BL_SPAMCOP_NET ?

Re: Problematic Results of Mailspike Rules RCVD_IN_MSPIKE_Lx

["Kevin A. McGrail" <KM...@PCCC.com>]

On 12/6/2013 1:15 PM, Lutz Petersen wrote:
>
> Kevin, it's simple, I just counted the mails:
>
>
> Receiving (this day) 120 Mails from this IP (they have more, only one
> is listed at Mailspike), maybe 1-2 from them are Spam, the others not.
>
> Giving all of them (equal if spam or not) a negative Score simply is
> marking a lot of Ham as Spam.

Not all rules can be perfect.  It's a question of the overall score of 
the email.  What threshold are you using?

Re: Problematic Results of Mailspike Rules RCVD_IN_MSPIKE_Lx

["Kevin A. McGrail" <KM...@PCCC.com>]

On 12/6/2013 12:01 PM, Lutz Petersen wrote:
> We just decided to locally reduce these MSPIKE_Lx SA Scores to zero.
> Why are the Mailspike Rules scored so much more than the similar Spamcop
> Rule RCVD_IN_BL_SPAMCOP_NET ?
Because based on testing, we've found the scores to be appropriate but 
sometimes our corpora isn't all encompassing enough.  I'm not sure we 
compared the scoring to SpamCop.

However, if you trust dnswl.org and your own whitelist, why aren't you 
scoring them high enough to offset the MAILSPIKE Scores?

What score did you get for

RCVD_IN_MSPIKE_L4

Depending on your update, it's floating between 2 and 4 which might be a bit high.

I think it's supposed to be statically set from 20_mailspike.cf but perhaps the auto rule system is ignoring it because of the version if loop on the scoring?

Can someone take a look at this?

Regards,
KAM

Re: Problematic Results of Mailspike Rules RCVD_IN_MSPIKE_Lx

[Benny Pedersen <me...@junc.eu>]

Lutz Petersen skrev den 2013-12-06 18:01:

> We just decided to locally reduce these MSPIKE_Lx SA Scores to zero.
> Why are the Mailspike Rules scored so much more than the similar 
> Spamcop
> Rule RCVD_IN_BL_SPAMCOP_NET ?

http://mailspike.org/usage.html

L4 = Very bad reputation

so spamassassin is unfair ?

only one spammer is needed to make it worse for all users, and only the 
mailhost can change the repution for there ip

thats also why i try to keep away from ip blacklists, but use domain 
blacklist, if owners does not resolve the spamming from there domain