You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Thijs Koetsier | Exception IT <th...@exception.nl> on 2005/09/27 20:32:55 UTC
Whitelisted, but marked as spam
Hi all,
I'm having messages marked as spam, for users who are in my whitelist.
In /etc/mail/spamassasin/whitelist.cf are these lines (among others):
all_spam_to *@foo.com
whitelist_to *@foo.com
whitelist_to user1@foo.com
Whitelist_from *@foo.com
(it is this thourough because I didn't get this to work)
However, the user is still getting messages marked as spam, as is show in
the header below.
As you can see, the subject is rewritten with {Spam}, the spam status is
5.4, but below that also is marked as being in the all_spam, whitelist_from
and whitelist_to.
Return-path: <us...@foo.com>
Envelope-to: user1@zoltar.exception.nl
Delivery-date: Tue, 27 Sep 2005 19:17:11 +0200
Received: from Debian-exim by zoltar.exception.nl with spam-scanned (Exim
4.52)
id 1EKJ4o-0001TP-Rn
for user1@zoltar.exception.nl; Tue, 27 Sep 2005 19:17:11 +0200
Received: from localhost by zoltar.exception.nl
with SpamAssassin (version 3.0.4);
Tue, 27 Sep 2005 19:17:11 +0200
From: "User1" <us...@foo.com>
To: "User1" <us...@foo.com>
Subject: {Spam} <ANB5Mail> Maillog 27-09-2005
Date: Tue, 27 Sep 2005 19:17:07 +0200
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on
zoltar.exception.nl
X-Spam-Level: *****
X-Spam-Status: Yes, score=5.4 required=5.0 tests=AWL,BAYES_00,HTML_60_70,
HTML_BADTAG_00_10,HTML_MESSAGE,HTML_NONELEMENT_00_10,
HTML_TAG_EXIST_MARQUEE,HTML_TAG_EXIST_TBODY,MIME_BOUND_NEXTPART,
MIME_BOUND_RKFINDY,MIME_HTML_MOSTLY,MPART_ALT_DIFF,
USER_IN_ALL_SPAM_TO,USER_IN_WHITELIST,USER_IN_WHITELIST_TO,X_LIBRARY
autolearn=no version=3.0.4
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_43397E97.410A444D"
Message-Id: <E1...@zoltar.exception.nl>
If anyone can enlighten this for me, it would be greatly appreciated!
Cheers,
Thijs
Re: Whitelisted, but marked as spam
Posted by Fred <sp...@freddyt.com>.
Thijs Koetsier | Exception IT wrote:
> X-Spam-Status: Yes, score=5.4 required=5.0
> tests=AWL,BAYES_00,HTML_60_70,
> HTML_BADTAG_00_10,HTML_MESSAGE,HTML_NONELEMENT_00_10,
> HTML_TAG_EXIST_MARQUEE,HTML_TAG_EXIST_TBODY,MIME_BOUND_NEXTPART,
> MIME_BOUND_RKFINDY,MIME_HTML_MOSTLY,MPART_ALT_DIFF,
> USER_IN_ALL_SPAM_TO,USER_IN_WHITELIST,USER_IN_WHITELIST_TO,X_LIBRARY
Since you have AWL in there, I would check to see what AWL is scoring this
message.
RE: 50_scores.cf warnings (was: Whitelisted, but marked as spam)
Posted by Thijs Koetsier | Exception IT <th...@exception.nl>.
As a matter of fact I _really_ deleted the file a few days ago, so I just
downloaded the spamassassin .zip again and uploaded the extracted
50_scores.cf to my server.
-----Oorspronkelijk bericht-----
Van: Fred [mailto:spamassassin@freddyt.com]
Verzonden: dinsdag 27 september 2005 21:12
Aan: thijs.koetsier@exception.nl; users@spamassassin.apache.org
Onderwerp: Re: 50_scores.cf warnings (was: Whitelisted, but marked as spam)
Thijs Koetsier | Exception IT wrote:
> So, now that I've replaced by 50_scores.cf (thanks Fred), I'm getting
> the 150 warnings back. They're all of the type:
Redownload the spamassassin package and extract that file again. It sounds
like you have an older version of that file.
Re: 50_scores.cf warnings (was: Whitelisted, but marked as spam)
Posted by Fred <sp...@freddyt.com>.
Thijs Koetsier | Exception IT wrote:
> So, now that I've replaced by 50_scores.cf (thanks Fred), I'm getting
> the 150 warnings back. They're all of the type:
Redownload the spamassassin package and extract that file again. It sounds
like you have an older version of that file.
50_scores.cf warnings (was: Whitelisted, but marked as spam)
Posted by Thijs Koetsier | Exception IT <th...@exception.nl>.
So, now that I've replaced by 50_scores.cf (thanks Fred), I'm getting the
150 warnings back. They're all of the type:
warning: score set for non-existent rule ADVANCE_FEE_4
and correlate to the scoring rules in the 50_scores.cf file, such as
score ADVANCE_FEE_4 3.024 3.040 3.515 3.727
Should I remove the 150 lines these warnings originate from, or is there
something else wrong do you think?
Cheers,
Thijs
-----Oorspronkelijk bericht-----
Van: Fred [mailto:spamassassin@freddyt.com]
Verzonden: dinsdag 27 september 2005 21:02
Aan: Bret Miller; users@spamassassin.apache.org
Onderwerp: Re: Whitelisted, but marked as spam
Bret Miller wrote:
> You would think that whitelist should be given a lower number than
> -1.0. Otherwise, how does it counteract the many other rule additons.
>
> How about adding:
> score USER_IN_WHITELIST -20
> score USER_IN_WHITELIST_TO -20
> to your local.cf so that it does actually "whitelist".
>
> Bret
>
Normally it would but the 50_scores.cf where this score is defined was
removed.
Re: Whitelisted, but marked as spam
Posted by Fred <sp...@freddyt.com>.
Bret Miller wrote:
> You would think that whitelist should be given a lower number than
> -1.0. Otherwise, how does it counteract the many other rule additons.
>
> How about adding:
> score USER_IN_WHITELIST -20
> score USER_IN_WHITELIST_TO -20
> to your local.cf so that it does actually "whitelist".
>
> Bret
>
Normally it would but the 50_scores.cf where this score is defined was
removed.
RE: Whitelisted, but marked as spam
Posted by Bret Miller <br...@wcg.org>.
You would think that whitelist should be given a lower number than -1.0.
Otherwise, how does it counteract the many other rule additons.
How about adding:
score USER_IN_WHITELIST -20
score USER_IN_WHITELIST_TO -20
to your local.cf so that it does actually "whitelist".
Bret
> -----Original Message-----
> From: Thijs Koetsier | Exception IT
> [mailto:thijs.koetsier@exception.nl]
> Sent: Tuesday, September 27, 2005 11:44 AM
> To: users@spamassassin.apache.org
> Subject: RE: Whitelisted, but marked as spam
>
> In addition to my mail just send;
>
> This is the e-mail recieved by the user. Shouldn't
> "user_in_whitelist" to
> score -100 and "user_in_all_spam_to" be also at least more than -1.0?
>
> Spam detection software, running on the system
> "zoltar.exception.nl", has
> identified this incoming email as possible spam. The
> original message has
> been attached to this so you can view it (if it isn't spam)
> or label similar
> future email. If you have any questions, see the
> administrator of that
> system for details.
>
> Content preview: ASCI Technologies maillog 27-09-2005 ASCI
> Technologies
> Filialen in -Assen -Emmen -Enschede -Groningen -Tilburg -en
> Winschoten
> [...]
>
> Content analysis details: (5.4 points, 5.0 required)
>
> pts rule name description
> ---- ----------------------
> --------------------------------------------------
> 1.0 MIME_BOUND_RKFINDY Spam tool pattern in MIME
> boundary (rfkindy)
> 1.0 X_LIBRARY Message has X-Library header
> -1.0 USER_IN_WHITELIST From: address is in the user's white-list
> -1.0 USER_IN_WHITELIST_TO User is listed in 'whitelist_to'
> -1.0 USER_IN_ALL_SPAM_TO User is listed in 'all_spam_to'
> 1.0 HTML_60_70 BODY: Message is 60% to 70% HTML
> 1.0 HTML_BADTAG_00_10 BODY: HTML message is 0% to 10% bad tags
> 1.0 HTML_TAG_EXIST_TBODY BODY: HTML has "tbody" tag
> -1.0 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
> [score: 0.0000] 1.0
> HTML_TAG_EXIST_MARQUEE
> BODY: HTML has "marquee" tag
> 1.0 MIME_HTML_MOSTLY BODY: Multipart message mostly
> text/html MIME
> 1.0 HTML_MESSAGE BODY: HTML included in message
> 1.0 MPART_ALT_DIFF BODY: HTML and text parts are different
> 1.0 HTML_NONELEMENT_00_10 BODY: 0% to 10% of HTML elements are
> non-standard
> 1.0 MIME_BOUND_NEXTPART Spam tool pattern in MIME boundary
> -1.6 AWL AWL: From: address is in the auto
> white-list
>
> The original message was not completely plain text, and may
> be unsafe to
> open with some email clients; in particular, it may contain a
> virus, or
> confirm that your address can receive spam. If you wish to
> view it, it may
> be safer to save it to a file and open it with an editor.
>
> Cheers,
> Thijs
>
>
> -----Oorspronkelijk bericht-----
> Van: Thijs Koetsier | Exception IT
> [mailto:thijs.koetsier@exception.nl]
> Verzonden: dinsdag 27 september 2005 20:33
> Aan: users@spamassassin.apache.org
> Onderwerp: Whitelisted, but marked as spam
>
> Hi all,
>
> I'm having messages marked as spam, for users who are in my whitelist.
>
> In /etc/mail/spamassasin/whitelist.cf are these lines (among others):
> all_spam_to *@foo.com
> whitelist_to *@foo.com
> whitelist_to user1@foo.com
> Whitelist_from *@foo.com
> (it is this thourough because I didn't get this to work)
>
> However, the user is still getting messages marked as spam,
> as is show in
> the header below.
> As you can see, the subject is rewritten with {Spam}, the
> spam status is
> 5.4, but below that also is marked as being in the all_spam,
> whitelist_from
> and whitelist_to.
>
> Return-path: <us...@foo.com>
> Envelope-to: user1@zoltar.exception.nl
> Delivery-date: Tue, 27 Sep 2005 19:17:11 +0200
> Received: from Debian-exim by zoltar.exception.nl with
> spam-scanned (Exim
> 4.52)
> id 1EKJ4o-0001TP-Rn
> for user1@zoltar.exception.nl; Tue, 27 Sep 2005 19:17:11 +0200
> Received: from localhost by zoltar.exception.nl
> with SpamAssassin (version 3.0.4);
> Tue, 27 Sep 2005 19:17:11 +0200
> From: "User1" <us...@foo.com>
> To: "User1" <us...@foo.com>
> Subject: {Spam} <ANB5Mail> Maillog 27-09-2005
> Date: Tue, 27 Sep 2005 19:17:07 +0200
> X-Spam-Flag: YES
> X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on
> zoltar.exception.nl
> X-Spam-Level: *****
> X-Spam-Status: Yes, score=5.4 required=5.0
> tests=AWL,BAYES_00,HTML_60_70,
> HTML_BADTAG_00_10,HTML_MESSAGE,HTML_NONELEMENT_00_10,
> HTML_TAG_EXIST_MARQUEE,HTML_TAG_EXIST_TBODY,MIME_BOUND_NEXTPART,
> MIME_BOUND_RKFINDY,MIME_HTML_MOSTLY,MPART_ALT_DIFF,
>
> USER_IN_ALL_SPAM_TO,USER_IN_WHITELIST,USER_IN_WHITELIST_TO,X_LIBRARY
>
> autolearn=no version=3.0.4
> MIME-Version: 1.0
> Content-Type: multipart/mixed;
> boundary="----------=_43397E97.410A444D"
> Message-Id: <E1...@zoltar.exception.nl>
>
> If anyone can enlighten this for me, it would be greatly appreciated!
>
> Cheers,
> Thijs
>
>
RE: Whitelisted, but marked as spam
Posted by Thijs Koetsier | Exception IT <th...@exception.nl>.
In addition to my mail just send;
This is the e-mail recieved by the user. Shouldn't "user_in_whitelist" to
score -100 and "user_in_all_spam_to" be also at least more than -1.0?
Spam detection software, running on the system "zoltar.exception.nl", has
identified this incoming email as possible spam. The original message has
been attached to this so you can view it (if it isn't spam) or label similar
future email. If you have any questions, see the administrator of that
system for details.
Content preview: ASCI Technologies maillog 27-09-2005 ASCI Technologies
Filialen in -Assen -Emmen -Enschede -Groningen -Tilburg -en Winschoten
[...]
Content analysis details: (5.4 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
1.0 MIME_BOUND_RKFINDY Spam tool pattern in MIME boundary (rfkindy)
1.0 X_LIBRARY Message has X-Library header
-1.0 USER_IN_WHITELIST From: address is in the user's white-list
-1.0 USER_IN_WHITELIST_TO User is listed in 'whitelist_to'
-1.0 USER_IN_ALL_SPAM_TO User is listed in 'all_spam_to'
1.0 HTML_60_70 BODY: Message is 60% to 70% HTML
1.0 HTML_BADTAG_00_10 BODY: HTML message is 0% to 10% bad tags
1.0 HTML_TAG_EXIST_TBODY BODY: HTML has "tbody" tag
-1.0 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
[score: 0.0000] 1.0 HTML_TAG_EXIST_MARQUEE
BODY: HTML has "marquee" tag
1.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
1.0 HTML_MESSAGE BODY: HTML included in message
1.0 MPART_ALT_DIFF BODY: HTML and text parts are different
1.0 HTML_NONELEMENT_00_10 BODY: 0% to 10% of HTML elements are
non-standard
1.0 MIME_BOUND_NEXTPART Spam tool pattern in MIME boundary
-1.6 AWL AWL: From: address is in the auto white-list
The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus, or
confirm that your address can receive spam. If you wish to view it, it may
be safer to save it to a file and open it with an editor.
Cheers,
Thijs
-----Oorspronkelijk bericht-----
Van: Thijs Koetsier | Exception IT [mailto:thijs.koetsier@exception.nl]
Verzonden: dinsdag 27 september 2005 20:33
Aan: users@spamassassin.apache.org
Onderwerp: Whitelisted, but marked as spam
Hi all,
I'm having messages marked as spam, for users who are in my whitelist.
In /etc/mail/spamassasin/whitelist.cf are these lines (among others):
all_spam_to *@foo.com
whitelist_to *@foo.com
whitelist_to user1@foo.com
Whitelist_from *@foo.com
(it is this thourough because I didn't get this to work)
However, the user is still getting messages marked as spam, as is show in
the header below.
As you can see, the subject is rewritten with {Spam}, the spam status is
5.4, but below that also is marked as being in the all_spam, whitelist_from
and whitelist_to.
Return-path: <us...@foo.com>
Envelope-to: user1@zoltar.exception.nl
Delivery-date: Tue, 27 Sep 2005 19:17:11 +0200
Received: from Debian-exim by zoltar.exception.nl with spam-scanned (Exim
4.52)
id 1EKJ4o-0001TP-Rn
for user1@zoltar.exception.nl; Tue, 27 Sep 2005 19:17:11 +0200
Received: from localhost by zoltar.exception.nl
with SpamAssassin (version 3.0.4);
Tue, 27 Sep 2005 19:17:11 +0200
From: "User1" <us...@foo.com>
To: "User1" <us...@foo.com>
Subject: {Spam} <ANB5Mail> Maillog 27-09-2005
Date: Tue, 27 Sep 2005 19:17:07 +0200
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on
zoltar.exception.nl
X-Spam-Level: *****
X-Spam-Status: Yes, score=5.4 required=5.0 tests=AWL,BAYES_00,HTML_60_70,
HTML_BADTAG_00_10,HTML_MESSAGE,HTML_NONELEMENT_00_10,
HTML_TAG_EXIST_MARQUEE,HTML_TAG_EXIST_TBODY,MIME_BOUND_NEXTPART,
MIME_BOUND_RKFINDY,MIME_HTML_MOSTLY,MPART_ALT_DIFF,
USER_IN_ALL_SPAM_TO,USER_IN_WHITELIST,USER_IN_WHITELIST_TO,X_LIBRARY
autolearn=no version=3.0.4
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_43397E97.410A444D"
Message-Id: <E1...@zoltar.exception.nl>
If anyone can enlighten this for me, it would be greatly appreciated!
Cheers,
Thijs