A discussion on the subject that may be of interest in the SmarterMail forum.

http://forums.smartertools.com/showthread.php/38483-jump-in-spam-scores


Mike


Michael Graveen

m...@anim8.net

----------------------------------------

Return-Path: <declude.junkmail-f83d868d348149c9928eaad64e22d...@declude.com>

Received: from smtp.declude.com (smtp.declude.com [216.144.195.81]) by 
ns.pixel8.com with SMTP;

Sat, 2 Mar 2013 10:23:43 -0600

Received: from smail.globalweb.net (smail.globalweb.net [208.74.80.105]) by 
smtp.declude.com with SMTP;

Sat, 2 Mar 2013 11:22:35 -0500

Received: from HRADT (173-163-199-121-richmond.hfc.comcastbusiness.net 
[173.163.199.121]) by smail.globalweb.net with SMTP;

Sat, 2 Mar 2013 11:22:22 -0500

From: "Randy Armbrecht" <ra...@globalweb.us>

To: Declude.JunkMail@declude.com

References: 
<1044585735_52516...@declude.com><1056213922_52517...@declude.com><1070057329_52517...@declude.com><1226673407_52521...@declude.com><1245946641_52522...@declude.com>
 <1249494625_52522...@declude.com> <1251923344_52522...@declude.com> 
<-1916622906_42591...@declude.com>

In-Reply-To: <-1916622906_42591...@declude.com>

Subject: RE: [Declude.JunkMail] why have spam scores jumped?

Date: Sat, 2 Mar 2013 11:22:04 -0500

Message-ID: <-1864395546_42592...@declude.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_053A_01CE1738.2B571DA0"

X-Mailer: Microsoft Outlook 14.0

X-Vipre-Scanned: 0AC03A97003DC80AC03BE4

Thread-Index: 
AQGfnOsLrnxuRjEYIyUIZ/qhpeQALAIkewrQA4Zvh3wCcEpK0AG5X5wcAlfJDG0BMAgZkQGdxfpImHe4hjA=

Content-Language: en-us

X-GBUdb-Analysis: 0, 208.74.80.105, Ugly c=0 p=0 Source New

X-MessageSniffer-Scan-Result: 0

X-MessageSniffer-SNF-Group: OK

X-Declude-Sender: ra...@globalweb.us [208.74.80.105]

X-Declude-Spoolname: 42592729.eml

X-Declude-RefID: str=0001.0A020208.51322762.00AC,ss=1,fgs=0

X-DECLUDE: 
----------------------------------------------------------------------

X-Declude-Note: Scanned by Declude 4.12.01 "http://www.declude.com/x-note.htm";

X-Declude-Scan: Incoming Score [-3] at 11:23:01 on 02 Mar 2013 by

X-Declude-Tests: TOKENS [-5], MAILSPIKE-L2 [6], SPFPASS [-1], CT-UNKNOWN [-1], 
FILTER-SUBJECT [2], FILTER-SPAM [5], HAM-INDICATOR [-5], X1234X [0], 
UNSUBSCRIBE [-100], SUBJECT-FWD [-100]

X-Country-Chain: UNITED STATES->destination

X-Declude-Code: e

X-Declude-Recipcount: 1

X-Recipients: declude.junkmail@declude.com

X-HELO: smail.globalweb.net

X-Identity: 208.74.80.105 | smail.globalweb.net | globalweb.us

X-DECLUDE: 
----------------------------------------------------------------------

List-Id: <listid.Declude.JunkMail.42592764.declude.com>

X-Mailing-List: Declude.JunkMail@declude.com

Reply-to: Declude.JunkMail@declude.com

Precedence: list

Sender: "Randy Armbrecht" <ra...@globalweb.us>

X-Rcpt-To: <m...@anim8.net>

X-SmarterMail-Spam: SPF_Pass, ISpamAssassin 0 [raw: 0], DK_None, DKIM_None, 
Custom Rules [], URIBL:11

X-SmarterMail-TotalSpamWeight: 0 (Trusted Sender)

This doesn't look like Declude is the culprit in your scoring, but rather your 
SmarterMail Spam scoring is the culprit.  Have you changed anything recently in 
the Spam settings of SmarterMail?




Sincerely,

Randy Armbrecht
Global Web Solutions, Inc.
Office: 804.442.5300 x112
Toll Free: 877.800.4562

24 /7 Tech Support!
Your Internet Source.Since 1996!

NEW GlobalSync Remote-BackUp Solutions!

Web Hosting  -  E-Mail  -  Spam/Virus Gateway Services
Hi-Speed DSL, Ethernet and Wireless Internet -  T-1/T-3's
PC Support - Networking - Virus/MalWare Removal

25% discount on most services for Non-Profits!  Call us today!



From: SM Admin [mailto:imailad...@bcwebhost.net]

Sent: Friday, March 01, 2013 8:54 PM

To: Declude.JunkMail@declude.com

Subject: [Declude.JunkMail] why have spam scores jumped?



Hi,



I don't know if anyone is still here but I'd like some insights into some 
strange anti-spam behavior.



We have latest SmarterMail and Declude, as well as Sniffer. Over the last few 
days I noticed a significant drop in email messages.  Upon further 
investigation, I found that messages were being givn much higher spam scores 
than in the past, with the result that they get classified as spam or just 
outright deleted.  Checking the headers, however, I don't see why the scores 
are coming in so high.  Below are a few examples.  Does anyone see why the spam 
scores come out so high?



Thanks,



Ben



***********************************************

X-MessageSniffer-Scan-Result: 0

X-MessageSniffer-Rules: 0-0-0-2998-c

X-Declude-Sender: mstad...@ghrlawyers.com [70.89.176.73]

X-Declude-Spoolname: 195938010.eml

X-Declude-RefID:

X-Declude-Note: Scanned by Declude 4.11.00 "http://www.declude.com/x-note.htm";

X-Declude-Scan: Incoming Score [0] at 17:26:20 on 01 Mar 2013

X-Declude-Tests: SPFUNKNOWN [1]

X-Country-Chain: UNITED STATES->destination

X-Declude-Code: e

X-HELO: mail.garrettlaw.com

X-Identity: 70.89.176.73 | mail.garrettlaw.com | ghrlawyers.com

X-SmarterMail-Spam: SPF_SoftFail, ISpamAssassin 0 [raw: 0], DK_None, DKIM_None, 
URIBL:3, Declude: 0

X-SmarterMail-TotalSpamWeight: 15

*****************************************************************************************

-MessageSniffer-Scan-Result: 0

X-MessageSniffer-Rules: 0-0-0-32767-c

X-Declude-Sender: gha...@ghrlawyers.com [70.89.176.73]

X-Declude-Spoolname: 159487572.eml

X-Declude-RefID:

X-Declude-Note: Scanned by Declude 4.11.00 "http://www.declude.com/x-note.htm";

X-Declude-Scan: Incoming Score [-3] at 16:38:51 on 01 Mar 2013

X-Declude-Tests: SPFUNKNOWN [1]

X-Country-Chain: UNITED STATES->destination

X-Declude-Code: 1e

X-HELO: mail.garrettlaw.com

X-Identity: 70.89.176.73 | mail.ghrlawyers.com | ghrlawyers.com

X-SmarterMail-Spam: SPF_SoftFail, ISpamAssassin 0 [raw: 0], DK_None, DKIM_None, 
URIBL:7, Declude: -3

X-SmarterMail-SpamDetail: 0.0 TVD_SUBJ_ACC_NUM

X-SmarterMail-SpamDetail: 0.0 T_OBFU_PDF_ATTACH

X-SmarterMail-TotalSpamWeight: 28

**********************************************************************

X-MessageSniffer-Scan-Result: 0

X-MessageSniffer-Rules: 0-0-0-32767-c

X-Declude-Sender: gha...@ghrlawyers.com [70.89.176.73]

X-Declude-Spoolname: 159487567.eml

X-Declude-RefID:

X-Declude-Note: Scanned by Declude 4.11.00 "http://www.declude.com/x-note.htm";

X-Declude-Scan: Incoming Score [-3] at 16:35:50 on 01 Mar 2013

X-Declude-Tests: SPFUNKNOWN [1]

X-Country-Chain: UNITED STATES->destination

X-Declude-Code: 1e

X-HELO: mail.garrettlaw.com

X-Identity: 70.89.176.73 | mail.ghrlawyers.com | ghrlawyers.com

X-SmarterMail-Spam: SPF_SoftFail, ISpamAssassin 1 [raw: 1], DK_None, DKIM_None, 
URIBL:10, Declude: -3

X-SmarterMail-TotalSpamWeight: 41

******************************************************************************

Just for comparison, here is an email from the same source from Tuesday (and 
very typical of past headers):



X-MessageSniffer-Scan-Result: 0

X-MessageSniffer-Rules: 0-0-0-27512-c

X-Declude-Sender: gha...@ghrlawyers.com [70.89.176.73]

X-Declude-Spoolname: 159486224.eml

X-Declude-RefID:

X-Declude-Note: Scanned by Declude 4.11.00 "http://www.declude.com/x-note.htm";

X-Declude-Scan: Incoming Score [-3] at 17:56:38 on 26 Feb 2013

X-Declude-Tests: SPFUNKNOWN [1]

X-Country-Chain: UNITED STATES->destination

X-Declude-Code: 1e

X-HELO: mail.garrettlaw.com

X-Identity: 70.89.176.73 | mail.garrettlaw.com | ghrlawyers.com

X-SmarterMail-Spam: SPF_SoftFail, ISpamAssassin 5 [raw: 3], DK_None, DKIM_None, 
Declude: -3

X-SmarterMail-TotalSpamWeight: 5







--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Reply via email to