John wrote: > Gary V wrote: >> John wrote: >> >>>This is an example of the symptom. Starting amavis on filtering server1 >>>with the following log definitions: >> >> >>>$DO_SYSLOG = 0; >>>$LOGFILE = "/var/log/amavis.log"; >>>$log_level = 4 >> >>>I get this in the log for a given message. >> >>>Dec 16 15:43:22 server1.franklinamerican.com amavisd-new[13045]: >>>(13045-06) SPAM-TAG, <[EMAIL PROTECTED]> -> >>><[EMAIL PROTECTED]>, Yes, hits=5.3 tagged_above=1.0 required=3.5 >>>tests=AWL, BAYES_99, HTML_90_100, HTML_IMAGE_RATIO_02, HTML_MESSAGE, >>>HTML_MIME_NO_HTML_TAG, MIME_HTML_ONLY >> >>>I find this in the headers of the delivered message on the mailbox >>>server. (snipped) >> >> >>>Return-Path: <[EMAIL PROTECTED]> >>>Received: from server1.franklinamerican.com ([127.0.0.1]) >>> by localhost (server1.franklinamerican.com [127.0.0.1]) >>> (amavisd-new, >>>port 10024) >>> with ESMTP id 13045-06 for <[EMAIL PROTECTED]>; >>> Fri, 16 Dec 2005 15:43:21 -0600 (CST) >>>Date: Fri, 16 Dec 2005 15:43:16 -0600 (CST) >>>From: More Coupons <[EMAIL PROTECTED]> >>>Reply-To: E-Family Values <[EMAIL PROTECTED]> >>>To: Fake User <[EMAIL PROTECTED]> >>>Subject: Jamie, Here's more free coupons for your baby >>>Mime-Version: 1.0 >>>Content-Type: text/html; charset=ISO-8859-1 >>>Content-Transfer-Encoding: quoted-printable >>>X-MRX: miinquufqwlxlwlvulvkuvll sswnilkiilkvwnnxik lllquiqusk >>>X-Virus-Scanned: by amavis at mx1.franklinamerican.com >>>X-Virus-Scanned: by amavis at imap.franklinamerican.com >> >> >> >> Are you certain the quarantined messages that do have X-Spam headers >> are addressed to franklinamerican.com? Are you certain franklinamerican.com >> is >> listed in your @local_domains_maps? Is there any reason you could not >> lower $sa_tag_level_deflt? I admit it should not necessary to do that, >> but try it and see what happens. >> >> Gary V >>
> Gary, our mail server does recipient checks during SMTP. We don't even > accept mail not addressed to us, let alone put headers on it and deliver > it to our users. I could lower the default tag level, but I'm already > configured to add SA headers above 1.0. Even the basic "X-Spam-Score: > 1.2" headers aren't being added. The $sa_tag_level_deflt only affects the X-Spam type headers. You can safely include these headers in every mail, spam or not by setting: $sa_tag_level_deflt = undef; which for this particular setting means 'lower than any possible score'. It is assumed you only accept mail addressed to you. I could not assume however that you receive mail for only one single domain. The point is every domain you accept mail for must be listed in @local_domains_maps if you want the X-Spam headers inserted for those domains. If you do any address rewriting, it is a good idea to include those domains also (e.g. 'localhost'). The score must also fall at or above $sa_tag_level_deflt. The only case I can think of where mail addressed to a particular domain would see the X-Spam headers in the spam that is quarantined, but not in spam that is passed to a recipient is when the score of the mail passed to the recipient falls below $sa_tag_level_deflt. You claim the mail scores above $sa_tag_level_deflt and the domain is listed in @local_domains_acl but for some odd reason, the X-Spam headers are not inserted until the score reaches $sa_kill_level_deflt (the point at which the mail is quarantined). I would have to say that that is more than odd. I proposed to lower $sa_tag_level_deflt as a first diagnostic test. I can't see how it would hurt your system to do so. I am curious to see the result. If you include the X-Spam info headers on a piece of ham, the worst that could happen is you would get something like this: X-Spam-Status: No, score=-3.502 required=5 tests=[ALL_TRUSTED=-1.8, BAYES_00=-2.599, DSPAM_HAM=-0.1, SUBJ_ALL_CAPS=0.997] X-Spam-Score: -3.502 X-Spam-Level: Gary V ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click _______________________________________________ AMaViS-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
