The fact that you had to set BAYES_00 to -4 tells me that you have a problem
with ham being tagged as spam which points to a bayes training issue. You are
right, without the -4 you would still only have a score of 4.3 but you would
had been almost there. I hope you are not training your spam filter with that
BAYES_00 set like that, because if you are, you are effectively telling your
bayes that EVERY email is ham. Below I have included two X-Spam Reports from
flashlight spam to two different users. As you can see, in both the BAYES_99 is
hitting.
I suggest, you delete your bayes database, remove the BAYES_00 -4 and start
training again. You are going to need a couple of hundred ham and a couple
hundred spam before it becomes trained.
X-Spam-Flag: YES
X-Spam-Score: 14.625
X-Spam-Level: **************
X-Spam-Status: Yes, score=14.625 tag=-999 tag2=3.6 kill=12
tests=[BAYES_99=3.5, DCC_CHECK=1.1, DIGEST_MULTIPLE=0.293,
HTML_MESSAGE=0.001, NO_DNS_FOR_FROM=0.001, PYZOR_CHECK=1.392,
RCVD_IN_SBL_CSS=3.335, RDNS_NONE=0.793, T_REMOTE_IMAGE=0.01,
URIBL_BLACK=1.7, URIBL_DBL_SPAM=2.5] autolearn=disabled
--------------------------------------------------------------------------------------------------------------
X-Spam-Flag: YES
X-Spam-Score: 11.93
X-Spam-Level: ***********
X-Spam-Status: Yes, score=11.93 tag=-999 tag2=3.6 kill=12 tests=[BAYES_99=3.5,
BAYES_999=0.2, HTML_MESSAGE=0.001, PYZOR_CHECK=1.392,
RCVD_IN_SBL_CSS=3.335, RDNS_NONE=0.793, SPF_PASS=-0.001,
T_REMOTE_IMAGE=0.01, URIBL_BLACK=1.7, URI_TRY_USME=1]
autolearn=disabled
-----Original Message-----
From: amavis-users
[mailto:[email protected]] On
Behalf Of @lbutlr
Sent: Sunday, December 18, 2016 12:42 AM
To: [email protected]
Subject: Re: Flashlight spam (and others)
> On Dec 17, 2016, at 10:40 AM, Dino Edwards <[email protected]>
> wrote:
>
> Am I looking at this right? Does BAYES_00 assign a score of -4 on these
> messages?
Yes. BAYES_00 is normally extremely effective at passing ham.
But note that the spam passed even WITHOUT BAYES_00
> X-Spam-Status: No, score=0.3 required=5.0
> tests=BAYES_00,DCC_CHECK,DKIM_SIGNED,
> HTML_IMAGE_ONLY_24,HTML_MESSAGE,MIME_HEADER_CTYPE_ONLY,RDNS_NONE,
> T_DKIM_INVALID,T_REMOTE_IMAGE autolearn=no autolearn_force=no
> version=3.4.1
