David, Never mind. I found in the logs where those tests you mentioned are giving the email a credit (negative weight) and thus the total weight is adjusted accordingly.
I have IPNOTINMX and NOLEGITCONTENT set up under HIDETESTS which explains why the confusion on the total score. BTW -- I would still like to see some people post their ip4r tests to the list. I have a hunch I'm missing some valuable tests in my list. Thanks, Dave > -----Original Message----- > From: [email protected] [mailto:[email protected]] On Behalf Of Dave > Beckstrom > Sent: 2009-02-19 08:56 > To: [email protected] > Subject: RE: [Declude.JunkMail] Spam Score? > > David, > > Here is the test: > > CBL IP4R cbl.abuseat.org 127.0.0.2 6 0 > > According to these headers: > > X-RBL-Warning: CBL: "Blocked - see > http://cbl.abuseat.org/lookup.cgi?ip=65.60.20.131"; > X-Note: Failed Weights: CBL [6], SPAMHEADERS [3], SPFPASS [0] > > Wasn't the test triggered and a score of 6 should have been added to the > total score? > > > > > -----Original Message----- > > From: [email protected] [mailto:[email protected]] On Behalf Of David > > Barker > > Sent: 2009-02-19 08:37 > > To: [email protected] > > Subject: RE: [Declude.JunkMail] Spam Score? > > > > Dave, > > > > The last column of a test is the value added or subtracted if the test is > > NOT triggered. IF a test is NOT triggered it will not show up in the > header. > > The most common that are used like this are: > > > > IPNOTINMX > > NOLEGITCONTENT > > FROMNOMATCH > > > > David Barker > > VP Operations Declude > > Your Email security is our business > > 978.499.2933 office > > 978.988.1311 fax > > [email protected] > > > > > > > > -----Original Message----- > > From: [email protected] [mailto:[email protected]] On Behalf Of Dave > > Beckstrom > > Sent: Thursday, February 19, 2009 9:33 AM > > To: [email protected] > > Subject: [Declude.JunkMail] Spam Score? > > > > > > Something is happening with our spam score that I don't quite understand. > > If you look below at the (sanitized) email headers you'll see that the CBL > > test scored 6 and spamheaders scored 3 and yet the final score for this > > email was Spam Score: [1] > > > > Shouldn't the score have been 9? > > > > On another note, if the CBL ip4rl test shows "blocked" what is the best > way > > to hold this email? I assume that I would just up the weighting from 6 to > > my hold level? Do you guys hold email based only on an rbl response of > > "blocked" or do you require additional tests to fail? > > > > If a few folks would like to post their ip4r tests from the global.cfg I > > think that would be really helpful to a lot of people. I know that my > > global.cfg is a good number of years old and the ip4r tests are not tests > > that I've updated in a long time. Seeing what others are using would help > > me identify if I have tests I'm not using but should be using and vice > > versa. > > > > Thanks, > > > > Dave > > > > > > > > > > Return-Path: <[email protected]> Thu Feb 19 03:29:48 > > 2009 > > Received: from server1.taxhelpis.com [65.60.20.131] xxxx.xxxx.com with > SMTP; > > Thu, 19 Feb 2009 03:29:48 -0600 > > Reply-To: <[email protected]> > > In-Reply-To: [email protected] > > MIME-Version: 1.0 > > Content-Type: multipart/alternative; > > boundary="----_=_extPart_000_0097_a3d0dac.a3d0dac" > > Content-class: urn:content-classes:message > > Return-path: <[email protected]> > > Subject:Vehicle Warranty - 60% OFF Dealers Price > > Date: Thu, 19 Feb 2009 03:30:57 -0600 > > Message-Id: <[email protected]> > > Thread-Topic: RE: This email can save your life > > From: "Continued Auto Coverage"<[email protected]> > > To: <xxxxx> > > Importance: Normal > > X-invURIBL-Scan: Scanned by invURIBL 3.1.1 on 2/19/2009 3:29:58 AM > > X-invURIBL-Weight: 0 > > X-invURIBL-Range: CLEAN > > X-RBL-Warning: CBL: "Blocked - see > > http://cbl.abuseat.org/lookup.cgi?ip=65.60.20.131"; > > X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam > > [4000100e]. > > X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. > > X-Declude-Sender: [email protected] [65.60.20.131] > > X-Declude-RefID: > > X-Note: ======================================== > > X-Note: Spam Score: [1] > > X-Note: Scan Time: 03:30:01 on 19 Feb 2009 > > X-Note: Spool File: 369855951432.eml > > X-Note: Server Name: mx2.bestlevelterm.com > > X-Note: SMTP Sender: [email protected] > > X-Note: Reverse DNS & IP: server1.taxhelpis.com [65.60.20.131] > > X-Note: Recipient(s): xxxx > > X-Note: Country Chain: [ARIN Unlisted]->destination > > X-Note: Failed Weights: CBL [6], SPAMHEADERS [3], SPFPASS [0] > > X-Note: ======================================== > > > > > > > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [email protected], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [email protected], and > > type "unsubscribe Declude.JunkMail". The archives can be found > > at http://www.mail-archive.com. > > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [email protected], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [email protected], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
