To reply to my own mail with the solution... :) I had 2 merged groups, like this:
@group1.com:merged:* @group2.com:merged:* This seems to be bad mojo... Removing one fixes everything! Bye, Bart Verwilst ----- Original Message ----- From: "Bart Verwilst" <[EMAIL PROTECTED]> To: "dspam-users" <[email protected]> Sent: Tuesday, July 17, 2007 11:16:45 AM (GMT+0100) Europe/Berlin Subject: [dspam-users] First mails always quarantined Hi guys! I'm fighting with dspam for a while now on one area. When i create a new user, their mails are almost always quarantined. It's only when i relearn a single mail, that the others stop being sent straight to quarantine.. Until i do that, we have loads of false positives.. This is the header i get from one of those mails: X-DSPAM-Result: Spam X-DSPAM-Processed: Tue Jul 17 09:25:50 2007 X-DSPAM-Confidence: 0.9899 X-DSPAM-Probability: 1.0000 X-DSPAM-Factors: 15, of, 0.99000, de, 0.99000, X-MimeOLE*By, 0.99000, dat, 0.99000, X-MimeOLE*Produced, 0.99000, X-MimeOLE*Microsoft+MimeOLE, 0.99000, door, 0.99000, in, 0.99000, X-Mailer*Microsoft, 0.99000, dit, 0.99000, en, 0.99000, op, 0.99000, X-MimeOLE*MimeOLE, 0.99000, X-MimeOLE*Produced+By, 0.99000, 1), 0.99000 All these words are very common though.. An example: for the word "en": We have a merged group: 5944030228501233664 S: 00120 I: 01778 P: 0.2551 And the actual domain: 5944030228501233664 S: 00004 I: 00000 P: 0.4000 I'm not sure why he sees the tokens of these first mails as spam since the merged group has over 2500 mails learned, and i'm using TOE. But still, it shouldn't get a score of 0.99 anyways... TB is off, but i guess this isn't used either since i'm passed my 2500 mails? Does ANYONE please have a solution about this? Earlier i noticed that the Date header had a lot of entries in these mails, all useless and with a high score, so i made dspam ignore this header, which seemed to fix it for my testaccount.. But now a new customer is suffering the same fate... I hope somebody knows the real solution! :) Thanks a lot! Kind regards, Bart Verwilst !DSPAM:3,469c891d193441704460093!
