RE: [Declude.JunkMail] Spam Score?
Dave, The last column of a test is the value added or subtracted if the test is NOT triggered. IF a test is NOT triggered it will not show up in the header. The most common that are used like this are: IPNOTINMX NOLEGITCONTENT FROMNOMATCH David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax dbar...@declude.com -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave Beckstrom Sent: Thursday, February 19, 2009 9:33 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Spam Score? Something is happening with our spam score that I don't quite understand. If you look below at the (sanitized) email headers you'll see that the CBL test scored 6 and spamheaders scored 3 and yet the final score for this email was Spam Score: [1] Shouldn't the score have been 9? On another note, if the CBL ip4rl test shows blocked what is the best way to hold this email? I assume that I would just up the weighting from 6 to my hold level? Do you guys hold email based only on an rbl response of blocked or do you require additional tests to fail? If a few folks would like to post their ip4r tests from the global.cfg I think that would be really helpful to a lot of people. I know that my global.cfg is a good number of years old and the ip4r tests are not tests that I've updated in a long time. Seeing what others are using would help me identify if I have tests I'm not using but should be using and vice versa. Thanks, Dave Return-Path: yourautopolicyvxw...@bestlevelterm.com Thu Feb 19 03:29:48 2009 Received: from server1.taxhelpis.com [65.60.20.131] ..com with SMTP; Thu, 19 Feb 2009 03:29:48 -0600 Reply-To: yourautopolicyvxw...@bestlevelterm.com In-Reply-To: 20090219033057.ggnppl...@mx2.bestlevelterm.com.1329 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=_=_extPart_000_0097_a3d0dac.a3d0dac Content-class: urn:content-classes:message Return-path: yourautopolicyvxw...@bestlevelterm.com Subject:Vehicle Warranty - 60% OFF Dealers Price Date: Thu, 19 Feb 2009 03:30:57 -0600 Message-Id: 20090219033057.ggnppl...@mx2.bestlevelterm.com Thread-Topic: RE: This email can save your life From: Continued Auto Coveragecontinuedautocover...@bestlevelterm.com To: x Importance: Normal X-invURIBL-Scan: Scanned by invURIBL 3.1.1 on 2/19/2009 3:29:58 AM X-invURIBL-Weight: 0 X-invURIBL-Range: CLEAN X-RBL-Warning: CBL: Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=65.60.20.131; X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [4000100e]. X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. X-Declude-Sender: yourautopolicyvxw...@bestlevelterm.com [65.60.20.131] X-Declude-RefID: X-Note: X-Note: Spam Score: [1] X-Note: Scan Time: 03:30:01 on 19 Feb 2009 X-Note: Spool File: 369855951432.eml X-Note: Server Name: mx2.bestlevelterm.com X-Note: SMTP Sender: yourautopolicyvxw...@bestlevelterm.com X-Note: Reverse DNS IP: server1.taxhelpis.com [65.60.20.131] X-Note: Recipient(s): X-Note: Country Chain: [ARIN Unlisted]-destination X-Note: Failed Weights: CBL [6], SPAMHEADERS [3], SPFPASS [0] X-Note: --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spam Score?
David, Here is the test: CBL IP4Rcbl.abuseat.org 127.0.0.2 6 0 According to these headers: X-RBL-Warning: CBL: Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=65.60.20.131; X-Note: Failed Weights: CBL [6], SPAMHEADERS [3], SPFPASS [0] Wasn't the test triggered and a score of 6 should have been added to the total score? -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David Barker Sent: 2009-02-19 08:37 To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Spam Score? Dave, The last column of a test is the value added or subtracted if the test is NOT triggered. IF a test is NOT triggered it will not show up in the header. The most common that are used like this are: IPNOTINMX NOLEGITCONTENT FROMNOMATCH David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax dbar...@declude.com -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave Beckstrom Sent: Thursday, February 19, 2009 9:33 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Spam Score? Something is happening with our spam score that I don't quite understand. If you look below at the (sanitized) email headers you'll see that the CBL test scored 6 and spamheaders scored 3 and yet the final score for this email was Spam Score: [1] Shouldn't the score have been 9? On another note, if the CBL ip4rl test shows blocked what is the best way to hold this email? I assume that I would just up the weighting from 6 to my hold level? Do you guys hold email based only on an rbl response of blocked or do you require additional tests to fail? If a few folks would like to post their ip4r tests from the global.cfg I think that would be really helpful to a lot of people. I know that my global.cfg is a good number of years old and the ip4r tests are not tests that I've updated in a long time. Seeing what others are using would help me identify if I have tests I'm not using but should be using and vice versa. Thanks, Dave Return-Path: yourautopolicyvxw...@bestlevelterm.com Thu Feb 19 03:29:48 2009 Received: from server1.taxhelpis.com [65.60.20.131] ..com with SMTP; Thu, 19 Feb 2009 03:29:48 -0600 Reply-To: yourautopolicyvxw...@bestlevelterm.com In-Reply-To: 20090219033057.ggnppl...@mx2.bestlevelterm.com.1329 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=_=_extPart_000_0097_a3d0dac.a3d0dac Content-class: urn:content-classes:message Return-path: yourautopolicyvxw...@bestlevelterm.com Subject:Vehicle Warranty - 60% OFF Dealers Price Date: Thu, 19 Feb 2009 03:30:57 -0600 Message-Id: 20090219033057.ggnppl...@mx2.bestlevelterm.com Thread-Topic: RE: This email can save your life From: Continued Auto Coveragecontinuedautocover...@bestlevelterm.com To: x Importance: Normal X-invURIBL-Scan: Scanned by invURIBL 3.1.1 on 2/19/2009 3:29:58 AM X-invURIBL-Weight: 0 X-invURIBL-Range: CLEAN X-RBL-Warning: CBL: Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=65.60.20.131; X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [4000100e]. X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. X-Declude-Sender: yourautopolicyvxw...@bestlevelterm.com [65.60.20.131] X-Declude-RefID: X-Note: X-Note: Spam Score: [1] X-Note: Scan Time: 03:30:01 on 19 Feb 2009 X-Note: Spool File: 369855951432.eml X-Note: Server Name: mx2.bestlevelterm.com X-Note: SMTP Sender: yourautopolicyvxw...@bestlevelterm.com X-Note: Reverse DNS IP: server1.taxhelpis.com [65.60.20.131] X-Note: Recipient(s): X-Note: Country Chain: [ARIN Unlisted]-destination X-Note: Failed Weights: CBL [6], SPAMHEADERS [3], SPFPASS [0] X-Note: --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spam Score?
David, Never mind. I found in the logs where those tests you mentioned are giving the email a credit (negative weight) and thus the total weight is adjusted accordingly. I have IPNOTINMX and NOLEGITCONTENT set up under HIDETESTS which explains why the confusion on the total score. BTW -- I would still like to see some people post their ip4r tests to the list. I have a hunch I'm missing some valuable tests in my list. Thanks, Dave -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave Beckstrom Sent: 2009-02-19 08:56 To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Spam Score? David, Here is the test: CBL IP4Rcbl.abuseat.org 127.0.0.2 6 0 According to these headers: X-RBL-Warning: CBL: Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=65.60.20.131; X-Note: Failed Weights: CBL [6], SPAMHEADERS [3], SPFPASS [0] Wasn't the test triggered and a score of 6 should have been added to the total score? -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David Barker Sent: 2009-02-19 08:37 To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Spam Score? Dave, The last column of a test is the value added or subtracted if the test is NOT triggered. IF a test is NOT triggered it will not show up in the header. The most common that are used like this are: IPNOTINMX NOLEGITCONTENT FROMNOMATCH David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax dbar...@declude.com -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave Beckstrom Sent: Thursday, February 19, 2009 9:33 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Spam Score? Something is happening with our spam score that I don't quite understand. If you look below at the (sanitized) email headers you'll see that the CBL test scored 6 and spamheaders scored 3 and yet the final score for this email was Spam Score: [1] Shouldn't the score have been 9? On another note, if the CBL ip4rl test shows blocked what is the best way to hold this email? I assume that I would just up the weighting from 6 to my hold level? Do you guys hold email based only on an rbl response of blocked or do you require additional tests to fail? If a few folks would like to post their ip4r tests from the global.cfg I think that would be really helpful to a lot of people. I know that my global.cfg is a good number of years old and the ip4r tests are not tests that I've updated in a long time. Seeing what others are using would help me identify if I have tests I'm not using but should be using and vice versa. Thanks, Dave Return-Path: yourautopolicyvxw...@bestlevelterm.com Thu Feb 19 03:29:48 2009 Received: from server1.taxhelpis.com [65.60.20.131] ..com with SMTP; Thu, 19 Feb 2009 03:29:48 -0600 Reply-To: yourautopolicyvxw...@bestlevelterm.com In-Reply-To: 20090219033057.ggnppl...@mx2.bestlevelterm.com.1329 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=_=_extPart_000_0097_a3d0dac.a3d0dac Content-class: urn:content-classes:message Return-path: yourautopolicyvxw...@bestlevelterm.com Subject:Vehicle Warranty - 60% OFF Dealers Price Date: Thu, 19 Feb 2009 03:30:57 -0600 Message-Id: 20090219033057.ggnppl...@mx2.bestlevelterm.com Thread-Topic: RE: This email can save your life From: Continued Auto Coveragecontinuedautocover...@bestlevelterm.com To: x Importance: Normal X-invURIBL-Scan: Scanned by invURIBL 3.1.1 on 2/19/2009 3:29:58 AM X-invURIBL-Weight: 0 X-invURIBL-Range: CLEAN X-RBL-Warning: CBL: Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=65.60.20.131; X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [4000100e]. X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. X-Declude-Sender: yourautopolicyvxw...@bestlevelterm.com [65.60.20.131] X-Declude-RefID: X-Note: X-Note: Spam Score: [1] X-Note: Scan Time: 03:30:01 on 19 Feb 2009 X-Note: Spool File: 369855951432.eml X-Note: Server Name: mx2.bestlevelterm.com X-Note: SMTP Sender: yourautopolicyvxw...@bestlevelterm.com X-Note: Reverse DNS IP: server1.taxhelpis.com [65.60.20.131] X-Note: Recipient(s): X-Note: Country Chain: [ARIN Unlisted]-destination X-Note: Failed Weights: CBL [6], SPAMHEADERS [3], SPFPASS [0] X-Note: --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail
RE: [Declude.JunkMail] Spam Score?
Post the following tests from your global.cfg: CBL SPAMHEADERS IPNOTINMX NOLEGITCONTENT FROMNOMATCH David -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave Beckstrom Sent: Thursday, February 19, 2009 9:56 AM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Spam Score? David, Here is the test: CBL IP4Rcbl.abuseat.org 127.0.0.2 6 0 According to these headers: X-RBL-Warning: CBL: Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=65.60.20.131; X-Note: Failed Weights: CBL [6], SPAMHEADERS [3], SPFPASS [0] Wasn't the test triggered and a score of 6 should have been added to the total score? -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of David Barker Sent: 2009-02-19 08:37 To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] Spam Score? Dave, The last column of a test is the value added or subtracted if the test is NOT triggered. IF a test is NOT triggered it will not show up in the header. The most common that are used like this are: IPNOTINMX NOLEGITCONTENT FROMNOMATCH David Barker VP Operations Declude Your Email security is our business 978.499.2933 office 978.988.1311 fax dbar...@declude.com -Original Message- From: supp...@declude.com [mailto:supp...@declude.com] On Behalf Of Dave Beckstrom Sent: Thursday, February 19, 2009 9:33 AM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] Spam Score? Something is happening with our spam score that I don't quite understand. If you look below at the (sanitized) email headers you'll see that the CBL test scored 6 and spamheaders scored 3 and yet the final score for this email was Spam Score: [1] Shouldn't the score have been 9? On another note, if the CBL ip4rl test shows blocked what is the best way to hold this email? I assume that I would just up the weighting from 6 to my hold level? Do you guys hold email based only on an rbl response of blocked or do you require additional tests to fail? If a few folks would like to post their ip4r tests from the global.cfg I think that would be really helpful to a lot of people. I know that my global.cfg is a good number of years old and the ip4r tests are not tests that I've updated in a long time. Seeing what others are using would help me identify if I have tests I'm not using but should be using and vice versa. Thanks, Dave Return-Path: yourautopolicyvxw...@bestlevelterm.com Thu Feb 19 03:29:48 2009 Received: from server1.taxhelpis.com [65.60.20.131] ..com with SMTP; Thu, 19 Feb 2009 03:29:48 -0600 Reply-To: yourautopolicyvxw...@bestlevelterm.com In-Reply-To: 20090219033057.ggnppl...@mx2.bestlevelterm.com.1329 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=_=_extPart_000_0097_a3d0dac.a3d0dac Content-class: urn:content-classes:message Return-path: yourautopolicyvxw...@bestlevelterm.com Subject:Vehicle Warranty - 60% OFF Dealers Price Date: Thu, 19 Feb 2009 03:30:57 -0600 Message-Id: 20090219033057.ggnppl...@mx2.bestlevelterm.com Thread-Topic: RE: This email can save your life From: Continued Auto Coveragecontinuedautocover...@bestlevelterm.com To: x Importance: Normal X-invURIBL-Scan: Scanned by invURIBL 3.1.1 on 2/19/2009 3:29:58 AM X-invURIBL-Weight: 0 X-invURIBL-Range: CLEAN X-RBL-Warning: CBL: Blocked - see http://cbl.abuseat.org/lookup.cgi?ip=65.60.20.131; X-RBL-Warning: SPAMHEADERS: This E-mail has headers consistent with spam [4000100e]. X-RBL-Warning: SPFPASS: SPF returned PASS for this E-mail. X-Declude-Sender: yourautopolicyvxw...@bestlevelterm.com [65.60.20.131] X-Declude-RefID: X-Note: X-Note: Spam Score: [1] X-Note: Scan Time: 03:30:01 on 19 Feb 2009 X-Note: Spool File: 369855951432.eml X-Note: Server Name: mx2.bestlevelterm.com X-Note: SMTP Sender: yourautopolicyvxw...@bestlevelterm.com X-Note: Reverse DNS IP: server1.taxhelpis.com [65.60.20.131] X-Note: Recipient(s): X-Note: Country Chain: [ARIN Unlisted]-destination X-Note: Failed Weights: CBL [6], SPAMHEADERS [3], SPFPASS [0] X-Note: --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to imail...@declude.com, and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came
