Michael,

I think I know what happened with spams getting through with high AWL scores to
some lists after reading some recent messages on related topics.

Check one of those spams, particularly the received headers. See if any in the
path that message took are listed in /usr/share/spamassassin/60_whitelist.cf.
If so, messages taking that path are whitelisted, meaning they start with
a -100 score. When the message hits AWL, THAT SENDER (the spammer) starts
with -100, regardless of the score, so their average IS highly-anti-spam. Their
next message (which there probably won't be one) will be scored more spammy,
but still not as spam. It's only after several posts that the AWL adjustment
will be corrected.

If this is correct, that same spammer could probably get a message through
based on DEFAULT WHITELIST settings, regardless of AWL. Have you seen repeats
of this problem?

I'm increasingly convinced that the default whitelist is risky for this reason.

- Bob

Reply via email to