>>> For the sake of spam/virus elimination, I wouldn't say that there IS
a "standard" in add-ons.
Fair enough... I'm using Suse Linux server 8.1, Postfix, Amavis-d, SA
2.64, Razor, Rules_Du_Jour (most of them, but not all), SpamCop URI, and
manual Bayes learning (via IMAP and a shared folder). This is only a
relay box, with all email forwarded to our internal GroupWise system.
A typical header of one that sneaks through looks like this:
X-Spam-Status: Yes, hits=4.2 tagged_above=0.1 required=3.5
tests=BAYES_30, BLANK_LINES_70_80, WS_URI_RBL
X-Spam-Level: ****
X-Spam-Flag: YES
("X-Spam-Flag" ????)
..and a spam that gets correctly quarantined looks like this:
X-Spam-Status: Yes, hits=8.4 tag1=-999.0 tag2=3.5 kill=4.0
tests=CLICK_BELOW, HTML_60_70, HTML_IMAGE_RATIO_08,
HTML_LINK_CLICK_HERE, HTML_MESSAGE,
HTML_TAG_BALANCE_A, MIME_HTML_ONLY, NORMAL_HTTP_TO_IP, OB_URI_RBL,
WS_URI_RBL
X-Spam-Level: ********
...and, for comparison, a ham that gets delivered:
X-Spam-Status: No, hits=-3.2 tagged_above=-999.0 required=3.5
tests=BAYES_00,
CLICK_BELOW, EXCUSE_14, HTML_FONTCOLOR_RED, HTML_FONTCOLOR_UNSAFE,
HTML_LINK_CLICK_HERE, HTML_MESSAGE, MIME_BOUND_NEXTPART,
REMOVE_IN_QUOTES,
REMOVE_SUBJ, SARE_FROM_SPAM_WORD1
X-Spam-Level:
For reference, I tag above -999, I append "***POSSIBLE SPAM***" at 3.5,
and I kill at 4.0 (and rarely, if ever, get a false positive). I cannot
figure out why emailsare slipping by Amavis...something stinks here...
GA
