Tim Macrina wrote: > Can anyone explain to me as to why this message was marked as ham. > Thank you
Because it didn't hit any rules. No hits = ham, and by default, autolearn as ham (IMO this is a bad thing, but the default SA ruleset doesn't have enough negative-scoring rules to use a negative learning threshold.) > X-Spam-Status: No, score=0.0 required=5.0 tests=none autolearn=ham > version=3.0.3 Do you run with network checks enabled? in particular that message should have hit a bunch of SURBLs, URIBL.com lists, and razor. Also, the source IP 220.160.189.10 is in XBL (via CBL). Of course, both of these hits could have been added after you got the message, but it's worth checking if your setup is using network tests.
