Philip Prindeville wrote: > Daryl C. W. O'Shea wrote: > > >> Screaming Eagle wrote: >> >> >> >>> All, >>> Emailing with outlook and from internal network is marked as spam: >>> pts rule name description >>> ---- ---------------------- >>> -------------------------------------------------- >>> -1.8 ALL_TRUSTED Passed through trusted hosts only via SMTP >>> 1.1 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME >>> 1.0 HTML_MESSAGE BODY: HTML included in message >>> 0.1 HTML_90_100 BODY: Message is 90% to 100% HTML >>> 3.0 BAYES_00 BODY: Bayesian spam probability is 0 to 1% >>> [score: 0.0002] >>> 2.8 RATWARE_OUTLOOK_NONAME Bulk email fingerprint (Outlook no name) >>> found >>> 1.9 RATWARE_MS_HASH Bulk email fingerprint (msgid ms hash) found >>> 1.7 MSGID_DOLLARS Message-Id has pattern used in spam >>> -0.8 AWL AWL: From: address is in the auto white-list >>> >>> I think the RATWARE_OUTLOOK_NOMAME, RATWARE_MS_HASH,and MSGID_DOLLARS >>> is skewing the score. I have only seen this score if you use MS >>> OUTLOOK. Any idea why and if there is work around for this? Thanks. >>> >>> >>> >> >>> 3.0 BAYES_00 BODY: Bayesian spam probability is 0 to 1% >>> [score: 0.0002] >>> >> Whoever set the score for BAYES_00 to 3.0 must have been high! >> >> Daryl >> >> >> > > That's true, but you'd still be over 5.0 even without it. > > No, it would not be over 5.0 if BAYES_00 hadn't been screwed with. Because the default for BAYES_00 is a negative number, not 0.
This message adds to 8.9. Based on the scores of the other rules, this is 3.1.x with set3. In that set, BAYES_00 should score -2.599 instead of +3.0. That would make the message score somewhere around 3.3 (I'm not adding all the rules out to the thousandth, so I could be off by 0.1) HTML_MESSAGE also should be 0.1, not 1.0. The real score: 2.3. While I do admit that the rules screaming eagle points out are a problem, the shifting the scores of BAYES_00 and HTML_MESSAGE by a total of +6.599 from its default is a bigger problem. (the 3 cited rules total 6.403 points, which is a smaller impact than the score fiddling has caused.)
