-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Matt Kettler wrote: > David Goldsmith wrote: >> A messages that just made it through to my mailbox had the following SA >> headers: >> >> X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) >> X-Spam-Level: **** >> X-Spam-Status: No, score=4.5 required=7.0 tests=BAYES_50,HTML_40_50, >> HTML_MESSAGE,URIBL_SBL autolearn=no version=3.1.0 >> >> I bounced it to our 'spam' address and ran 'spamc' against the message >> and came back with: >> >> X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) >> X-Spam-Level: >> X-Spam-Status: No, score=0.5 required=7.0 tests=BAYES_40,HTML_40_50, >> HTML_MESSAGE,URIBL_SBL autolearn=no version=3.1.0 >> >> >> I've seen this often where email bounced by one of our users to out spam >> box appears to have a lower score when tested manually but in this case, >> I ran spamc within minutes of receiving the message. >> >> Any ideas on what may have changed in the Bayesian database in the short >> interval that would lower the confidence that the message is spam? > > Define "bounced it to our 'spam' address".. What exact mechanism did > you use here?
Using Thunderbird, I used the 'Redirect' option to pass it to an address that our users can submit spam to that made it through. We then manually review / test those messages with spamc / sa-learn by hand. > I ask because Auto-processing learners are a dangerous minefield, SA's > bayes system is very sensitive to changes in: > > From and To: headers > Body encoding > > Both of which will be changed dramatically if you use "forward" on a > message. Dave -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3rc2 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFEhPn4417vU8/9QfkRAr9pAJ9TzupLQJcOU3T/vMF/zNn6R1o7CgCff+YE xkWWjiBF7WQ/bFcKAqmvxP0= =A0Ru -----END PGP SIGNATURE-----
