I'm a DNSWL admin. I would like to see full examples (well, headers). What IP addresses are being looked up in DNSWL?
It's possible you don't have trusted_networks and internal_networks configured correctly, resulting in looking up an IP address belonging to your ISP or another mail server which you have configured to relay mail to you. I know of no reason it would be a temporary hiccup, but it is certainly unusual. According to spamassassin's mass checks, 0.89% of spam hits RCVD_IN_DNSWL_MED: http://www.chaosreigns.com/dnswl/ Also, I see your threshold (6.31) is set higher than the default (5), and at the default the two examples you provided would have been classified correctly. Although I understand you may not wish to lower your threshold. Interesting problem though. On 02/20, Pasi Hirvonen wrote: > Hello, > > I just recently moved our mail setup to new hardware and I've been > paying close attention to what gets marked as spam and what > doesn't. > > Looking at my spam folder, I have received roughly 550 spam emails > to my email account since last tuesday (15th). Out of those 550, > *345* have been downscored by RCVD_IN_DNSWL_MED. Annoyingly, a > significant number of those spam mails have dropped just below the > spam threshold because of it. > > X-Spam-Status: No, score=6.105 required=6.31 > tests=[CHARSET_FARAWAY_HEADER=3.2, DOS_HIGHBIT_HDRS_BODY=1, > HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, PYZOR_CHECK=1.985, > RCVD_IN_BL_SPAMCOP_NET=1.246, RCVD_IN_DNSWL_MED=-2.3, > > X-Spam-Status: No, score=6.076 required=6.31 > tests=[FORGED_MUA_OUTLOOK=2.785, FROM_MISSP_MSFT=1, > MISSING_HEADERS=1.207, > MSGID_FROM_MTA_HEADER=0.001, > MSOE_MID_WRONG_CASE=3.373, RCVD_IN_DNSWL_MED=-2.3, > T_FROM_MISSPACED=0.01] autolearn=no > > I'm thinking of not bothering with DNSWL tests anymore unless > someone convinces me this is a temporary hiccup. What are your > experiences? > > - Pasi > > ps. if someone wants to see full mail examples, I have plenty. :) > -- "Go forth, and be excellent to one another." - http://www.jhuger.com/fredski.php http://www.ChaosReigns.com
