On Fri, 2012-11-09 at 10:45 -0200, Rejaine Monteiro wrote:
>
> I have a strange problem in Spamassassin - I have received spam which
> normally should have been blocked, but were not.
> I have received messages with a low score or even negative score, but
> when I save the e-mail to a file and run the spamc in the same
> message (using the same spamassassin server) the score is completely
> different
>
> Today for example, I received a message with a negative score (message
> header say: SA: 0 (-93.5/5.0)
>
> I got this mail client (thunderbird), saved it in a file (.eml
> extension) ,I copied it to the server where it runs spamassassin and
> spamc ran the manually:
>
> #spamc -R < /tmp/spam.eml
> Content analysis details: (19.8 points, 5.0 required)
>
You don't show what rules hit, which makes it impossible to say what's
happening. Possibilities:
- your 2nd spam score is largely due to blacklisting but none of the
blacklists fires the first time. Two possibilities:
(a) the spammer used a new domain which hadn't been blacklisted the
when the mail was received but was blacklisted by the time
you ran the manual test. This is common.
(b) (unlikely) there was a network problem that prevented access to
the blacklists when it was received, but fault fixed for the
manual test
- if you use a local black-list, was it offline for backups/maintenance
when the mail was received? I use a mail archive to whitelist anybody
I've sent mail to, which is offline between 03:00-03:20 while its DB
is backed up. Mail received in that period may be falsely treated as
spam.
Martin
