Spam sneaking in.

[Lambert Rots]

Hi,

Sorry for the delayed response, I was first debugging/fetching logs for a
few days...

No I did not change the DKIM_VERIFIED score so apparently I have a
different issue ;-)

Comparing debug logs between Amavisd-new (debug-sa) and spamassassin
directly shows that blacklist checks score 0 with NXDOMAIN replies when the
mail arrives the first time where spamassassin scores +3 with several hits
on blacklist checks.

I just cannot imagine that all spam I receive is early recipient based,
besides, postfix is already taking care of most blacklist checking.

Most spam mail is coming from the same email domains, share the same
subject and a lot of other stuff on which amavisd-new should be able to
identify it as spam. Bayes scores some mail but not all.

Spam senders try a lot to bypass anti spam but in my opinion amavisd-new
should be able to do better than marking less than 1 percent of spam mail
as spam.

Best regards,

Lambert

Op zo 18 aug. 2019 om 11:59 schreef Matus UHLAR - fantomas <
uhlar at fantomas.sk>:

> On 16.08.19 13:51, Lambert Rots wrote:
> >Did you get a solution for the issue about spam sneaking in? I think I
> have
> >the same issue about spam being scored differently between spamassassin
> and
> >amavisd-new.
>
> did you also change the DKIM_VERIFIED score to -3?
> If not, you don't have the same issue.
>
> >It looks like DNS blacklist checks are not scored as most spam is found on
> >blacklists when parsing the mail through spamassassin but debugging
> >amavisd-new shows that DNS checks are being performed.
>
> this is also a different issue. Many sites and webs get into blacklist
> after
> the spam starte spreading, so first (early) recipients don't see the mail
> in
> blacklist, while late recipients or later checks shows blacklists.
>
> --
> Matus UHLAR - fantomas, uhlar at fantomas.sk ; http://www.fantomas.sk/
> Warning: I wish NOT to receive e-mail advertising to this address.
> Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
> Linux IS user friendly, it's just selective who its friends are...
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.amavis.org/pipermail/amavis-users/attachments/20190826/b5e7c242/attachment.html>