<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-2">
</head>
<body text="#000000" bgcolor="#FFFFFF">
On 7/31/19 12:36 PM, Matus UHLAR - fantomas wrote:<br>
<blockquote type="cite"
cite="mid:20190731173631.GA19012@fantomas.sk">On 31.07.19 11:47,
Bob D wrote:
<br>
<blockquote type="cite">I have an Ubuntu 18.04 server running
Postfix, Clamav, Spamassassin, Dovecot with virtual
hosts/emails.
<br>
I have spam sneaking in here and it is annoying. They all mostly
come from the same IP. When I ban the IP, after a few hours, it
just comes from another IP.
<br>
This garbage is obviously spam, no doubt. When I test any of the
mails via the command-line, it always scores high.
<br>
The last one I checked scored 23.8 as spam using either:
<br>
$ su spamassassin -c "spamassassin -D < testmail"
<br>
$ su amavis -c " spamassassin -D < testmail"
<br>
This one showed .6 in the X-Header as it came in as shown here:
<br>
--------------------------------------------------------------------------------------------------------------------------------
<br>
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on
<br>
MyServer1-2.mydomain.com
<br>
X-Spam-Level:
<br>
X-Spam-Status: No, score=0.6 required=4.0
tests=BAYES_99,BAYES_999,DKIM_SIGNED,
<br>
DKIM_VALID,DKIM_VALID_AU,DKIM_VERIFIED,HTML_MESSAGE,
<br>
T_KAM_HTML_FONT_INVALID,T_REMOTE_IMAGE autolearn=no
autolearn_force=no
<br>
version=3.4.2
<br>
</blockquote>
<br>
strange, BAYES_99+BAYES_999 scores 3.7
<br>
DKIM_VALID,DKIM_VALID_AU and DKIM_VERIFIED substract only 0.3
points
<br>
<br>
try setting sa_tag_level_deflt to 'undef' and you can see scores
of those
<br>
rules...
<br>
<br>
</blockquote>
Well, I changed the sa_tag_level_deflt to 'undef', it was at
'-9999'. <br>
A few got in and it appears no difference in the headers. <br>
Here is one<br>
----------------------------------------------------------------------------------------------<br>
<pre>X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on
myserver.mydomain.com
X-Spam-Level: **
X-Spam-Status: No, score=2.3 required=4.0 tests=BAYES_99,BAYES_999,DKIM_SIGNED,
DKIM_VALID,DKIM_VALID_AU,DKIM_VERIFIED,HTML_FONT_LOW_CONTRAST,
HTML_MESSAGE,KAM_SHORT,URIBL_BLACK autolearn=no autolearn_force=no
version=3.4.2
Received: from arena.catherinepoolerink.com (arena.catherinepoolerink.com [65.181.122.153])
by myserver.com (Postfix) with ESMTP id 23E2860B3A
for <a class="moz-txt-link-rfc2396E" href="mailto:emailuser@domain.org"><emailuser@domain.org></a>; Thu, 1 Aug 2019 09:32:08 -0500 (CDT)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=a4ier; d=catherinepoolerink.com;
h=From:MIME-Version:Message-ID:Reply-To:Subject:To:Content-Type:Date;
<a class="moz-txt-link-abbreviated" href="mailto:i=henry@catherinepoolerink.com">i=henry@catherinepoolerink.com</a>;
</pre>
----------------------------------------------------------------------------------------------<br>
when I ran the mail via: <br>
$ su amavis -c "spamassassin -D < mailtest" <br>
I get:<br>
--------------------------<br>
Content analysis details: (18.0 points, 4.0 required)<br>
<br>
pts rule name description<br>
---- ----------------------
--------------------------------------------------<br>
3.5 BAYES_99 BODY: Bayes spam probability is 99 to
100%<br>
[score: 1.0000]<br>
0.2 BAYES_999 BODY: Bayes spam probability is 99.9 to
100%<br>
[score: 1.0000]<br>
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the
Spamhaus DBL<br>
blocklist<br>
[URIs: catherinepoolerink.com]<br>
1.2 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE
SURBL<br>
blocklist<br>
[URIs: catherinepoolerink.com]<br>
1.7 URIBL_BLACK Contains an URL listed in the URIBL
blacklist<br>
[URIs: catherinepoolerink.com]<br>
0.0 HTML_MESSAGE BODY: HTML included in message<br>
0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or<br>
identical to background<br>
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not
necessarily<br>
valid<br>
0.9 RAZOR2_CHECK Listed in Razor2 (<a
class="moz-txt-link-freetext" href="http://razor.sf.net/">http://razor.sf.net/</a>)<br>
1.9 RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50%<br>
[cf: 100]<br>
5.0 KAM_VERY_BLACK_DBL Email that hits both URIBL Black and
Spamhaus<br>
DBL<br>
0.8 FSL_BULK_SIG Bulk signature with no Unsubscribe<br>
0.0 KAM_SHORT Use of a URL Shortener for very short
URL<br>
0.1 DKIM_INVALID DKIM or DK signature exists, but is not
valid<br>
-------------------------------------<br>
Again clearly spam according to Spamhaus and others .<br>
Something wrong not sure what.<br>
</body>
</html>