Topic: Spam Assassin False Positives

[Smitro]

Can someone help me out? I have a user complaining that SA is getting a lot of false positives for a couple of people that sends mail to them. I have set my restrictions to 5 mark as spam and 9 Reject. This is from the log for one of the recent emails.

Code: [Select]

2008-03-19 19:42:04.447199500 [2902] info: spamd: connection from localhost [127.0.0.1] at port 57324
2008-03-19 19:42:04.520945500 [2902] info: spamd: checking message <47E0DFDE.2000702@bigpond.net.au> for qpsmtpd:1005
2008-03-19 19:42:23.090447500 [2902] info: spamd: identified spam (10.3/5.0) for qpsmtpd:1005 in 18.7 seconds, 84357 bytes.
2008-03-19 19:42:23.090779500 [2902] info: spamd: result: Y 10 - FUZZY_OCR,HTML_IMAGE_ONLY_16,HTML_IMAGE_RATIO_04,HTML_MESSAGE,MIME_HTML_ONLY scantime=18.7,size=84357,user=qpsmtpd,uid=1005,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=57324,mid=<47E0DFDE.2000702@bigpond.net.au>,autolearn=disabled

This person eventually complained, I noticed that when they forwarded the failure message through it still got flagged with:
HTML_IMAGE_ONLY_16,HTML_IMAGE_RATIO_04,HTML_MESSAGE
And it still got rated at 2.7

The other thing is that this particular email is coming from Bigpond (Biggest supplier of internet in Australia) so I don't think we could tell them to change their settings.

Other uses are quite happy with the spam filter, this user seems to be having trouble only with a couple of their friends sending email to them. Weird thing is it seems to be the same friends every time. Is there something I can suggest to help these people get email through? The person trying to send to my server is using Thunderbird for email, is there any options in there that could help them with the composing of emails?

Admittedly, this particular user's main use of email is to get jokes and other forwards from around the net (annoying I know).

Any thoughts?

[raem]

Smitro

Install the Email-wbl panel from dmay contrib area, and add them to the spamassassin whitelist,
http://distro.ibiblio.org/pub/linux/distributions/smeserver/contribs/dmay/smeserver/7.x/testing/smeserver-wbl/

or manually add them to the whitelist (or blacklist) with db commands.

To enter multiple addresses to White & Black lists
db spamassassin setprop wbl.global name@domain.com White *domain2.com White *domain3.com Black
(all on one line)
expand-template /etc/mail/spamassassin/local.cf
sv t /service/spamd

To review entries
db spamassassin show

To enter single address
db spamassassin setprop wbl.global name@domain.com White
db spamassassin setprop wbl.global badname@baddomain.com Black
expand-template /etc/mail/spamassassin/local.cf
sv t /service/spamd

To check the service is running
sv s /service/spamd

Email from addresses that are white listed will never be moved to the junkmail folder.
Email from addresses that are black listed will always be moved to the junkmail folder.

[Smitro]

Thanks Ray, Saved me some hassle once again!

[raem]

Smitro

That info is in the FAQ, it pays to read them fully.

http://wiki.contribs.org/SME_Server:Documentation:FAQ#The_entire_Sonoracomm_howto_from_Google.27s_text_cache