Mailing List Archive

Difference is score when mail is received by Postfix and when tested from the command line
Dear all

If I look at the score reported from within my mail client Thunderbird I
see this section:

X-Spam-Status: No, score=2.9 required=3.0 tests=BAYES_50,HTML_MESSAGE,

HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,SPF_HELO_PASS,URIBL_BLACK

autolearn=no autolearn_force=no version=3.4.2

If I run the same mail through spamc from the command line on the mail
server I see an output with a difference score. Why is that:

cat
/srv/vmail/..../tps/mail/cur/1633659838.M893539P31027......,S=5912,W=6108:2,Sc
| spamc -r

Spam detection software, running on the system "..............",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

the administrator of that system for details.

Content preview: The coolest and comfiest sandals to wear around the house,

or even at the office Everyone is talking about these colorful rubber shoes,

designed to ensure maximum comfort and stability. They are non- [...]

Content analysis details: (11.6 points, 2.0 required)

pts rule name description

---- ----------------------
--------------------------------------------------

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the Spamhaus DBL

blocklist

[URIs: jokepray.bar]

0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%

[score: 0.5000]

0.0 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)

[2.56.57.67 listed in bl.mailspike.net]

3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[2.56.57.67 listed in zen.spamhaus.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.2 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL

blocklist

[URIs: jokepray.bar]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URIs: jokepray.bar]

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

0.4 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML

tag

1.5 FROM_FMBLA_NEWDOM From domain was registered in last 7 days

Please note that I have lowered the required score from 3.0 to 2.0

Regards

Thomas S
Re: Difference is score when mail is received by Postfix and when tested from the command line [ In reply to ]
Hi Thomas, needing to lower your score to two or three implies To me that
your system could use some tweaking. In particular I would guess that your
Bayesian tokens need to be cleared.

As for the different scores, you would have to know the way that
spamassassin is being used on your system.

For example, you might be using postfix and amavis to check your mail flow
which can us a different configuration file then the command line
spamassassin program. If you're running the spamd, You could look to see
what configuration file it's using.

It also could be a case where you have changed the correct file and need to
reboot the service that is damonized to take effect with the new setting.

Regards, KAM
On Fri, Oct 8, 2021, 07:25 Thomas Seilund <tps@netmaster.dk> wrote:

> Dear all
>
> If I look at the score reported from within my mail client Thunderbird I
> see this section:
>
> X-Spam-Status: No, score=2.9 required=3.0 tests=BAYES_50,HTML_MESSAGE,
>
> HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,SPF_HELO_PASS,URIBL_BLACK
>
> autolearn=no autolearn_force=no version=3.4.2
>
> If I run the same mail through spamc from the command line on the mail
> server I see an output with a difference score. Why is that:
>
> cat
> /srv/vmail/..../tps/mail/cur/1633659838.M893539P31027......,S=5912,W=6108:2,Sc
> | spamc -r
>
> Spam detection software, running on the system "..............",
>
> has identified this incoming email as possible spam. The original
>
> message has been attached to this so you can view it or label
>
> similar future email. If you have any questions, see
>
> the administrator of that system for details.
>
> Content preview: The coolest and comfiest sandals to wear around the house,
>
> or even at the office Everyone is talking about these colorful rubber
> shoes,
>
> designed to ensure maximum comfort and stability. They are non- [...]
>
> Content analysis details: (11.6 points, 2.0 required)
>
> pts rule name description
>
> ---- ----------------------
> --------------------------------------------------
>
> 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the Spamhaus DBL
>
> blocklist
>
> [URIs: jokepray.bar]
>
> 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60%
>
> [score: 0.5000]
>
> 0.0 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)
>
> [2.56.57.67 listed in bl.mailspike.net]
>
> 3.3 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS
>
> [2.56.57.67 listed in zen.spamhaus.org]
>
> -0.0 SPF_HELO_PASS SPF: HELO matches SPF record
>
> 0.0 HTML_MESSAGE BODY: HTML included in message
>
> 0.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
>
> 1.2 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL
>
> blocklist
>
> [URIs: jokepray.bar]
>
> 1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist
>
> [URIs: jokepray.bar]
>
> 0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted
>
> 0.4 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML
>
> tag
>
> 1.5 FROM_FMBLA_NEWDOM From domain was registered in last 7 days
>
> Please note that I have lowered the required score from 3.0 to 2.0
>
> Regards
>
> Thomas S
>
Re: Difference is score when mail is received by Postfix and when tested from the command line [ In reply to ]
On 2021-10-08 13:24, Thomas Seilund wrote:

> X-Spam-Status: No, score=2.9 required=3.0 tests=BAYES_50,HTML_MESSAGE,

....

> autolearn=no autolearn_force=no version=3.4.2

X-Spam-Status: Yes, score=7.4 required=5.0
tests=DKIM_INVALID,DKIM_SIGNED,
HEADER_FROM_DIFFERENT_DOMAINS,HTML_MESSAGE,MAILING_LIST_MULTI,
RCVD_IN_DNSWL_HI,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_HELO_PASS,
SPF_PASS,TXREP,URIBL_ABUSE_SURBL,URIBL_AMI_DBLACK,URIBL_BLACK,
URIBL_CSS_A,URIBL_DBL_SPAM,URIBL_ZRD,USER_IN_DEF_SPF_WL autolearn=no
autolearn_force=no

your mail on spamassassin is spam :=)
Re: Difference is score when mail is received by Postfix and when tested from the command line [ In reply to ]
On 2021-10-08 13:32, Kevin A. McGrail wrote:
> Hi Thomas, needing to lower your score to two or three implies To me
> that your system could use some tweaking. In particular I would guess
> that your Bayesian tokens need to be cleared.

X-Spam-Status: Yes, score=7.0 required=5.0 tests=HTML_MESSAGE,
MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI,RCVD_IN_MSPIKE_H3,
RCVD_IN_MSPIKE_WL,SPF_HELO_PASS,SPF_PASS,TXREP,URIBL_ABUSE_SURBL,
URIBL_AMI_DBLACK,URIBL_BLACK,URIBL_CSS_A,URIBL_DBL_SPAM,URIBL_ZRD,
USER_IN_DEF_SPF_WL autolearn=no autolearn_force=no

you send spam to spamassassin maillist ?

i think Thomas have unstable dns results
Difference is score when mail is received by Postfix and when tested from the command line [ In reply to ]
Dear All

I see incomming mail that I would imagine that SA should classify as
spam but mail only gets a score of 2

When I run the same mail through spamc from the command line the score
is 11.8.

Why is the score not 11.8 when the mail is handled by Postfix/SA?

Pls. see details below.

Mail server is Debian Buster running Postfix and SA 3.4.2. SA is called
through a content filter in Postfix file master.cf

I have debug on spamd set up in /etc/default/spamassassin by the line
'OPTIONS="--debug --max-children=5 --username=vmail --nouser-config"'

After adding --debug and restarting SA with `sudo systemctl restart
spamassassin` I see a lot of debug info in /var/log/mail.log

I have run the mail through `spamc` using this command. Command and
output shown below:

sudo cat
/srv/vmail/netmaster.dk/tps/mail/cur/1633788457.M618066P6142.linode2.netmaster.dk,S=5989,W=6185:2,Sc
| spamc -R
11.8/5.0
Spam detection software, running on the system "linode2.netmaster.dk",
has identified this incoming email as possible spam.  The original
message has been attached to this so you can view it or label
similar future email.  If you have any questions, see
the administrator of that system for details.

Content preview:  The coolest and comfiest sandals to wear around the house,
   or even at the office Everyone is talking about these colorful
rubber shoes,
   designed to ensure maximum comfort and stability. They are non- [...]

Content analysis details:   (11.8 points, 5.0 required)

 pts rule name              description
---- ----------------------
--------------------------------------------------
 2.5 URIBL_DBL_SPAM         Contains a spam URL listed in the Spamhaus DBL
                            blocklist
                            [URIs: nerveoil.bar]
 1.9 URIBL_ABUSE_SURBL      Contains an URL listed in the ABUSE SURBL
                            blocklist
                            [URIs: nerveoil.bar]
 3.6 RCVD_IN_SBL_CSS        RBL: Received via a relay in Spamhaus SBL-CSS
                            [2.56.57.119 listed in zen.spamhaus.org]
 1.7 URIBL_BLACK            Contains an URL listed in the URIBL blacklist
                            [URIs: nerveoil.bar]
-0.0 SPF_HELO_PASS          SPF: HELO matches SPF record
 0.1 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
 0.0 HTML_MESSAGE           BODY: HTML included in message
 0.6 HTML_MIME_NO_HTML_TAG  HTML-only message, but there is no HTML
                            tag
 1.3 RDNS_NONE              Delivered to internal network by a host
with no rDNS
 0.1 PLING_QUERY            Subject has exclamation mark and question mark

The mail gets a score of 11.8 points.

But when the mail was first received by Postfix is was only given a
score of 2.

Why is the score different when Postfix sends mail to SA and when I do
it manually from the command line?

I have lines in /var/log/mail.log that shows the two cases. Command and
output below:

sudo egrep
"spamd:.*_SQOoqkxgTY1nD2P186QPi1PlOst4X14Ua3piV_tfAQ.zfy9tYggWkJI4WvbnWvvmtFGKPBGTxtWlYz5QVWDR5E@nerveoil.bar"
/var/log/mail.log
Oct  9 16:07:33 linode2 spamd[1009]: spamd: processing message
<_SQOoqkxgTY1nD2P186QPi1PlOst4X14Ua3piV_tfAQ.zfy9tYggWkJI4WvbnWvvmtFGKPBGTxtWlYz5QVWDR5E@nerveoil.bar>
for spamd:998
Oct  9 16:07:37 linode2 spamd[1009]: spamd: result: . 2 -
HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,PLING_QUERY,RDNS_NONE,SPF_HELO_PASS
scantime=3.5,size=5093,user=spamd,uid=998,required_score=5.0,rhost=::1,raddr=::1,rport=37770,mid=<_SQOoqkxgTY1nD2P186QPi1PlOst4X14Ua3piV_tfAQ.zfy9tYggWkJI4WvbnWvvmtFGKPBGTxtWlYz5QVWDR5E@nerveoil.bar>,autolearn=disabled
Oct  9 16:29:18 linode2 spamd[1008]: spamd: checking message
<_SQOoqkxgTY1nD2P186QPi1PlOst4X14Ua3piV_tfAQ.zfy9tYggWkJI4WvbnWvvmtFGKPBGTxtWlYz5QVWDR5E@nerveoil.bar>
for tps:998
Oct  9 16:29:20 linode2 spamd[1008]: spamd: result: Y 11 -
HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,PLING_QUERY,RCVD_IN_SBL_CSS,RDNS_NONE,SPF_HELO_PASS,URIBL_ABUSE_SURBL,URIBL_BLACK,URIBL_DBL_SPAM
scantime=2.8,size=5989,user=tps,uid=998,required_score=5.0,rhost=::1,raddr=::1,rport=37896,mid=<_SQOoqkxgTY1nD2P186QPi1PlOst4X14Ua3piV_tfAQ.zfy9tYggWkJI4WvbnWvvmtFGKPBGTxtWlYz5QVWDR5E@nerveoil.bar>,autolearn=disabled
Oct  9 16:30:30 linode2 spamd[1008]: spamd: checking message
<_SQOoqkxgTY1nD2P186QPi1PlOst4X14Ua3piV_tfAQ.zfy9tYggWkJI4WvbnWvvmtFGKPBGTxtWlYz5QVWDR5E@nerveoil.bar>
for tps:998

When I look in /var/log/mail.log I see that a lot of spamd output is
shown. I have extracted more details. Command and selected output below:

sudo egrep
"spamd:.*_SQOoqkxgTY1nD2P186QPi1PlOst4X14Ua3piV_tfAQ.zfy9tYggWkJI4WvbnWvvmtFGKPBGTxtWlYz5QVWDR5E@nerveoil.bar|score
so far=" /var/log/mail.log | less

Oct  9 16:07:33 linode2 spamd[1009]: spamd: processing message
<_SQOoqkxgTY1nD2P186QPi1PlOst4X14Ua3piV_tfAQ.zfy9tYggWkJI4WvbnWvvmtFGKPBGTxtWlYz5QVWDR5E@nerveoil.bar>
for spam
d:998
Oct  9 16:07:33 linode2 spamd[1008]: rules: running body tests; score so
far=-0.001
Oct  9 16:07:34 linode2 spamd[1008]: rules: running uri tests; score so
far=-0.001
Oct  9 16:07:34 linode2 spamd[1008]: rules: running body_eval tests;
score so far=-0.001
Oct  9 16:07:34 linode2 spamd[1008]: rules: running rawbody tests; score
so far=0.1
Oct  9 ................

Oct  9 16:07:37 linode2 spamd[1009]: rules: running meta tests; score so
far=0.1
Oct  9 16:07:37 linode2 spamd[1009]: spamd: result: . 2 -
HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,PLING_QUERY,RDNS_NONE,SPF_HELO_PASS
scantime=3.5,size=5093,user=spamd,uid=998,required_score=5.0,rhost=::1,raddr=::1,rport=37770,mid=<_SQOoqkxgTY1nD2P186QPi1PlOst4X14Ua3piV_tfAQ.zfy9tYggWkJI4WvbnWvvmtFGKPBGTxtWlYz5QVWDR5E@nerveoil.bar>,autolearn=disabled
Oct  9 16:29:18 linode2 spamd[1008]: spamd: checking message
<_SQOoqkxgTY1nD2P186QPi1PlOst4X14Ua3piV_tfAQ.zfy9tYggWkJI4WvbnWvvmtFGKPBGTxtWlYz5QVWDR5E@nerveoil.bar>
for tps:998
Oct  9 16:29:18 linode2 spamd[1008]: rules: running one_line_body tests;
score so far=8.006
Oct  9 16:29:18 linode2 spamd[1008]: rules: running head tests; score so
far=8.006
Oct  9 16:29:18 linode2 spamd[1008]: rules: running head_eval tests;
score so far=8.006
Oct  9 16:29:18 linode2 spamd[1008]: rules: running body tests; score so
far=8.006
Oct  9 16:29:18 linode2 spamd[1008]: rules: running uri tests; score so
far=8.006
Oct  9 16:29:18 linode2 spamd[1008]: rules: running body_eval tests;
score so far=8.006
Oct  9 16:29:18 linode2 spamd[1008]: rules: running rawbody tests; score
so far=8.006
O ......................

Oct  9 16:29:20 linode2 spamd[1008]: rules: running full tests; score so
far=9.806
Oct  9 16:29:20 linode2 spamd[1008]: rules: running meta tests; score so
far=9.806
Oct  9 16:29:20 linode2 spamd[1008]: spamd: result: Y 11 -
HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,PLING_QUERY,RCVD_IN_SBL_CSS,RDNS_NONE,SPF_HELO_PASS,URIBL_ABUSE_SURBL,URIBL_BLACK,URIBL_DBL_SPAM
scantime=2.8,size=5989,user=tps,uid=998,required_score=5.0,rhost=::1,raddr=::1,rport=37896,mid=<_SQOoqkxgTY1nD2P186QPi1PlOst4X14Ua3piV_tfAQ.zfy9tYggWkJI4WvbnWvvmtFGKPBGTxtWlYz5QVWDR5E@nerveoil.bar>,autolearn=disabled

Regards

Thomas S
Re: Difference is score when mail is received by Postfix and when tested from the command line [ In reply to ]
On 2021-10-09 17:39, Thomas Seilund wrote:

> sudo cat
> /srv/vmail/netmaster.dk/tps/mail/cur/1633788457.M618066P6142.linode2.netmaster.dk,S=5989,W=6185:2,Sc
> | spamc -R
> 11.8/5.0

if that works you are ready for using fuglu

eq example here shows that spamd works with your dns setup

have you overrided dns_servers in spamd local.cf ?

is you using bind ?

what settings is in /etc/resolv.conf ?

if you are not using fuglu i cant help more

sorry if your ipv6 is blacklisted in zen.spamhaus.com yesterday
Re: Difference is score when mail is received by Postfix and when tested from the command line [ In reply to ]
On 10/9/21 5:52 PM, Reindl Harald wrote:
>
>
> Am 09.10.21 um 17:39 schrieb Thomas Seilund:
>> Dear All
>>
>> I see incomming mail that I would imagine that SA should classify as
>> spam but mail only gets a score of 2
>>
>> When I run the same mail through spamc from the command line the
>> score is 11.8.
>>
>> Why is the score not 11.8 when the mail is handled by Postfix/SA?
>
>> Oct  9 16:07:37 linode2 spamd[1009]: spamd: result: . 2 -
>> HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,PLING_QUERY,RDNS_NONE,SPF_HELO_PASS
>
>> Oct  9 16:29:20 linode2 spamd[1008]: spamd: result: Y 11 -
>> HTML_MESSAGE,HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,PLING_QUERY,RCVD_IN_SBL_CSS,RDNS_NONE,SPF_HELO_PASS,URIBL_ABUSE_SURBL,URIBL_BLACK,URIBL_DBL_SPAM
>
> because 20 minutes later the sedning server itself was on
> RCVD_IN_SBL_CSS blacklist and some or more URLs in the message where
> on 3 different URI-Blacklists: URIBL_ABUSE_SURBL, URIBL_BLACK,
> URIBL_DBL_SPAM

Hi Reindl,

Thanks a lot.

Regards

Thomas S