I have a bit of an issue with a users inbox in that a lot of spam is getting through for him alone.
We use Amavis/Postfix and SA in our mail setup. Config setup like this:
Config: $sa_tag_level_deflt = 2.0; $sa_tag2_level_deflt = 6.2; $sa_kill_level_deflt = 8.0; $sa_dsn_cutoff_level = 10; $sa_crediblefrom_dsn_cutoff_level = 18; #$sa_quarantine_cutoff_level = 25; $penpals_bonus_score = 8; $penpals_threshold_high = $bounce_killer_score = 100;
Heres an example of some spam that is being picked up correctly:
X-Spam-Status: Yes, score=9.172 tagged_above=-2 required=6.2 tests=[BAYES_50=0.8, DOS_RCVD_IP_TWICE_B=0.001, FORGED_OUTLOOK_TAGS=0.052, FROM_12LTRDOM=2, FROM_OFFERS=2.699, HTML_MESSAGE=0.001, MIME_HTML_MOSTLY=0.428, MPART_ALT_DIFF=0.79, RDNS_NONE=0.793, SPF_HELO_SOFTFAIL=0.732, SPF_SOFTFAIL=0.665, TO_NO_BRKTS_MSFT=0.199, TO_NO_BRKTS_NORDNS=0.001, T_REMOTE_IMAGE=0.01,
lots of high scores as you can see pushing it well over the kill level (8). Heres a very typical example of some spam that is not being caught:
X-Spam-Status: No, score=1.484 tagged_above=-2 required=6.2 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, MPART_ALT_DIFF_COUNT=1.112, RCVD_IN_BRBL_LASTEXT=1.449, RDNS_NONE=0.793, SPF_PASS=-0.001, T_URIBL_SEM_FRESH=0.01, T_URIBL_SEM_FRESH_10=0.01, T_URIBL_SEM_FRESH_15=0.01] autolearn=no
The common theme in most of these is a low BAYES_00 score. Some seem really obvious as well
Return-Path: <email@example.com> X-Spam-Flag: NO X-Spam-Score: 2.488 X-Spam-Level: ** X-Spam-Status: No, score=2.488 tagged_above=-2 required=6.2 tests=[BAYES_00=-1.9, HTML_IMAGE_ONLY_32=0.001, HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.723, MORE_SEX=1.413, RCVD_IN_BRBL_LASTEXT=1.449, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01] autolearn=no From: "L o n g & H a r d" <firstname.lastname@example.org> MIME-Version: 1.0 Subject: How Men Like You Are Boosting Testosterone Message-ID: <GdeSiGuPRRZRwqRPfuK8Coieid3d24SeCz12i4o48mi4duRfPPqfqfPRwfuVVZZw@www123429.com>
Im not sure why this is happening for one user but not another? It seems like the only option here to train SA with a database of spam/ham. Has anyone any experience of this. If so what solution do you suggest?