1

Topic: Spam suddenly scored very low

============ Required information ====
- iRedMail version: iRedMail-0.9.0
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Web server (Apache or Nginx): Apache
- Linux/BSD distribution name and version: Ubuntu 14.04
- Related log if you're reporting an issue:
====

Hi All,

I have had my new server with iRedMail 0.9.0 running for about 2 months now.  Initially I was thrilled with how much better it was working vs. my home grown install, especially when it comes to detecting spam effectively.  About two weeks ago though I experienced a sudden drop in spam detection.  I updated my configuration to add spam headers to all mails and I can see that they are still being marked but are just scoring very low.  Previously ~ 65% of my emails to two accounts were correctly identified as spam.  That number has now fallen to < 10% and you can see from the attached graph that the drop was sudden on 5/30.

I have not altered the default spam settings other than to force headers in all mails.  Recent undetected spam headers look like this:

--
X-Spam-Flag: NO
X-Spam-Score: 0.294
X-Spam-Level:
X-Spam-Status: No, score=0.294 tagged_above=-9999 required=6.31
    tests=[BAYES_05=-0.5, HTML_MESSAGE=0.001, RDNS_NONE=0.793]
    autolearn=no autolearn_force=no
--

--
X-Spam-Flag: NO
X-Spam-Score: 3.737
X-Spam-Level: ***
X-Spam-Status: No, score=3.737 tagged_above=-9999 required=6.31
    tests=[BAYES_60=1.5, DKIM_SIGNED=0.1, HTML_IMAGE_RATIO_06=0.001,
    HTML_MESSAGE=0.001, MIME_HTML_ONLY=0.723, MISSING_MID=0.497,
    RDNS_NONE=0.793, SPF_HELO_NEUTRAL=0.112, T_DKIM_INVALID=0.01]
    autolearn=no autolearn_force=no
--

And from one that was successfully matched today:

--
X-Spam-Flag: YES
X-Spam-Score: 7.141
X-Spam-Level: *******
X-Spam-Status: Yes, score=7.141 tagged_above=-9999 required=6.31
    tests=[AC_SPAMMY_URI_PATTERNS10=2.353, BAYES_50=0.8,
    HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, HTML_OFF_PAGE=1,
    RDNS_NONE=0.793, THIS_AD=2.183, T_REMOTE_IMAGE=0.01]
    autolearn=no autolearn_force=no
--

I'm not sure what steps to take to identify why this change has occurred and appreciate any pointers.  Would like to get the effectiveness of the spam filtering back to where it was!

Thanks,
~ Bill

Post's attachments

SpamMatching.png
SpamMatching.png 19.38 kb, 1 downloads since 2015-06-13 

You don't have the permssions to download the attachments of this post.

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: Spam suddenly scored very low

Weird.

*) Do you have cron 'CRON=1' in file /etc/default/spamassassin?
*) Did you modify /etc/mail/spamassassin/local.cf?

3

Re: Spam suddenly scored very low

ZhangHuangbin wrote:

Weird.

*) Do you have cron 'CRON=1' in file /etc/default/spamassassin?
*) Did you modify /etc/mail/spamassassin/local.cf?

Yes - I have CRON=1 in the /etc/default/spamassassin file, it's the very last line.

No - I have not modified /etc/mail/spamassassin/local.cf, it is the default from the install.

I did modify /etc/amavis/conf.d/50-user to set '$sa_tag_level_deflt = -9999' to get headers added to every mail when I started troubleshooting this issue.

~ Bill

4

Re: Spam suddenly scored very low

No idea. Maybe it's caused by updated SpamAssassin rules.

Did you modify any other configuration files?

5

Re: Spam suddenly scored very low

ZhangHuangbin wrote:

No idea. Maybe it's caused by updated SpamAssassin rules.

Did you modify any other configuration files?

Especially on 29th of Mai.