LinuxQuestions.org - Exim4/ sa-exim/Spamassassin - Flags as Spam but Still Accepts

- Linux - Software (https://www.linuxquestions.org/questions/linux-software-2/)

- - Exim4/ sa-exim/Spamassassin - Flags as Spam but Still Accepts (https://www.linuxquestions.org/questions/linux-software-2/exim4-sa-exim-spamassassin-flags-as-spam-but-still-accepts-246105/)

Exim4/ sa-exim/Spamassassin - Flags as Spam but Still Accepts

Hello All....

I've sucessfully set up Spamassassin on my Debian box with exim4 (I've installed sa-exim as well). SA is running, I know so because I can watch it in exim4's mainlog and the X headers are appearing in my delivered emails. It is rejecting some emails outright (those with a score of 17 is what I've seen so far) but letting ones with scores like 7.5 through even though they are marked as spam. Here's the applicable headers from one that got delivered to me:

Code:

X-SA-Exim-Connect-IP 63.241.65.15  

From Jon Watson <munged@munged.com>              

 

Subject WINNING NOTIFICATION.  

X-Spam-Flag YES  

X-Spam-Checker-Version SpamAssassin 3.0.0 (2004-09-13) on theheatsinkbbs  

X-Spam-Level *******  

X-Spam-Status Yes, score=7.5 required=5.0 tests=AWL,MILLION_USD,

NIGERIAN_BODY1,NIGERIAN_BODY2,NIGERIAN_BODY3,SUBJ_ALL_CAPS,

UNCLAIMED_MONEY,US_DOLLARS_3 autolearn=no version=3.0.0  

Content-Type multipart/mixed; boundary="----------=_41790D6E.959EFB98"  

X-SA-Exim-Version 4.1 (built Tue, 17 Aug 2004 11:06:07 +0200)  

X-SA-Exim-Scanned Yes (on theheatsinkbbs)

As you can see in the X-Spam-Status header, SA has determined (correctly) that this message is spam yet it still delivered it to me.

I am aware of the threshold setting (which you can see I have set to 5), but is there some other setting that I'm missing? Something like "anything between 5 and 10 still deliver to me?"

I've looked in the docs and I've given up on the wiki at the Spamassassin site (man I hate Wiki software). Does anyone have any ideas?

Thanks!

Jon:Pengy:

Aha...I think I got it.....

It seems (initial tests bear this out), that the lower threshold where messages will be marked as spam is the required_hits in the local.cf file. The upperthreshold where mail stops being delivered even if it is spam is the SApermreject value in the sa-exim.conf file.

To recap if anyone else is looking for this info, if required_hits is 5.0 and SApermreject is 12.0 then:

All messages with scores under 12.0 will be delivered
Messages with scores under 5.0 will not be marked as spam (X-Spam-Flag: NO)
Messages with scores between 5.1 and 12.0 will be marked as spam (X-Spam-Flag: YES)
Messages with scores higher than 12.0 will not be delivered.

HTH

Jon

Quote:

Originally posted by heatsink
Aha...I think I got it.....

It seems (initial tests bear this out), that the lower threshold where messages will be marked as spam is the required_hits in the local.cf file. The upperthreshold where mail stops being delivered even if it is spam is the SApermreject value in the sa-exim.conf file.

To recap if anyone else is looking for this info, if required_hits is 5.0 and SApermreject is 12.0 then:

All messages with scores under 12.0 will be delivered
Messages with scores under 5.0 will not be marked as spam (X-Spam-Flag: NO)
Messages with scores between 5.1 and 12.0 will be marked as spam (X-Spam-Flag: YES)
Messages with scores higher than 12.0 will not be delivered.

HTH

Jon

OK...still screwed...

Where do I set the score at which Spamassassin will reject an email? I thought it was in local.cf (where it was set to 5.0) but when I set this value to 3.0, the score header on emails still reads that 5.0 is required.

Anyone?

Quote:

Originally posted by heatsink
OK...still screwed...

Where do I set the score at which Spamassassin will reject an email? I thought it was in local.cf (where it was set to 5.0) but when I set this value to 3.0, the score header on emails still reads that 5.0 is required.

Anyone?

Once again I answer my own post...man....I'm the BEST!

At some point, probably many weeks ago, I made an error in the local.cf file. I changed required_hits 5.0 to required_hits=5.0 (notice the = sign). This is incorrect and spamassassin ignores it. However, it doesn't tell you it ignores it...it just does.

I stumbled across a nifty command called spamassassin --lint that parses the various cf files and tells you if there are errors. Try it, you'll like it.

Thanks Jon.

You're welcome Jon.

no

sa-exim.so is controlling delivery by The upperthreshold where mail stops being delivered even if it is spam is the SApermreject value in the sa-exim.conf file.

not the sa local.cf