spam score on beta

[nosrg]

All the emails I received after I switched over to the beta server had a X-Spam-score: of 0. Even the newsletters from dell has a spam score of 0. All the emails has been legit and not spams, but I was just wondering, Is this normal?

[mcowger]

As I understand it, it is normal.

[kander]

Yes, I think this is normal behaviour. If I remember correctly spam that has a negative spamscore (this is possible, because there are also factors that decrease the spamscore) are rounded up to 0.

--K

[petergh]

Are the addresses these mails are sent from present in your address book? If so, they are weighted by 10, which means that any other spam traits it may exhibit would have to add up to more than 10 SpamAssassin points before the overall score would be >0.

At least that's how it works on the new spam system... don't know if you've switched or not.

[sflorack]

I am noticing the same thing (spam score of 0 on ALL emails).

I've checked messages that come from people not in my address book (ie Barnes and Noble) and it's still a 0.

This is certainly a problem!

[robmueller]

It's not a problem if the email isn't spam, it should have a score of 0!

Have you got examples of emails that are definitely spam, but still have a score of 0?

Rob

[sflorack]

I forwarded a few spam messages I've received at a Yahoo account to FastMail. Messages that Yahoo had sent to the Bulk Folder receive a score of 0 in FastMail. I'd post the subjects of the messages here, but I'm not sure most are appropriate for all to see. (I picked the most obvious of spam...)

I did get 2 messages out of 10 (all from Yahoo's bulk folder and contained rather obscene wordings, etc) to report any kind of spam level at all: one message had a score of 11.4, and the other at 8.1.

Strangely, the 11.4 message was appropriately labeled with a subject change, and displayed {SPAM 11.4}, however, it failed the other rule that is suppose to move messages over a scpre of 10 to the Junk Folder. (I assume this has to do with the 3 decimal spam score still being used on the beta server.)

Shall I post actual messages with headers here?

[nosrg]

Forwarded few spam emails from my school's account (main reason why I use fastmail.fm, 1. spam control and 2. I dont' have a stupid number after my username)...

There are few emails like this... They all have very low spam scores........

X-Spam says it's high at 1.762? Are my emails been checked by both beta and reg mail servers?
So far, I noticed that all X-Spam high emails have been spams but the X-Spam score varies from 1 - 5 on spam mails.


Maybe it's cuz I forwarded through my school's email? does SA do any kinda checking like on how the email was received or just contents?


Return-Path: <****@uic.edu>
Received: from server3.fastmail.fm (server3.internal [10.202.2.134])
by server2.fastmail.fm (Cyrus v2.1.9) with LMTP; Thu, 02 Oct 2003 15:09:34 -0400
X-Sieve: CMU Sieve 2.2
X-Spam-hits: BAYES_44, HTML_60_70, HTML_IMAGE_ONLY_02, HTML_MESSAGE, MIME_HTML_ONLY
X-Spam-score: 1.762
X-Spam: high
X-Virus-checked: Yes
X-Resolved-to: ****@sent.com
X-Mail-from: ****@uic.edu
Received: from mail.messagingengine.com (localhost [127.0.0.1])
by localhost.localdomain (Postfix) with ESMTP id AB329258B20
for <****@sent.com>; Thu, 2 Oct 2003 15:09:32 -0400 (EDT)
Received: from 10.202.2.150 ([10.202.2.150] helo=mail.messagingengine.com) by messagingengine.com
with SMTP; Thu, 02 Oct 2003 15:09:32 -0400
X-Mail-from: ****@uic.edu
X-Delivered-to: <****@sent.com>
Received: from birch.cc.uic.edu (birch.cc.uic.edu [128.248.155.162])
by mail.messagingengine.com (Postfix) with SMTP id 7FEC8257A72
for <****@sent.com>; Thu, 2 Oct 2003 15:09:32 -0400 (EDT)
Received: (qmail 21817 invoked from network); 2 Oct 2003 14:09:28 -0500
Received: from webmail.cc.uic.edu (HELO webmail.uic.edu) (128.248.121.50)
by birch.cc.uic.edu with SMTP; 2 Oct 2003 14:09:28 -0500
X-WebMail-UserID: ****@uic.edu
Date: Thu, 2 Oct 2003 14:08:01 -0500
Sender: *<****@uic.edu>
From: *<****@uic.edu>
To: ****@sent.com
X-EXP32-SerialNo: 50000146
Subject: Get your Prescriptions Meds filled online
Message-ID: <3FA680CA@webmail.uic.edu>
Mime-Version: 1.0
Content-Type: text/html; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
X-Mailer: InterChange (Hydra) SMTP v3.62

<HTML>
<BODY>
<P align=center><a href="http://www.fast100.com/find.html">
<IMG id=IMG1 src="http://www.fast100.com/icons/brown.gif"
border=0></a><br></P>
<P align=center><a href="http://www.fast100.com/something.html">
<IMG height=71 src="http://www.fast100.com/icons/bottom.gif" width=591
border=0></a></P>
wlva2^hvp(rqhhsfvujimvgvfoycanbngpdspjkkqmkmtgtpbexpchnhxnjydlojbtfsdreveqkywf
qblrqnbfuyugaxrokvkpqnj
</BODY>
</HTML>

Another one, I am not too worried about this one cuz it has a 4.8 score... But still...

Return-Path: <****@uic.edu>
Received: from server3.fastmail.fm (server3.internal [10.202.2.134])
by server2.fastmail.fm (Cyrus v2.1.9) with LMTP; Thu, 02 Oct 2003 15:08:43 -0400
X-Sieve: CMU Sieve 2.2
X-Spam-hits: BAYES_56, BIZ_TLD, HTML_50_60, HTML_MESSAGE, MIME_HTML_ONLY,
OBFUSCATING_COMMENT
X-Spam-score: 4.821
X-Spam: high
X-Virus-checked: Yes
X-Resolved-to: ****@sent.com
X-Mail-from: ****@uic.edu
Received: from mail.messagingengine.com (localhost [127.0.0.1])
by localhost.localdomain (Postfix) with ESMTP id 9E5E82525D3
for <****@sent.com>; Thu, 2 Oct 2003 15:08:42 -0400 (EDT)
Received: from 10.202.2.150 ([10.202.2.150] helo=mail.messagingengine.com) by messagingengine.com
with SMTP; Thu, 02 Oct 2003 15:08:42 -0400
X-Mail-from: ****@uic.edu
X-Delivered-to: <****@sent.com>
Received: from birch.cc.uic.edu (birch.cc.uic.edu [128.248.155.162])
by mail.messagingengine.com (Postfix) with SMTP id 3F1F725A3C3
for <****@sent.com>; Thu, 2 Oct 2003 15:08:42 -0400 (EDT)
Received: (qmail 21668 invoked from network); 2 Oct 2003 14:08:37 -0500
Received: from webmail.cc.uic.edu (HELO webmail.uic.edu) (128.248.121.50)
by birch.cc.uic.edu with SMTP; 2 Oct 2003 14:08:37 -0500
X-WebMail-UserID: ****@uic.edu
Date: Thu, 2 Oct 2003 14:07:07 -0500
Sender: * <****@uic.edu>
From: *<****@uic.edu>
To:****@sent.com
X-EXP32-SerialNo: 50000146
Subject: DISCREET OVERNIGHT PHARMACY! mvpr ilufzs i lod
Message-ID: <3FA67FB9@webmail.uic.edu>
Mime-Version: 1.0
Content-Type: text/html; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable
X-Mailer: InterChange (Hydra) SMTP v3.62

<html>

<head>

<meta http-equiv=3D3D"Content-Type" content=3D3D"text/html; charset=3D3Dwindows-=3D
1252">
</head>

<body>

<p><b>
<font color=3D3D"#9933FF" lang=3D3D"0" face=3D3D"Arial" FAMILY=3D3D"SANSSERIF" PTS=3D
IZE=3D3D"10">
Wholesale Prescription Medications</font></b><font lang=3D3D"0" face=3D3D"Aria=3D
l" size=3D3D"2" FAMILY=3D3D"SANSSERIF" PTSIZE=3D3D"10"><br>
<br>
Our Doctors will write <!wipe> your Prescription<br>
You pay only the wholesale price on your Medication.<br>
<br>
<b>DISCREET<!conner> OVERNIGHT PHARMACY! </b></font></p>
<p><font lang=3D3D"0" face=3D3D"Arial" size=3D3D"2" FAMILY=3D3D"SANSSERIF"
PTSIZE=3D3D=3D
"10">Now get
Vicodin! <br>
Pain rel<!calder>ief, Women's health<br>
Phenter<!ix>ine, Celebrex,Ortho tri-cyclen<br>
Meridia,Tram<!christoph>adol,Nordette 28<br>
Xenical,Ultram,Menopro<br>
Anti-depressants,Men's health Enha<!brighton>ncement<br>
Prozac, Viagr@ BustPro<br>
Zoloft Prop<!apse>ecia V-pro<br>
<br>
And many many more<br>
<br>
All Medic<!conclusive>ations Prescribed & Delivered Overn<!=3D
ectoderm>ight<br>
Bottom Prices - No Prior Presc<!bloke>ription Required<br>
<a title=3D3D"http://www.medsusa.biz/web/" target=3D3D"_blank" href=3D3D"http://=3D
www.pharmacydepot.biz/webstore/">
http://www.pharmacydepot.biz/webstore/</a><br>
<br>
<br>
Get off this news<!asthma>letter:<br>
<a title=3D3D"http://www.medsusa.biz/a.html" target=3D3D"_blank" href=3D3D"http:=3D
//www.pharmacydepot.biz/a.html">
here</a><br>
=FF</font></p>

</body>

</html>
cllgbsrqe cufhpaybl eb xlh z

[sflorack]

Rob, can you continue addressing this issue?

Otherwise, I'd prefer rolling back to the old spam filters.

[nosrg]

the good news is, all the non-spam emails I received so far has a x-spam-score of 0. I set the filter score to 1.5 and rejecting them up to 4.5, then ignoring the rest cuz they are surely spams after 4.5 (100% sure for me on beta).

[sflorack]

I have no problems with the low scores if the mail in question isn't spam. However, when I sent myself spam from a yahoo account, the score remained at 0.

[robmueller]

Remember that the definition of 'spam' for you is more than just the text content of the message. There's the HTML tags used, the MIME layout of the message, the source IP address it came from, etc. So saying that the score is low despite sending yourself some spam is not really accurate, since you're not sending yourself truly representative spam.

Anyway, if you login to the non-beta server and go to Options -> Account Preferences and set the Spam Protection to a non-zero value, then spam checking will be done on both the frontend and backend server. You should then see in each email:

X-Spam:

and

X-Remove-Spam:

headers. This will let you compare the old and new spam filter to see if the old filter would actually have done any better.

So do this, and if you receive a spam with a low score again, post the headers again, and we'll be able to see if there really would be a difference.

Rob

[sflorack]

Maybe I'm missing something here.

When I go through the old server and set the spam protection to value to a non-zero value, the spam scores end up being the same (or similar) for X-Spam and X-Remove-Spam fields. (Good!)

However, when I go back to the old server and set the spam protection BACK to zero, I'm getting a zero value on the X-Spam fields again. (I even sent myself a same message that returned a positive score in the past test.)

To my knowledge, it shouldn't work this way...

[robmueller]

No, it definitely shouldn't work that way, and that sounds very odd indeed. I'll have a look in your account if you don't mind to see what's going on...

Rob

[sflorack]

Please do!