AWL Spam

General eFa discussion
Post Reply
jup
Posts: 2
Joined: 21 Oct 2018 16:11

AWL Spam

Post by jup »

Hi team,

I am having instances where a bulk spam email is being marked correctly as spam, and then a few minutes later when it reaches other recipients inside the organisation, it is being marked as clean and allowed through.

I've checked the spam report, and the difference is that the later emails have a negative AWL score which then allows it through. For example:

-1.32 AWL Adjusted score from AWL reputation of From: address

I've seen it the other way around before (clean emails first, detected as spam later) but not the other way around. Are there any suggestions on how to resolve/avoid this?

Thanks.

EDIT: Apologies for posting in the wrong board, this is corrected now and old one deleted.


Later emails:
messagelisting1.png
messagelisting1.png (38.25 KiB) Viewed 7402 times
Attachments
ml1.PNG
ml1.PNG (31.72 KiB) Viewed 7402 times
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: AWL Spam

Post by pdwalker »

That score is being generated by the spamassassin autowhitelist plugin.

Some reasons it might be going wrong.

Now that I am looking, it seems this plugin is not giving me any results on my system, so I cannot test and verify what it is doing until I resolve that issue.
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: AWL Spam

Post by pdwalker »

Can someone run a "SpamAssassun Rule Hits" report under "Search and Reports" for me and tell me if you have any entries for AWL or TXREP and what your results are?

It's supposed to be enabled by default, but it doesn't seem to be doing anything on my system, so I'd like to make a comparison.

My reports return nothing for these two SA rules which is unexpected.
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: AWL Spam

Post by pdwalker »

jup wrote: 22 Oct 2018 15:02 I've checked the spam report, and the difference is that the later emails have a negative AWL score which then allows it through. For example:
-1.32 AWL Adjusted score from AWL reputation of From: address
I'd be curious know what the AWL score is from the 6 messages you listed. Was the AWL score going down for each message?
jup
Posts: 2
Joined: 21 Oct 2018 16:11

Re: AWL Spam

Post by jup »

Hi there,

Thanks for your replies.

I have a few hits on the AWL, but no listing for TXREP. See below:
awl.PNG
awl.PNG (100.14 KiB) Viewed 7379 times


In order of received (first received to last received):
AWL:Not Listed
AWL: Not Listed
AWL: -0.77
AWL: -1.32
AWL: -1.69
AWL: -1.94

All other scores are identical, except for the final SA score which is obviously reduced by the above values. The first two got captured as spam because they didn't have the AWL module downgrading it, however the next 4 get progressively more trusted by AWL.


Thanks.
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: AWL Spam

Post by pdwalker »

Have you tried training the system with the spam that was misclassified?
Post Reply