Very different spam scoring with spamassasin 3 vs 4

[kidtriton]

When going from EFA 4 to EFA 5 I'm getting quite a few messages come through that used to be blocked as spam (they are unsolicited spam). I guess this is completely a function of the spamassasin version and settings, so just looking for suggestions on how to get these to score as spam.

Here's the scoring for an almost exact same message in EFA 4:

old.JPG (85.3 KiB) Viewed 5056 times

And in EFA 5:

new.JPG (115.84 KiB) Viewed 5056 times

[shawniverson]

Those mails may be similar but are not the same. Chances are the sender domain is not the same...

The second email hit RCVD_IN_DNSWL_HI, which is the bulk of the negative scoring

You also have some problems....

You have no Bayes scoring happening currently. You might need to retrain your Bayes DB.

You are being blocked by Validity and URIBL, so results of those lookups did not occur. Make sure you are using recursion for DNS lookups to avoid this problem, see the following topic for more info:

viewtopic.php?t=934

[kidtriton]

Those mails may be similar but are not the same. Chances are the sender domain is not the same...

The second email hit RCVD_IN_DNSWL_HI, which is the bulk of the negative scoring

You also have some problems....

You have no Bayes scoring happening currently. You might need to retrain your Bayes DB.

You are being blocked by Validity and URIBL, so results of those lookups did not occur. Make sure you are using recursion for DNS lookups to avoid this problem, see the following topic for more info:

viewtopic.php?t=934

Thanks!

They are separate emails but was just saying that they are similar enough that I feel like both should have been flagged as spam.

As far as the RCVD_IN_DNSWL_HI goes, almost every email that's coming through my new EFA 5 server is getting that -5. Is this something I might should disable?

The Bayes training, how does that work, this is a brand new installation so does it happen automatically over time or are you saying I need to spend some time manually doing the SA Learn for spam messages? Or am I totally wrong about how that works?

I fixed the Validity thing. I had recursion enabled, but had put in 8.8.8.8 so I changed the resolv.conf file to 127.0.0.1 and I'm not getting that blocked message for Validity anymore.

[shawniverson]

Is your eFa behind another smarthost or accepting email directly from the Internet?

Bayes doesn't kick in until at least 200 messages have been learned as spam or ham.

[kidtriton]

Is your eFa behind another smarthost or accepting email directly from the Internet?

Bayes doesn't kick in until at least 200 messages have been learned as spam or ham.

Sorry for the late reply, its not behind anything, it has a public IP. Accepts directly from Internet.

When I posted the original screenshots I think it was at less than 200 emails. It seems to be doing much better now.

[shawniverson]

That is good to hear!