Mailscanner and manual SA run differ, how come?

Report bugs and workarounds
Post Reply
ovizii
Posts: 463
Joined: 11 May 2016 08:08

Mailscanner and manual SA run differ, how come?

Post by ovizii »

I have an email which shows these scores inside the EFA interface:

Code: Select all

Spamassassin Score:	20.35
Spam Report:	
Score	Matching Rule	Description
2.50	BAYES_50	Bayes spam probability is 40 to 60%
2.50	BAYES_BL	Bayes Blacklist everything above 40%
-0.45	BOTNET_SERVERWORDS	Hostname contains server-like substrings
0.15	C_RBL_CBL_CN	Listed in cbl.anti-spam.org.cn
2.00	C_RBL_DNSBL_INPS_DE	Received via a relay in inps.de DNSBL
1.80	C_RBL_HOSTKARMA_BL	Sender listed in HOSTKARMA-BLACK
0.60	C_RBL_JUSTSPAM	Listed in dnsbl.justspam.org
0.70	C_RBL_NIX	Listed in NiX Spam
0.95	C_RBL_UCE1	Listed in dnsbl-1.uceprotect.net
0.15	C_RBL_UNSUBSCORE	Listed in ubl.unsubscore.com
2.10	FREEMAIL_FORGED_REPLYTO	Freemail in Reply-To, but not From
1.02	MISSING_HEADERS	Missing To: header
1.39	PYZOR_CHECK	Listed in Pyzor (http://pyzor.sf.net/)
1.00	RCVD_IN_FMBBL	Relay in FMBLA
0.00	RCVD_NOT_IN_IPREPDNS	Sender not listed at http://www.chaosreigns.com/iprep/
1.55	REPLYTO_WITHOUT_TO_CC	Reply-To: header exists, but no one CC'd
1.40	SENDERSCORE_018	SenderScore Reputation 18% (score.senderscore.com)
0.50	SENDERSCORE_BLACK	SenderScore Reputation Black (score.senderscore.com)
0.00	SPF_FAIL	SPF: sender does not match SPF record (fail)
0.49	TXREP	Score normalizing based on sender's reputation
I was wondering why it didn't trigger the RelayCountry plugin so I piped it through manually:

Code: Select all

spamassassin -t /var/spool/MailScanner/quarantine/20160704/spam/A4729101028.A2854
.
.
.
Content analysis details:   (29.0 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 1.8 C_RBL_HOSTKARMA_BL     RBL: Sender listed in HOSTKARMA-BLACK
                     [153.149.229.140 listed in hostkarma.junkemailfilter.com]
 0.1 C_RBL_UNSUBSCORE       RBL: Listed in ubl.unsubscore.com
                            [153.149.229.140 listed in ubl.unsubscore.com]
 1.0 RCVD_IN_FMBBL          RBL: Relay in FMBLA
                            [153.149.229.140 listed in bl.fmb.la]
 0.9 C_RBL_UCE1             RBL: Listed in dnsbl-1.uceprotect.net
                            [153.149.229.140 listed in dnsbl-1.uceprotect.net]
 0.1 C_RBL_CBL_CN           RBL: Listed in cbl.anti-spam.org.cn
                            [153.149.229.140 listed in cbl.anti-spam.org.cn]
 0.6 C_RBL_JUSTSPAM         RBL: Listed in dnsbl.justspam.org
                            [153.149.229.140 listed in dnsbl.justspam.org]
 0.7 C_RBL_NIX              RBL: Listed in NiX Spam
                            [153.149.229.140 listed in ix.dnsbl.manitu.net]
 0.8 IXHASH_GENERIC         SPAM Hash of message found in (generic.ixhash.net)
 1.5 RELAYCOUNTRY_BAD       Relayed through dodgy countries at some point
 3.4 IXHASH_FMBLA           SPAM Hash of message found in (ix.fmb.la)
 1.4 SENDERSCORE_018        RBL: SenderScore Reputation 18%
                            (score.senderscore.com)
                            [153.149.229.140 listed in score.senderscore.com]
 0.5 SENDERSCORE_BLACK      RBL: SenderScore Reputation Black
                            (score.senderscore.com)
 2.0 C_RBL_DNSBL_INPS_DE    RBL: Received via a relay in inps.de DNSBL
                            [153.149.229.140 listed in dnsbl.inps.de]
-0.5 BOTNET_SERVERWORDS     Hostname contains server-like substrings
           [botnet_serverwords,ip=153.149.229.140,rdns=gfdefer007.mail.goo.jp]
 1.0 MISSING_HEADERS        Missing To: header
 2.5 BAYES_50               BODY: Bayes spam probability is 40 to 60%
                            [score: 0.5001]
 2.5 BAYES_BL               BODY: Bayes Blacklist everything above 40%
                            [score: 0.5001]
 1.4 PYZOR_CHECK            Listed in Pyzor (http://pyzor.sf.net/)
 0.0 RCVD_NOT_IN_IPREPDNS   Sender not listed at
                            http://www.chaosreigns.com/iprep/
 3.5 _jacob_HASHY           Hits more than 2 hashes
 1.6 REPLYTO_WITHOUT_TO_CC  Reply-To: header exists, but no one CC'd
 2.1 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
Can anyone explain the difference?
Post Reply