More unfiltered spam after 3.0.1.9 update

[grant]

anyone else experiencing this symptom or knows a fix?

Many thanks

[shawniverson]

What does the report say on one of the messages?

[grant]

Spam Report:
Score Matching Rule Description
0.80 BAYES_50 Bayes spam probability is 40 to 60%
1.10 DCC_CHECK Detected as bulk mail by DCC (dcc-servers.net)
0.00 FOUND_YOU I found you...
0.00 FROM_WORDY From address looks like a sentence
0.00 HTML_FONT_LOW_CONTRAST HTML font color similar or identical to background
0.00 HTML_MESSAGE HTML included in message
0.75 KAM_INFOUSMEBIZ Prevalent use of .info|.us|.me|.me.uk|.biz domains in spam/malware
0.79 RDNS_NONE Delivered to internal network by a host with no rDNS
0.01 T_HTML_TAG_BALANCE_CENTER Malformatted HTML
0.01 T_REMOTE_IMAGE Message contains an external image
0.01 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)
0.01 T_SPF_TEMPERROR SPF: test of record failed (temperror)

[shawniverson]

So total score is 3.48. If your minimum spam score is 4, it just fell a little short. I don't think this is result of the 3.0.1.9 update, but rather the result of a recent SA update scoring change upstream. These often fluctuate over time.

You can do a few things here.

1) Lower your spam score minimum (at risk of more false positives)

2) Override SA scores for one or more items in local.cf (my favorite approach)

For example, I personally don't accept mail from hosts without a rDNS record, so I could add my own score to /etc/mail/spamassassin/local.cf

score RDNS_NONE 4.0

3) Keep training bayes. This message has 40-60% probability, so continuing to feed bayes spam will increase spam probablility on these types of messages.

[grant]

Thank you so much for the follow up.
I went back to an older efa version.

[shawniverson]

Which version are you using that is not causing problems (I would like to run a code comparison)?

[grant]

v 3.0.1.5

[shawniverson]

Major difference between 3.0.1.5 and newer is postfix. I'm not sure how this could impact SA scoring...still looking into this.

[grant]

Let me clone this version since it's working properly. I will then update it and see if problem persists. I hate to see you wasting your time on something obsolete.

[grant]

3.0.2.1 fixed all pending issues for me.

Thank you so much!!