efa-project.org

Hi team,

I am having instances where a bulk spam email is being marked correctly as spam, and then a few minutes later when it reaches other recipients inside the organisation, it is being marked as clean and allowed through.

I've checked the spam report, and the difference is that the later emails have a negative AWL score which then allows it through. For example:

-1.32 AWL Adjusted score from AWL reputation of From: address

I've seen it the other way around before (clean emails first, detected as spam later) but not the other way around. Are there any suggestions on how to resolve/avoid this?

Thanks.

EDIT: Apologies for posting in the wrong board, this is corrected now and old one deleted.


Later emails:

That score is being generated by the spamassassin autowhitelist plugin.

Some reasons it might be going wrong.

Now that I am looking, it seems this plugin is not giving me any results on my system, so I cannot test and verify what it is doing until I resolve that issue.

Can someone run a "SpamAssassun Rule Hits" report under "Search and Reports" for me and tell me if you have any entries for AWL or TXREP and what your results are?

It's supposed to be enabled by default, but it doesn't seem to be doing anything on my system, so I'd like to make a comparison.

My reports return nothing for these two SA rules which is unexpected.

jup wrote: 22 Oct 2018 15:02 I've checked the spam report, and the difference is that the later emails have a negative AWL score which then allows it through. For example:
-1.32 AWL Adjusted score from AWL reputation of From: address

I'd be curious know what the AWL score is from the 6 messages you listed. Was the AWL score going down for each message?

Hi there,

Thanks for your replies.

I have a few hits on the AWL, but no listing for TXREP. See below:

In order of received (first received to last received):
AWL:Not Listed
AWL: Not Listed
AWL: -0.77
AWL: -1.32
AWL: -1.69
AWL: -1.94

All other scores are identical, except for the final SA score which is obviously reduced by the above values. The first two got captured as spam because they didn't have the AWL module downgrading it, however the next 4 get progressively more trusted by AWL.


Thanks.

Have you tried training the system with the spam that was misclassified?