Spam filtering weight calculations
Question asked by Anthony DePinto - January 17 at 7:49 AM
Unanswered
We upgraded to build 16.3.6586 and have noticed an increase in messages that have been making it into our customer's junk mail folders.  We have it set for 50 to delete, and 15 to move to junk mail.  I'm seeing lots of "15s" and some that look like below.  Where is the 16 being calculated?  I suspect this is more of the same with SPF checks.  We have it set to fail weight 30 and soft fail 10.
 
example 1:
X-CTCH-AVLevel: Unknown
X-SmarterMail-Spam: Bayesian Filtering, Commtouch 0 [value: Unknown], Message Sniffer 0 [code:0], ISpamAssassin 1 [raw: 1], SPF_Neutral, DK_None, DKIM_Fail
X-MessageSniffer-ResultCode: 0
X-SmarterMail-TotalSpamWeight: 16
 
example 2:
X-CTCH-AVLevel: Unknown
X-SmarterMail-Spam: Bayesian Filtering, Commtouch 0 [value: Unknown], Message Sniffer 0 [code:0], ISpamAssassin 1 [raw: 1], SPF_Neutral, DK_None, DKIM_Fail
X-MessageSniffer-ResultCode: 0
X-SmarterMail-TotalSpamWeight: 16
 
Example 3:
X-SmarterMail-Spam: Commtouch 0 [value: Unknown], Message Sniffer 0 [code:0], ISpamAssassin 0 [raw: 0], SPF_Fail, DK_None, DKIM_Pass
X-MessageSniffer-ResultCode: 0
X-SmarterMail-TotalSpamWeight: 25
X-MessageSniffer-ResultCode: 0
 
 

3 Replies

Reply to Thread
0
Anthony DePinto Replied
Actually we seem to have confirmed this is another SPF bug. We disabled SPF and messages started working properly again. The 30 is getting added even in the case of these being "ok".

With SPF check:

X-SmarterMail-Spam: Commtouch 0 [value: Unknown], Message Sniffer 0 [code:0], ISpamAssassin 0 [raw: 0], SPF_Fail, DK_None, DKIM_Pass
X-MessageSniffer-ResultCode: 0
X-SmarterMail-TotalSpamWeight: 25
X-MessageSniffer-ResultCode: 0

Without SPF check:

X-SmarterMail-Spam: Commtouch 0 [value: Unknown], Message Sniffer 0 [code:0], ISpamAssassin 0 [raw: 0], DK_None, DKIM_Pass
X-MessageSniffer-ResultCode: 0
X-SmarterMail-TotalSpamWeight: -5
X-MessageSniffer-ResultCode: 0
0
Joe Wolf Replied
You apparently have a wight of 30 applied to SPF_Fail in your AntiSpam settings. If you change that to something more reasonable the problem should be resolved. Also the DK_ tests are depreciated and should be removed.
-Joe
0
Anthony DePinto Replied
Yes, we realized the SPF check was adding the 30, however we don't believe the SPF records should be causing these failures. We've been having trouble with bad SPF checks for the past couple of releases. The current build seemed to make matters worse.

Reply to Thread