[169233] in North American Network Operators' Group
Re: spamassassin
daemon@ATHENA.MIT.EDU (Daniel Staal)
Wed Feb 19 01:46:59 2014
Date: Wed, 19 Feb 2014 01:46:33 -0500
From: Daniel Staal <DStaal@usa.net>
To: Randy Bush <randy@psg.com>,
North American Network Operators' Group <nanog@nanog.org>
In-Reply-To: <m2zjlnrhqe.wl%randy@psg.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
--As of February 19, 2014 9:52:57 AM +0800, Randy Bush is alleged to have
said:
> in the last 3-4 days, a *massive* amount of spam is making it past
> spamassassin to my users and to me. see appended for example. not
> all has dkim.
>
> clue?
--As for the rest, it is mine.
The spamassassin list has been tracking an issue where a new rule made it
out of the testbox accidentally, which lowers scores on a lot of spam. It
wasn't in the sample you provided, but the rule name is BAYES_999 - it
catches mail that the bayes filter thinks is 99.9-100% sure to be spam. As
it got promoted prematurely, it's showing with a score of 1.0. (The
default.) It's probably a part of your problem.
A fix should be in the rules update today or tomorrow - or you can rescore
it to the same as BAYES_99 (someplace in the 3 range by default, I
believe). That's what used to catch that mail: it used to mean 99-100%,
and now means 99-99.9%.
More info can be found in the mailing list archives for the spamassassin
list.
Daniel T. Staal
---------------------------------------------------------------
This email copyright the author. Unless otherwise noted, you
are expressly allowed to retransmit, quote, or otherwise use
the contents for non-commercial purposes. This copyright will
expire 5 years after the author's death, or in 30 years,
whichever is longer, unless such a period is in excess of
local copyright law.
---------------------------------------------------------------
