Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (nike.apache.org: domain of spamd@pcez.com designates
 209.102.124.32 as permitted sender)
Date: Wed, 15 Jun 2011 18:43:30 -0700 (PDT)
From: User for SpamAssassin Mail List <spamd@pcez.com>
To: "Lawrence @ Rogers" <lawrencewilliams@nl.rogers.com>
cc: users@spamassassin.apache.org
Subject: Re: Spam not stopped???
In-Reply-To: <4DF95472.2090202@nl.rogers.com>
Message-ID: <Pine.LNX.4.64.1106151829190.22398@mail.pcez.com>
References: <Pine.LNX.4.64.1106151724460.12790@mail.pcez.com>
 <4DF95472.2090202@nl.rogers.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed


Lawrence,

Thanks for the responce. I know Spam Assassin doesn't stop it we use a 
spamassassin milter for sendmail to reject it. (We been doing this for 
years....). Anyway here is a log on a email that was rejected:

Jun 15 06:27:33 mail spamd[981]: spamd: identified spam (22.2/6.0) for spamass-milter:111 in 2.1 seconds, 5378 bytes.

Jun 15 06:27:33 mail spamd[981]: spamd: result: Y 22 - AWL,BAYES_99,HTML_IMAGE_ONLY_12,HTML_MESSAGE,HTML_SHORT_LINK_IMG_1,SARE
_SPEC_ROLEX,SARE_SPOOF_COM2COM,SARE_SPOOF_COM2OTH,SPOOF_COM2COM,SPOOF_COM2OTH,URIBL_AB_SURBL,URIBL_BLACK,URIBL_JP_SURBL,URIBL_
RHS_DOB,URIBL_SBL,URIBL_SC_SURBL,URIBL_WS_SURBL scantime=2.1,size=5378,user=spamass-milter,uid=111,required_score=6.0,rhost=
localhost,raddr=127.0.0.1,rport=42127,mid=<20110615185711.2964.qmail@vsp-6214cbe9e6d>,bayes=1.000000,autolearn=spam

Jun 15 06:27:33 mail sm-mta[1251]: p5FDRUgF001251: Milter: data, reject=550 5.7.1 Blocked by SpamAssassin

Jun 15 06:27:33 mail sm-mta[1251]: p5FDRUgF001251: to=<user@pcez.com>, delay=00:00:02, pri=35237, stat=Blocked by SpamAssassin


The reason we did not block this at the MTA level is we do not know if 
OTHER users might want email from this email address.

Anyway I'm still looking for a clue why one is blocked and the other is 
not.

Thanks,

Ken


On Wed, 15 Jun 2011, Lawrence @ Rogers wrote:

> On 15/06/2011 10:00 PM, User for SpamAssassin Mail List wrote:
>> 
>> 
>> Hello,
>> 
>> I have something I cannot explain. We blacklisted an email address for a 
>> client but Spam assassin still let it through. Here are the logs:
>> 
>> 
>> Jun 15 08:08:10 mail spamd[20901]: spamd: identified spam (104.0/6.0) for 
>> client:2130 in 0.2 seconds, 1729 bytes.
>> 
>> Jun 15 08:08:10 mail spamd[20901]: spamd: result: Y 103 - 
>> BAYES_50,HTML_MESSAGE,MISSING_SUBJECT,SPF_PASS,TVD_SPAC
>> E_RATIO,USER_IN_BLACKLIST 
>> scantime=0.2,size=1729,user=client,uid=2130,required_score=6.0,rhost=localhost,raddr=127.
>> 0.0.1,rport=55987,mid=<SNT117-W309552C1E79D42EB67A294AD6B0@phx.gbl>,bayes=0.479706,autolearn=no 
>> 
>> Jun 15 08:08:10 mail sm-mta[21077]: p5FF86ld021067: to=<client@pcez.com>, 
>> delay=00:00:03, xdelay=00:00:02, mailer=local, pri=31672, dsn=2.0.0, 
>> stat=Sent
>> 
>> As you can see the use is in the black list but yet the mail was delivered. 
>> I checked other email that was over a score of "9" and the mail was 
>> rejected, but for some reason or another this was not.
>> 
>> Anyone have an idea why this making it through?
>> 
>> Thanks,
>> 
>> Ken
>> 
> SpamAssassin merely assigns scores and doesn't do any rejections on it's own. 
> That is handled by whatever is calling SpamAssassin and using the score that 
> the e-mail is assigned. This could be something like MailScanner, Amavis, or 
> some other third party software.
>
> Also, it would be better to blacklist an e-mail address at the MTA level (ex: 
> Exim, Postfix)
>
> Regards,
> Lawrence
>