From users-return-121025-archive-asf-public=cust-asf.ponee.io@spamassassin.apache.org Sat Aug 31 00:18:06 2019 Return-Path: X-Original-To: archive-asf-public@cust-asf.ponee.io Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [207.244.88.153]) by mx-eu-01.ponee.io (Postfix) with SMTP id 5A9F718065E for ; Sat, 31 Aug 2019 02:18:06 +0200 (CEST) Received: (qmail 48989 invoked by uid 500); 31 Aug 2019 00:18:05 -0000 Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm Precedence: bulk list-help: list-unsubscribe: List-Post: List-Id: Delivered-To: mailing list users@spamassassin.apache.org Received: (qmail 48978 invoked by uid 99); 31 Aug 2019 00:18:04 -0000 Received: from pnap-us-west-generic-nat.apache.org (HELO spamd1-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 31 Aug 2019 00:18:04 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd1-us-west.apache.org (ASF Mail Server at spamd1-us-west.apache.org) with ESMTP id 22609C0505 for ; Sat, 31 Aug 2019 00:18:02 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd1-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: 0.001 X-Spam-Level: X-Spam-Status: No, score=0.001 tagged_above=-999 required=6.31 tests=[RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=disabled Received: from mx1-ec2-va.apache.org ([10.40.0.8]) by localhost (spamd1-us-west.apache.org [10.40.0.7]) (amavisd-new, port 10024) with ESMTP id wVCADXb01Bat for ; Sat, 31 Aug 2019 00:18:00 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=67.149.19.3; helo=bigsky.scconsult.com; envelope-from=sausers-20150205@billmail.scconsult.com; receiver= Received: from bigsky.scconsult.com (bigsky.scconsult.com [67.149.19.3]) by mx1-ec2-va.apache.org (ASF Mail Server at mx1-ec2-va.apache.org) with ESMTPS id EAFCEBC80B for ; Sat, 31 Aug 2019 00:17:58 +0000 (UTC) Received: from extravagant.scconsult.com (extravagant.scconsult.com [192.168.254.62]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by toaster.scconsult.com (Postfix) with ESMTPSA id 46Kxkn4Rj0z2Kc1t for ; Fri, 30 Aug 2019 20:17:53 -0400 (EDT) From: "Bill Cole" To: users@spamassassin.apache.org Subject: Re: HTML Preheader affected by NORDNS_LOW_CONTRAST Date: Fri, 30 Aug 2019 20:17:52 -0400 X-Mailer: MailMate (2.0BETAr6137) Message-ID: <522E779F-8A21-4780-B50A-280777B5BFE0@billmail.scconsult.com> In-Reply-To: <01ab01d55f6f$179580a0$46c081e0$@jmweb.net> References: <01ab01d55f6f$179580a0$46c081e0$@jmweb.net> MIME-Version: 1.0 Content-Type: text/plain; format=flowed X-Spam-Source: on via in en X-Spam-Hops: On 30 Aug 2019, at 16:11, Jerry Martinez wrote: > I have noticed an unusually high amount of my HTML emails are being > tagged > as spam. The offending rule appears to be: > > ScanSA rules applied: (1.8) ...NORDNS_LOW_CONTRAST=1.82 This is an overly simplistic analysis. No single rule with a score of 1.8 can be called THE reason that a message is marked as spam by SA. The default spam score threshold for SA is 5.0, so 1.8 is scarcely more than 1/3 of the cause at a site using normal settings. The current default score for NORDNS_LOW_CONTRAST is 1.869 if network tests are enable (as they are at most sites) so it's a bit unclear where the value you're seeing comes from. The default score is determined by analysis of submitted "mass check" logs to the SA project and it has a limit at 2.5, so it appears that the scoring system is working as intended. RuleQA is showing that 97.4% of mail matching that rule in the submitted data sets is spam, in a total corpus that's roughly 60% spam, 40% ham (i.e. skewed towards ham, relative to email in the wild.) This is not to say that there is no chance of that rule being modified, just that a simple score reduction isn't going to be the way it's done. -- Bill Cole bill@scconsult.com or billcole@apache.org (AKA @grumpybozo and many *@billmail.scconsult.com addresses) Not Currently Available For Hire