[Mimedefang] 2 different scores spam getting through

[Nels Lindquist]

On 2 Sep 2004 at 9:42, Ray Goniea wrote:

<snip>

> We use a site wide procmail file to deliver spam marked email to a
> local folder on the server. 
> 
> After looking at the header of an email it essentially shows 2 scores,
> like it is being scanned twice using different rulesets. I have
> searched through the archives and have found a little bit on this but
> nothing that would lead me in the right direction. 
 
> X-Spam-Score: 6.497 (******) BAD_CREDIT,CLICK_BELOW_CAPS,EXTRA_MPART_TYPE,GUARANTEED_STUFF,
> HTML_40_50,HTML_FONT_BIG,HTML_LINK_CLICK_CAPS,
> HTML_LINK_CLICK_HERE,HTML_MESSAGE,HTML_TAG_EXISTS_TBODY
> X-Scanned-By: MIMEDefang 2.39

The above headers were definitely added by the default MIMEDefang 
filter, but unless you've explicitly altered your filter to add the 
following ones, I'd say you're running messages through SA twice; 
once via MIMEDefang and once directly.  Is your system-wide procmail 
filter somehow calling spamc or spamassassin by default?  Is spamd 
running?  (It doesn't need to be for MIMEDefang).

> X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on falconweb
> X-Spam-Level: 
> X-Spam-Status: NO, Level * hits=1.9 required=5.0 tests=BAD_CREDIT,
>  CLICK_BELOW_CAPS,GUARANTEED_STUFF,LINES_OF_YELLING version=2.63
> Status:   
> 
> As you see the X-Spam-Score is 6.5 but the X-Spam-Status is NO and the
> hits are only 1.9. But you can see where it did not go through as many
> rulesets therefore receiving a lower score.

It probably didn't trigger as many rules because the modifications 
MIMEDefang made before it was processed a second time made it look 
less like spam.

----
Nels Lindquist <*>
Information Systems Manager
Morningstar Air Express Inc.