No SPAM recoginition for various mails

[Carsten Burghardt]

Am 30.05.2011 17:04, schrieb Hermann Himmelbauer:
> Hi,
> I'm using Kolab 2.3.1 on Debian sqeeze and receive a lot of SPAM. When
> looking on my mail headers, it seems that not all mail is scanned by
> Spamassassin - but I have no clue why.
>
> The following is such an example:
>
> ---------- snip - unrecognized spam ----------------
>
> Return-Path:<protectoratecross at nymag.com>
> Received: from localhost (localhost [127.0.0.1])
> 	 by hermes.qwer.tk (Cyrus v2.3.16-kolab-nocaps) with LMTPA;
> 	 Mon, 30 May 2011 16:54:48 +0200
> X-Sieve: CMU Sieve 2.3
> Received: from localhost (localhost [127.0.0.1])
> 	by hermes.qwer.tk (Postfix) with ESMTP id 41F051070CB
> 	for<hermann at himmelbauer-it.at>; Mon, 30 May 2011 16:54:48 +0200 (CEST)
> X-Virus-Scanned: by amavisd-new at qwer.tk
> Received: from hermes.qwer.tk ([127.0.0.1])
> 	by localhost (hermes.qwer.tk [127.0.0.1]) (amavisd-new, port 10024)
> 	with ESMTP id n1FridkM1cEl for<hermann at himmelbauer-it.at>;
> 	Mon, 30 May 2011 16:54:48 +0200 (CEST)
> Received: from localhost (localhost [127.0.0.1])
> 	by hermes.qwer.tk (Postfix) with ESMTP id 12C311070D0
> 	for<hermann at himmelbauer-it.at>; Mon, 30 May 2011 16:54:48 +0200 (CEST)
> Received: from microsofb07270.aprec.ru (unknown [91.210.206.13])
> 	by hermes.qwer.tk (Postfix) with SMTP id B491C1070CB
> 	for<hermann at qwer.tk>; Mon, 30 May 2011 16:54:47 +0200 (CEST)
> Received: (qmail 2525 by uid 525); Mon, 30 May 2011 18:53:03 -0300
> From: "Jessica Alba weight loss Free trial sample"<protectoratecross at nymag.com>
> To:<hermann at qwer.tk>
> Subject: Jessica Alba did it, you can too!
> Date: Mon, 30 May 2011 18:08:59 -0300
> Message-ID:<000401cc1efa$f1d076d0$d5716470$@com>
> MIME-Version: 1.0
> Content-Type: multipart/alternative;
> 	boundary="----=_NextPart_000_0003_01CC1EFA.F1D076D0"
> X-Mailer: Microsoft Office Outlook 12.0
> Thread-Index: AcjjWWMdM5XEvb9SQHf4U0yvc5yaCg==
> Content-Language: en-us
> X-Kolab-Scheduling-Message: FALSE
>
> This is a multipart message in MIME format.
> --------------- snip /end unrecoginzed spam ------------
>
> In messages that are recognized as SPAM, I find the following:
>
> ---------------- snip - spam scanner works --------------
> X-Virus-Scanned: by amavisd-new at qwer.tk
> X-Spam-Flag: NO
> X-Spam-Score: 3.117
> X-Spam-Level: ***
> X-Spam-Status: No, score=3.117 tagged_above=3 required=6.3 tests=[AWL=-4.477,
> 	HTML_IMAGE_ONLY_32=2.353, HTML_MESSAGE=0.001, MIME_HTML_ONLY=2.299,
> 	RDNS_NONE=0.1, SPOOF_COM2COM=0.001, SPOOF_COM2OTH=2.84]
> ---------------- /snip ----------------------------------
>
> Any clue why the above is not present in any mail header? "X-Virus-Scanned" is always there, but the
> "X-Spam" headers are often missing.
>
> Perhaps I need to upgrade Spamassassin? E.g. via "sa-update" or the like? Or is there some switch
> I have to enable?
>
As you can see from the SpamAssassin line above your emails are only 
tagged (marked) above a score of 3. It actually scans your emails but 
only the ones that have a higher score get this "X-Spam-xxx" headers. 
You can change this in your amavis configuration but it will not change 
your spam filtering. I would recommend to decrease the value of 
"required" (also in your amavis config) so that spam is already filtered 
out at a lower value as 6.3 is pretty high.


Regards

Carsten