SpamAssassin Bayes judges good emails as spam


(Cris Baker) #1

Since early December, I’ve been having a problem with non-spam (ham) emails being judged by SpamAssassin as spam by my domain: http://www.universalgunownership.net

A month ago, SpamAssassin started labeling my copies of emails (which I send to me) as spam with rule BAYES_95 and it has now exacerbated the problem with BAYES_50, BAYES_80, BAYES_99 and BAYES_999.

It even lists a test email I sent to myself with ZERO content - absolutely nothing - as BAYES_50!

X-ChillidogHosting-MailScanner-SpamCheck: not spam, SpamAssassin (score=0.8, required 5, BAYES_50 0.80)

And my very standard emails with some text, just one image and a couple of URLs are all being judged as BAYES_99 and BAYES_999. Deleting the image and the URLs made no difference it was still judged as spam. Deleting the one word “money” also made no difference…

I have found a page purporting to explain the issue but the writer assumes detailed technical knowledge of SpamAssassin which is way beyond me, see https://wiki.apache.org/spamassassin/BayesInSpamAssassin

My mail server is at Chillidog, yet SpamAssassin is not listed in the CPanel main page under EMAIL. It does list MailScanner but that page also does not list SpamAssassin. I can’t even see how to get into SpamAssassin…

CPanel even stops me looking at the CPanel documentation - it takes me to a Login page “Powered by Atlassian Confluence 5.9.2, Team Collaboration Software” where neither of my Chillidog logins work…

How do I stop SpamAssassin listing my good ham emails as spam?

Thanks in advance, all help very gratefully received…
Happy New Year, Cris


(Gregory Barchard) #2

Hi cris

Bayes is a learning system that is trained by all of the incoming mail received by the server.

The header posted says it wasn’t marked as spam. You should check how you are sending the message to yourself. Are you using your chillidog account to send the message to yourself? If you’re not, you could be impersonating your domain by sending it from a mail server not associated with your site. This is not good.

Have you set up any rules? It is easy to set up rules BOTH on the server, in the webmail and in your mail client. Any programs you can run locally can be the culprit. For example, spam sieve, an application you can run on your own computer, can move the messages automatically to spam.

Another thing to check is your Spf records (email Authenication) to make sure this is set to list all of the servers you’re using to send mail from.

Finally, Mailscanner is the spam handler that I use. It uses spam assassin in part for its spam filter. You can configure the mail scanning settings. The spam assassin settings are not configurable (since these are very complex and likely to be misconfigured). Mailscanner is also better spam engine as it works on several fronts. :slightly_smiling:

For account and message specific questions, please open a support ticket.

Thanks
Greg


(Cris Baker) #3

Hi Greg,

Happy New Year, I much appreciate your very prompt reply.

Is the Bayes system only trained by my domain server?, or is it all the emails in all the accounts on the Cloud server?, or just all the Chillidog accounts?

The SpamAssassin documentation says to train it on good emails. It says it needs 200 emails both good and bad to get started… My own emails which I copy to me to see exactly what is received are good, how do I tell it these are good?

As suggested by page https://wiki.apache.org/spamassassin/DnsBlocklists, I checked my domain at http://moensted.dk/spam which highlighted an issue. The first of many entries is:

Resolved UniversalGunOwnership.net to 198.58.103.98
[UniversalGunOwnership.net has 1 MX record UniversalGunOwnership.net.(0)]

  • WSFF open relays and more: will-spam-for-food.eu.org -> 127.0.0.2
    This RBL is not maintained anymore. Please remove from your mail server configuration or bad things (such as randomly blocked mail) may happen by mistake.

Yes indeed, the Bayes-50 didn’t get marked as spam, but I listed it because that email had ZERO CONTENT - absolutely NOTHING AT ALL - and yet still got caught by the Bayes system. Yet why does zero content still get a spam score? This Bayes-50 score highlights the problem…

On the Global Email Filters page (and some other options which I also investigated) it says: For more information, read the documentation. But clicking on this link takes me to a CPanel Login page “Powered by Atlassian Confluence 5.9.2, Team Collaboration Software” where neither of my two Chillidog logins work and yet there’s no way to register…

https://documentation.cpanel.net/login.action?os_destination=%2Fpages%2Fviewpage.action%3FspaceKey%3DPLD%26title%3DGlobal%2BFilters&permissionViolation=true

As you suggest, I’ll open a support ticket for the rest.

Many thanks for your help, Cris


(Gregory Barchard) #4

Hi

To answer your questions:

  1. It analyzes all messages on the server. Not just yours. It looks at message content. Including the subject.

  2. That site and error is an issue with that site. It has nothing to do with your domain or chillidog. That site is searching black lists to see if you’re on it. It has nothing to do with chillidog. They need to update their site.

  3. As this was not marked as spam, why worry about it? The system didn’t judge it as spam. The bayes score is only one metric of the entire system. It is not the be all end all. It also only applies to incoming messages. Not outgoing too so no one will see it :slight_smile:

  4. Finally, you should use and configure Mailscanner. Not email filters. Mailscanner is what runs and controls the settings on your account. You can add whitelisting emails in there.

Greg