wierd spamscores

shanti

shanti

Verified User
Joined
Apr 8, 2009
Messages
95
Location
Wien / Vienna - Austria
Hello

We experience unwanted scoring and dont know where to target the issue:

obvious spam ist scored wrong because of a-yet-not-clean-to-us mechanism. In and obvious SPAM we see headers

Code: 
SPFCheck: Server passes SPF test, -30 Spam score
DKIMCheck: Server passes DKIM test, -20 Spam score

with ridicolous (-)scores .. i suggest those headers not being provided by Spamassassin , cuz we cant find matching rules

are they done by exim ? and how to disable that ? we would like all scoring done by SA instead of Exim

anyone experience same ? and howo fix it ?

RFC
br
-c-
 
shanti said:
In and obvious SPAM we see headers
Click to expand...
These values are given when a sending system is obeying the SPF an DKIM rules. Spammers often obey them these days.
The values are provided by the ESF (Easy Spam Fighter). ESF uses value to 100 if I'm not mistaken.

If you find these values should be lower, then feel free to adjust the values.
Go to your /etc/exim.easy_spam_fighter directory and create a file called variables.conf.custom and insert values to your liking for example:
Code: 
EASY_SPF_PASS == -10
EASY_DKIM_PASS == -10
ofcourse use values to your own insight, but remember to use double = characters in this file.

When ready, rebuild exim and exim.conf to be sure.
Code: 
da build exim
da build exim_conf
after that these values should change to the one you set.

Be aware that if you set them too low there is also a risk that valid mail is seen as spam.

If you don't want to use Easy Spamfighter at all anymore, then disable it in Custombuild.
If I'm correct like this:
Code: 
da build set easy_spam_fighter no
da build update
da build update_versions
The last command should rebuild exim and exim.conf but if not, use the rebuild commands from above.
 
shanti said:
anyone experience same ? and howo fix it ?
Click to expand...

Why would you want to change it? They have only effect when their sum is bigger than 100, by default. If you want to disable the scores, you will need to disable Easy Spam Fighter completely.
 
zEitEr said:
Why would you want to change it? They have only effect when their sum is bigger than 100, by default. If you want to disable the scores, you will need to disable Easy Spam Fighter completely.
Click to expand...

Hi , well the goal is to get rid of this ratings in a way that existing/valid DKIM or SPF wont be overrated like aktually .. nowadays most spammers satisfy those already -- meaning sh** .. thank you for feedback -c-
 
shanti said:
the goal is to get rid of this ratings
Click to expand...

The negative values has only cosmetic effect. Easy Spam Fighter checks rDNS, DKIM, SPF and drops emails which violate these standards. You might check logs on how many emails are blocked by ESF first running the following command as root:

Bash: 
zgrep -E 'ESF|SPFCheck|BlacklistCheck|drop message based' /var/log/exim/mainlog*
 
Thank You mucho .. we set those values in /etc/exim.easy_spam_fighter/variables.conf.custom to lower single digit values (like EASY_SPF_PASS == -2) .
Now the results are fine :-)
 
You must log in or register to reply here.
Back
Top