wierd spamscores

[shanti]

Hello

We experience unwanted scoring and dont know where to target the issue:

obvious spam ist scored wrong because of a-yet-not-clean-to-us mechanism. In and obvious SPAM we see headers

SPFCheck: Server passes SPF test, -30 Spam score
DKIMCheck: Server passes DKIM test, -20 Spam score

with ridicolous (-)scores .. i suggest those headers not being provided by Spamassassin , cuz we cant find matching rules

are they done by exim ? and how to disable that ? we would like all scoring done by SA instead of Exim

anyone experience same ? and howo fix it ?

RFC
br
-c-

 

[Richard G]

In and obvious SPAM we see headers

These values are given when a sending system is obeying the SPF an DKIM rules. Spammers often obey them these days.
The values are provided by the ESF (Easy Spam Fighter). ESF uses value to 100 if I'm not mistaken.

If you find these values should be lower, then feel free to adjust the values.
Go to your /etc/exim.easy_spam_fighter directory and create a file called variables.conf.custom and insert values to your liking for example:

EASY_SPF_PASS == -10
EASY_DKIM_PASS == -10

ofcourse use values to your own insight, but remember to use double = characters in this file.

When ready, rebuild exim and exim.conf to be sure.

da build exim
da build exim_conf

after that these values should change to the one you set.

Be aware that if you set them too low there is also a risk that valid mail is seen as spam.

If you don't want to use Easy Spamfighter at all anymore, then disable it in Custombuild.
If I'm correct like this:

da build set easy_spam_fighter no
da build update
da build update_versions

The last command should rebuild exim and exim.conf but if not, use the rebuild commands from above.

 

[zEitEr]

anyone experience same ? and howo fix it ?

Why would you want to change it? They have only effect when their sum is bigger than 100, by default. If you want to disable the scores, you will need to disable Easy Spam Fighter completely.

 

[shanti]

Thank you Richard .. looks very promising .. we will test that ASAP

 

[shanti]

Why would you want to change it? They have only effect when their sum is bigger than 100, by default. If you want to disable the scores, you will need to disable Easy Spam Fighter completely.

Hi , well the goal is to get rid of this ratings in a way that existing/valid DKIM or SPF wont be overrated like aktually .. nowadays most spammers satisfy those already -- meaning sh** .. thank you for feedback -c-

 

[zEitEr]

the goal is to get rid of this ratings

The negative values has only cosmetic effect. Easy Spam Fighter checks rDNS, DKIM, SPF and drops emails which violate these standards. You might check logs on how many emails are blocked by ESF first running the following command as root:

zgrep -E 'ESF|SPFCheck|BlacklistCheck|drop message based' /var/log/exim/mainlog*

 

[Richard G]

and drops emails which violate these standards.

Yep indeed. And those amounts are huge/massive even on little servers as hours. So I woulnd't disable it anyway.

 

[shanti]

Thank You mucho .. we set those values in /etc/exim.easy_spam_fighter/variables.conf.custom to lower single digit values (like EASY_SPF_PASS == -2) .
Now the results are fine