SA Not Working All The Time Threshold=0

[Saltshaker]

Hey Folks,
I joined up here to see if I could figure out what is going on with my SA setting and server. I have set a mail server with hMailserver and SA in order to only check spam scores on all incoming mail that is received. Which can receive email without a problem. When I originally set this up and set the SA Threshold to 0, all emails that came in were added as an attachment and the content analysis was in the body of the email which is quite helpful.

However at some point it stopped working and the email no longer gets marked as Spam with the content analysis. Running the test in Hmailserver and sending the email with the subject test, works and on occasion, I have seen it work once or twice but otherwise, it does not come in as intended which is with the attachment and the content analysis. The only thing that changes is that is subject gets the added "SPAM" to it.

So I have updated to the latest SA and check all configs but still no luck. I even went as far as spinning up a new server, reinstall from scratch and still it does the same thing.

I have the current server up to date with the current SA settings seen in the attachments. Threshold at 0, all boxes checked, and add [SPAM] to the subject which it does every time but thats it.
I went into the local config for SA and this is the only thing I have set or uncommented out:


# Add *****SPAM***** to the Subject header of spam e-mails
#
rewrite_header Subject *SPAM*

# Save spam messages as a message/rfc822 MIME attachment instead of
# modifying the original message (0: off, 2: use text/plain instead)
#
report_safe 1

# Set the threshold at which a message is considered spam (default: 5.0)
#
required_score 0

I forwarded an actual spam email over from my personal Yahoo email to my test SA address but it only marked it as spam in the subject
As seen in the header it is marked as Spam but the Spam Status says no even though the score is above the required 0.0

Return-Path: myemail@yahoo.com
X-Spam-Checker-Version: SpamAssassin 4.0.0 (svnunknown) on SpamAssassin.mylab.net
X-Spam-Level:
X-Spam-Status: No, score=-4.8 required=0.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FROM,FREEMAIL_REPLYTO_END_DIGIT,HTML_MESSAGE, RCVD_IN_DNSWL_HI,RCVD_IN_MSPIKE_H2,RCVD_IN_ZEN_BLOCKED_OPENDNS, SPF_HELO_NONE,URIBL_DBL_BLOCKED_OPENDNS autolearn=ham autolearn_force=no version=4.0.0
Received: from sonic316-21.consmr.mail.ne1.yahoo.com (sonic316-21.consmr.mail.ne1.yahoo.com [66.163.187.147]) by mail.mylab.net with ESMTP ; Wed, 11 Sep 2024 16:38:54 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1726087134; bh=I1QqxEydsMBYOZZoEtMS3ANQ8zg08XfWyOHz3zNaq4s=; h=Date:From:Reply-To:To:In-Reply-To:References:Subject:From:Subject:Reply-To; b=ZISDJLIpk+Dv/HiFjgqYtYJf6Vb7Zt9DFNex1IGQbaR4lZm8huoNsPr7izVdh9xUy7nvCC+u91vRsqJGdBHi//ZR1lro5KzQRukffKAhdxP0SVev2KFkOQ5ne8QdofLFMcRJUquhMKM7oTahMBp0B9ejpW1qTr7F5LjlQjX5yPAQLiUBWZFG5KiQU9pSJGbxgY1iH64/IS/QVsnFzuXNryYLS/vp8hCtfHWhIcqNMHz5/Gyqz+9veAjkc7Qz1t0m2VhfBNzutoBfH67tHGgfZTLyCstoNiAI6jsrQPRv2BOjJ13Nr/4x50tg/5MLVqdUbMP7Boh6gpW539CGp1uYjw==
X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1726087134; bh=U4hRCaD+cT/6R1S0375BigforYYNqFAlEsreiWH6qbp=; h=X-Sonic-MF:Date:From:To:Subject:From:Subject; b=j4DxhnnQ8/5hrAn8pw/MQ95EY/XnENAE0Z5Uho2wn6H88+NyjifVWtt//saxZq81n2R2R9wtRLM5vTxyf3Ij9Fcc4L24SqOIJaaOuhASNZZUdVk+sHf1rEg/qWyW9Ol5fNbuJ9Cc4zXiUUYqOA4YMgqzKMG8WMK9FDePnKF6Xqy0OSNhPS0jYEyf+pxUJZ9foBp4TIOC1eTDMg6eR5gdLJmuU6r1TIuTGf9GfupmOrw+pm2Zk4q9IbSCXQk0oRxHGmt7uLlnL1DDcqZQVW9p0Mutx3ECRtcnm2NQ2z/zN5hxHZgeJVgH7bQ+v2nnjVPxj6beDP8NN11u52teM5VIGg==
X-YMail-OSG: pdDKg.IVM1lDk5CoeFhLsIveW7GDZ9ktnrZLXgPXazGGql1dOzWL2QAE999UCZc JNUi.zHqSw5cMB7xpd2T.ThFpDWPg6KzA62abmWCqun5rHD.WtaLV9afBwtD_8KqmID.9_T3o2kV fTL6ve8UGHsYn.mW1iKvQ0GjMYOT8NbX55a64jSXBafTni_DIpa4poH9qdIq.Uv_KRBj.tw1KBwY 0h5hLRSnAV.4Q4daRAhj6D.lrKupIAkAGlWOg7BeMO4AaF_ydVKOnWsdG1HphddG54F1NExFc53d DPhZYuCe7Y6bq8ErY92R0CtInLECPnV_Nr7l3SuSHiY_hSdoEP3xrgsJYYynoEgBKBYntfSWkRcQ YryoF2YXhytA.3khZFDJSN2VH_ZZl.dDYAO9E5ZoDDNQ1EEcd8UlFa6zRLwh8AMP3Kkbm78Pa5iN 07BRMwpvaQaBBFIhyKekwurXSILTYKn_zB97c_VzQAmNE8YgcetLtx4TKS9vJ8nLYqZa1riDtWdh fKWJZwKP0dpglBVkIkAZ7DK3qhECNwSV6qyoeUD.f_7BelNthHgGdW5mZswMNVQmwjIpXywKGmOR FmupBhXUQLsN3LgodC0mNioeE_nBpE67Yi56M3XAiCev_SA5He3tjnYJ86o816YUR59mNaHVVqNu _t_BJnFIpeSIMZMNEI95SOl1imu3SUD2FJDerweKEITB1CcaCdAuSMUDKJV3ah7Khcf9Woee_yaw kFA1hgvsFbUmNE3_vKlEY4bdQpz7FMx0NUvS6VbjwkXnrt8KmCwBcDsI6XcWKJo1wAPr2p2D1FEe O3iuAR6cuDwUULpv8Est87imhpKFbMUw0sXknsESJ9EuohP1QWH4OuXcQLrwS0XB.TKnWiqozWhE qhkEFi8tuva99y1.tTal9NJ9mFcY0ELz5sra5NeDkXkBx7cee0F9l10mInqaF4l6ro40sTu.sZv1 9dlHIIZUvqGcj8r4d_TL2tBY4bz1yVr2WBV9wpi.KiOeXryuEyLiQ.0Y81qhYPGPCX_jsHaV13aQ 3UGTrW1f_gjBilqAT87Mk9AD1Cp1lOiFnKdoS9XLIv0A01MHuSrz6jxdL6RkiKiDZ7u5ZBFEWu3W kM.QArLcrNEdoQ9Y9wlp9dBsiR4TIYEh19nsXa3zuDyS5Kl3Ce2DljlEhiXuCCJZod6o7JCMnmUx 47W_UFfTBn4Y.m0qGbH0LdZyy_OwW4w_DW57nubu1YpFQCGF4asSvacoiXX0s4.nBmxDll8130nX LvMwS2s7jG.qadyIinyCf1lpCUW.dl4PJKs9lsb.DOWFMxqT3IBPw.ynuAA577JBIpJFiS3wt03i nQ02GuhGvuCuN5t_8dDBdub9sUwg62jhhTWReFxDLYvJ9_80OUl1l7lJlwRj42b1S8rMgVKqkyme _yrCXz.cBITYt1ePAQwYt1.DM1E5xdbehzOI_FQvTCE6HH7qLfRG_rUHCrEx10IFWU77UxijF9yU elOZ1qEmIbK_WGDTL8amWR9yTXUkCLhN1uFz8lOHKSEb7j_psOO8RwEbC2O2xPvAMq4iDaVJqNqU ORYeTfQ5_UaXABeP9CRQBplm6eiMNOQIpK2HGI7NLP8OJjdsfilC5fUvZMpNnzrGjWsPFiDLXBzE irlBt0BwLM07sOQ1hiUBljfSY3t0eND5a8JKCcAQG56W2KH0OATBVzeZ4Ka7DpQSXAp.wqC4MZC4 47DoZ3dBmMiAvftDQQ3O7NpoDedCGwhy1y7EMnW0t.hBDy3phDsC1ztNTY6nB3Trr0.cUlgHQ5jg j6qHfhaEhVL42WMqnipvPVpt.Pk5NRLmgPjYVCi4s8SeXtlNasYiwQobkWV1lPH3e0XzaVZavHtn MGGB7qtSDWn5cpfYfYpyjzFsYN3ItQK54hgJQZ7jXtzMbHcZ8f4DJNtA7mj1jK2i57d9Eg6Oq.eI umOAYVvzWvwKMR1_j2glE4cfJL27sVlSTzC3ZPnc1gsODtuw5KGEv83qnguxKpcSral5f1c27D3B jv33kPdDnobGxnO4CISLFX06IEwmkEvkSUy4PffAnEnRxfpDMF4XPWR6mX_QuWUCFf8KDoqve_Nw iKDpphC.eGHoZ3Pd1AF.ZipYoAKG8JPbfpfzkc9nDK972grAsKtGxxYolQOd6ayeBh6LTo8fgT4d ABedFtWRY6NS_P3MocjOjzpY8OS0LaVXZ7jXaSKzkXa2hqPGOBi9hO7LN8BVOsF3iXsHG1zs3Y4M WBoRLa2TUlVjrrLj74YSq12XzhhuCKbpEnzxkRQpW5cMw3VcLpbIErcdQ5OTVX1ULDRCqwwTn65. o8vxUmWotizjQnmWi7yAkXw--
X-Sonic-MF: <myemail@yahoo.com>
X-Sonic-ID: 2bea2a58-fc89-4041-91e0-89f0cd43f355
Received: from sonic.gate.mail.ne1.yahoo.com by sonic316.consmr.mail.ne1.yahoo.com with HTTP; Wed, 11 Sep 2024 20:38:54 +0000
Date: Wed, 11 Sep 2024 20:38:53 +0000 (UTC)
From: ME <myemail@yahoo.com>
Reply-To: ME <myemail@yahoo.com>
To: "myemail@spamassassin.com" <myemail@spamassassin.com>
Message-ID: <590140916.6809617.1726087133556@mail.yahoo.com>
In-Reply-To: <354656749.1095457.1725133784120@prd-cnn-email-deployment-587b46d5c-r52rg>
References: <354656749.1095457.1725133784120@prd-cnn-email-deployment-587b46d5c-r52rg>
Subject: [SPAM] Fw:=?utf-8?Q?=20Claim=20Your=20$500=20Reward=20=E2=80=93=20Limited=20Time=20?= =?utf-8?Q?Offer!?=
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_Part_6809616_735213887.1726087133554"
X-Mailer: WebService/1.1.22645 YMailNorrin
Content-Length: 8972
X-hMailServer-Spam: YES
X-hMailServer-Reason-Score: 0


Running a test with hMailserver and emailing myself with the test Subject line then it does work.

The header as follows:
Return-Path: myemail@yahoo.com
Received: from localhost by SpamAssassin.mylab.net with SpamAssassin (version 4.0.0); Thu, 12 Sep 2024 14:18:58 -0400
From: Chris <myemail@yahoo.com>
To: "me@mylab.net" <me@mylab.net>
Subject: [SPAM] *SPAM* XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X
Date: Thu, 12 Sep 2024 18:18:54 +0000 (UTC)
Message-Id: <1160144086.7245425.1726165134566@mail.yahoo.com>
X-Spam-Checker-Version: SpamAssassin 4.0.0 (svnunknown) on SpamAssassin.mylab.net
X-Spam-Flag: YES
X-Spam-Level: **************************************************
X-Spam-Status: Yes, score=995.2 required=0.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FROM,FREEMAIL_REPLYTO_END_DIGIT,GTUBE, HTML_MESSAGE,RCVD_IN_DNSWL_HI,RCVD_IN_MSPIKE_H2,SPF_HELO_NONE, TVD_SPACE_RATIO autolearn=no autolearn_force=no version=4.0.0
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------=_66E33092.11F7333B"
X-hMailServer-Spam: YES
X-hMailServer-Reason-1: Tagged as Spam by SpamAssassin - (Score: 0)
X-hMailServer-Reason-Score: 0


So I have attached my hMailserver settings as well but can anyone tell me how to get this to generate the content analysis for all incoming emails?? Thanks.

[palinka]

What's in your spamd.log?

[jimimaseye]

score=-4.8

Sa is working. Your test did not exceed the threshold of zero. (Minus 4.8 )

Also you might choose to research this

URIBL_DBL_BLOCKED_OPENDNS

[Entered by mobile. Excuse my spelling.]

[Saltshaker]

score=-4.8

Sa is working. Your test did not exceed the threshold of zero. (Minus 4.8 )

Also you might choose to research this

URIBL_DBL_BLOCKED_OPENDNS

[Entered by mobile. Excuse my spelling.]

Thank you! So I set the score in the config file to -100 for fun and that seem to do the trick. In the past, I do not recall scores going below 0 so is that normal or did something change in the scoring that now allows for negative values?

[jimimaseye]

, I do not recall scores going below 0 so is that normal

As far as i remember yes.

However....

Also you might choose to research this
URIBL_DBL_BLOCKED_OPENDNS

It matters.

[Entered by mobile. Excuse my spelling.]

[palinka]

So I have attached my hMailserver settings as well but can anyone tell me how to get this to generate the content analysis for all incoming emails?? Thanks.

If all you want is the report, just add this to your local.cf:

Code: Select all

add_header all Score _SCORE_
add_header all Report _REPORT_

Then go back to the default settings for spam scoring, because if every message is set to spam, then SA is kind of useless.