了解 spamassassin 及其评分

2024-5-31 • tag-icon

我想知道为什么我的很多电子邮件都被视为垃圾邮件。设置是 Exim4、Dovecot 和 SpamAssassin。以下是到达收件箱的示例电子邮件：

Envelope-to: [email protected]
Delivery-date: Thu, 01 Jun 2017 13:01:35 +0100
MIME-Version: 1.0
Reply-To: [email protected]
From: Andy Newby <[email protected]>
Date: Thu, 1 Jun 2017 13:01:08 +0100
Message-ID: <CALvgFsuZG24KsNqAShA5mgcwZYNEpaGyNdoMohe0RhYA8dx9gw@mail.gmail.com>
To: bob <[email protected]>
Content-Type: multipart/alternative; boundary="001a1146b7bcfc00300550e4cbcd"

 Content preview:  test Andy Newby *Email:* [email protected] *WWW: *http://www.ultranerds.co.uk
    *Mobile: * 07769 201 576 test [...] 

 Content analysis details:   (1.4 points, 5.0 required)

  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was blocked.
                             See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: docs.google.com]
 -0.2 RCVD_IN_MSPIKE_H2      RBL: Average reputation (+2)
                             [209.85.128.171 listed in wl.mailspike.net]
 -0.0 RCVD_IN_DNSWL_NONE     RBL: Sender listed at http://www.dnswl.org/, no
                             trust
                             [209.85.128.171 listed in list.dnswl.org]
 -0.0 SPF_PASS               SPF: sender matches SPF record
  0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail provider
                             (andy.newby[at]gmail.com)
  0.0 HTML_MESSAGE           BODY: HTML included in message
  1.6 HTML_IMAGE_ONLY_12     BODY: HTML: images with 800-1200 bytes of words
  0.0 T_DKIM_INVALID         DKIM-Signature header exists but is not valid
  0.0 T_REMOTE_IMAGE         Message contains an external image
X-Spam-Status: Yes
X-ACL-Warn: SpamAssassin detected spam (from [email protected] to [email protected]).
Subject: *** SPAM *** test

--001a1146b7bcfc00300550e4cbcd
Content-Type: text/plain; charset="UTF-8"

test

Andy Newby
*Email:*    [email protected]
*WWW:    *http://www.ultranerds.co.uk
*Mobile: * 07769 201 576

--001a1146b7bcfc00300550e4cbcd
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">test<div><br clear=3D"all"><div><div class=3D"gmail_signat=
ure" data-smartmail=3D"gmail_signature"><div dir=3D"ltr"><div><div dir=3D"l=
tr"><div><div dir=3D"ltr"><div><div dir=3D"ltr">Andy Newby=C2=A0<div><font =
size=3D"1"><b>Email:</b>=C2=A0 =C2=A0=C2=A0<a href=3D"mailto:andy@ultranerd=
s.co.uk" target=3D"_blank">[email protected]</a>=C2=A0</font></div><div=
><b><span style=3D"font-size:x-small">WWW:</span><span style=3D"font-size:x=
-small">=C2=A0 =C2=A0=C2=A0</span></b><a href=3D"http://www.ultranerds.co.u=
k" style=3D"font-size:x-small" target=3D"_blank">http://www.ultranerds.co.u=
k</a><span style=3D"font-size:x-small"> =C2=A0</span></div><div><b style=3D=
"font-size:x-small">Mobile:=C2=A0</b><span style=3D"font-size:x-small">=C2=
=A007769 201 576</span><div><div><img src=3D"https://docs.google.com/uc?exp=
ort=3Ddownload&amp;id=3D0B2xS_1XN-aUHT2lBdXlSOFVFM2M&amp;revid=3D0B2xS_1XN-=
aUHTUNrb0JVVHY5Q0lwb0h0czY4QlRaYW5pOWp3PQ" style=3D"font-size:12.8px"><br><=
/div></div></div><div><br></div></div></div></div></div></div></div></div><=
/div></div>
</div></div>

--001a1146b7bcfc00300550e4cbcd--

它有 2 个完全冲突的分数，我不知道为什么 :/

X-Spam-Score: 14
X-Spam-Bar: +

...然后在下面：

 Content analysis details:   (1.4 points, 5.0 required)

由于这个原因X-Spam-Status:（Yes因为分数是 14，而我的阈值是 10），它被重写并移到我的垃圾邮件箱中。我真的不明白发生了什么

在 /etc/exim4/exim4.conf.template 中，我设置了以下规则：

SPAMASSASSIN = yes
SPAM_SCORE = 10

system_filter = /etc/exim4/system.filter
system_filter_user = Debian-exim

...然后这个规则/etc/exim4/system.filter：

if $h_X-Spam-Status: contains "Yes"
then
    headers add "Old-Subject: $h_subject"
    headers remove "Subject"
    headers add "Subject: *** SPAM *** $h_old-subject"
    headers remove "Old-Subject"
endif

更新：根据要求，以下是/var/log/mail.log：

Jun  1 13:55:40 admin spamd[3850]: spamd: connection from localhost [127.0.0.1]:45126 to port 783, fd 6
Jun  1 13:55:40 admin spamd[3850]: spamd: setuid to debian-spamd succeeded
Jun  1 13:55:40 admin spamd[3850]: spamd: checking message <CALvgFst0Sw_pMpaByZYZ0iv8+uXhUZKwBt14u4Nuxq+dFTJFKg@mail.gmail.com> for debian-spamd:114
Jun  1 13:55:41 admin spamd[3850]: spamd: clean message (1.6/5.0) for debian-spamd:114 in 0.2 seconds, 3924 bytes.
Jun  1 13:55:41 admin spamd[3850]: spamd: result: . 1 - FREEMAIL_FROM,HTML_IMAGE_ONLY_12,HTML_MESSAGE,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_PASS,T_DKIM_INVALID,T_REMOTE_IMAGE,URIBL_BLOCKED scantime=0.2,size=3924,user=debian-spamd,uid=114,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=45126,mid=<CALvgFst0Sw_pMpaByZYZ0iv8+uXhUZKwBt14u4Nuxq+dFTJFKg@mail.gmail.com>,autolearn=no autolearn_force=no
Jun  1 13:55:41 admin spamd[3670]: prefork: child states: II
^X^C

...进而/var/log/exim4/mainlog：

2017-06-01 13:55:40 1dGPdc-0004Pc-Uq DKIM: d=gmail.com s=20161025 c=relaxed/relaxed a=rsa-sha256 [verification succeeded]
2017-06-01 13:55:41 1dGPdc-0004Pc-Uq <= [email protected] H=mail-wm0-f45.google.com [74.125.82.45] P=esmtps X=TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128 CV=no S=5747 id=CALvgFst0Sw_pMpaByZYZ0iv8+uXhUZKwBt14u4Nuxq+dFTJFKg@mail.gmail.com
2017-06-01 13:55:41 1dGPdc-0004Pc-Uq => info <[email protected]> R=localuser_spam T=local_spam_delivery
2017-06-01 13:55:41 1dGPdc-0004Pc-Uq Completed

答案1

在 SpamAssassin 报告中，您可以看到您的 IP 列在 2 个 RBLS（mailspike.net 和 dnswl.org）上。检查这些网站，了解如何删除您的 IP。
配置文件中的垃圾邮件分数 10 表示垃圾邮件级别 1.0，这个分数非常低，通常为 5.0，即邮件被标记为垃圾邮件。将 /etc/exim4/exim4.conf.template 垃圾邮件分数更改为 50 或更高。
运行您的域名https://intodns.com/查看与邮件相关的问题，这些问题可以让您在 RBLS 上列出。

答案2

看起来您的 exim 配置中$spam_score和之间存在混淆。$spam_score_int

从相关exim文档章节（重点是我的）：

$垃圾邮件分数

邮件的垃圾邮件分数，例如“3.4”或“30.5”。这对于包含在日志或拒绝邮件中很有用。

$垃圾邮件分数

该邮件的垃圾邮件分数，乘以十，得到整数值。例如“34”或“305”。它可能看起来与 $spam_score 不一致，因为 $spam_score 是四舍五入的，而 $spam_score_int 是截断的。整数值对于条件中的数字比较很有用。

我没有完全理解您的配置，尤其是文件/etc/exim4/exim4.conf.template- 它可能是 debian 和/或不符合当前的 exim 配置规则。但是：1.4正如报告中的文本看起来很像通过变量14访问时的样子！$spam_score_int

答案1

答案2

相关内容