Spam Blocker giving obvious spam a score of 0

[BadBoyHouse]

I installed Spam Blocker lite on our Untangle box today.

Whilst it is blocking some spam there are a huge amount of obvious spam emails that are getting spam scores of 0, 0.2 and other low ratings.



For example:

Subject: Triple your account balance
Sender: do_not_reply@aa-idcomputer.com
Spam Score: 0

Subject: Work Offer Inside
Sender: non-existentname@ourdomainname.co.uk
Spam Score: 0.5
(email spoofing)

Subject: Alternate Methods Of Power
Sender: non-existentname@ourdomainname.co.uk
Spam Score: 0.6
(email spoofing)

Subject: Employment You've Been Searching!
Sender: non-existentname@ourdomainname.co.uk
Spam Score: 1.6
(email spoofing)

I'm confused as to why these obvious spam emails are getting such low scores.

SMTP scanning strength is set to Medium 4.3. Drop super spam is ticked. Super spam threshold is 20.

We use GFI Mail Essentials on our Exchange server so fortunately this is still taking care of these obvious spam emails. I was hoping that I could stop using GFI though down the line.

Our configuration is as follows:

ISP Router
|
Untangle
|
Network Switch
|
Exchange Server

Under Network - External Interface - The primary DNS server is our ISP router address.

[BadBoyHouse]

This is also very strange:

Subject: Comnpany concerning itself with the advertising - spam score 21.8
Sender: (random letters)@ourdomainname.co.uk (SUPER SPAM)

Subject: Company conerning itself with advertising - spam score 4.1
Sender: (random letters)@ourdomainname.co.uk PASSED TO USER

How can two identical emails have such a big gap in spam score???


To: myemailaddress@ourdomainname.co.uk
Subject: New Job Vacancy - spam score 0 - PASSED TO USER!!!
Sender: atila-gnuthcin@ourdomainname.co.uk

To: colleaguesemailaddress@ourdomainname.co.uk
Subject: New Job Vacancy - spam score 0 - spam score 4.9 - quarantined!!
Sender: atila-gnuthcin@ourdomainname.co.uk

[raditude]

I have seen on a fresh install that it does take a little time for the bayes scoring to learn, during such time some spam does get through.

I cannot explain the huge variance in the spam scores, maybe one of the admins can or will provide an answer to that. It has just been my experience, the more emails that you can get for UT to filter, the faster the scoring learns.

[BadBoyHouse]

It processes a lot of emails a day. Hopefully you're right in that it needs to learn.

It is still presently giving odd scores - identical emails, all clearly spam, some getting very low scores (<4) others getting high scores (>20).

[BadBoyHouse]

It seems to be getting much better - obviously it's learning.

Will monitor.