BAYES_99 & BAYES_999 Issue with email with no body but attachments

[mydigia]

Hello,

Our user A from Server A has emailed our user B on Server B, and that email was flagged as spam and ended up in Junk folder.

Reason you may ask?

X-Source:=20
X-Source-Args:=20
X-Source-Dir:=20
X-Spam-Status: Yes, score=3D10.2
X-Spam-Score: 102
X-Spam-Bar: ++++++++++
X-Spam-Report: Spam detection software, running on the system =
"OUR_SERVER",
has identified this incoming email as possible spam.  The original
message has been attached to this so you can view it or label
similar future email.  If you have any questions, see
root\@localhost for details.
Content preview: =20
Content analysis details:   (10.2 points, 10.0 required)
  pts rule name              description
---- ---------------------- =
--------------------------------------------------
  5.0 BAYES_99               BODY: Bayes spam probability is 99 to 100%
                             [score: 1.0000]
  1.0 BAYES_999              BODY: Bayes spam probability is 99.9 to =
100%
                             [score: 1.0000]
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL =
was
                             blocked.  See
                             =
[URL unfurl="true"]http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block[/URL]
                              for more information.
                             [URIs: USER_A_DOMAIN]
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not =
necessarily
                             valid
  1.8 PYZOR_CHECK            Listed in Pyzor
                             ([URL='https://pyzor.readthedocs.io/en/latest/']Welcome to Pyzor’s documentation! — Pyzor 1.0 documentation[/URL])
  0.0 TVD_SPACE_RATIO        No description available.
  2.2 SB_GIF_AND_NO_URIS     No description available.
  0.0 KAM_DMARC_STATUS       Test Rule for DKIM or SPF Failure with =
Strict
                             Alignment
  0.1 DKIM_INVALID           DKIM or DK signature exists, but is not =
valid
  0.0 FSL_BULK_SIG           Bulk signature with no Unsubscribe
X-Spam-Flag: YES
Subject:  ***SPAM***  EMAIL_SUBJECT
This is a multipart message in MIME format.

By the looks of things, the email has no body content, but just legitimate attachments that the user chose to send to the other user. In my mind, this is a legit use of emailing... But clearly not according to SpamAssassin...

1) How do you guys get around this other than actually going and changing the score either user-specific or server-wide?

2) Can someone explain why PYZOR_CHECK is unhappy and scording 1.8 there?

3) What's the difference between BAYES_99 and BAYES_999 and what exactly don't they like?

4) SB_GIF_AND_NO_URIS: That's just in almost everyone's email signature isn't it? An image that is their company logo or similar why is this an issue? :facepalm:

 

[cPRex]

Hey there! I think the answers to 1 and 2 can be found in the discussion here:

Re: Config option to skip pyzor check on empty body emails?

www.mail-archive.com

I'm not sure there is an answer we can provide for number 3. SpamAssassin's bayesian filtering is based on learning from previous messages marked as spam, so it could be what they don't like is unique to your particular environment. If you have a few hundred emails, it might be worth trying to re-train SpamAssassin to better recognize the email your systems handle - Tutorial - How To Train SpamAssassin with SA-Learn

For number 4, the documentation for SB_GIF_AND_NO_URIS says this:

"Explanation The mail has an attachment of the MIME-type "image/gif" but the body does not contain a URI and an email address."

Is that the case with your particular signature?