SpamAssassin Scoring

[neil154]

Please help me in understanding SpamAssassin and BoxTrapper a little better.

I am getting a lot of spam email don't understand it. I have SpamAssassin set at 5 and BoxTrapper set to 9.9. Below is the header from a typical header which shows a spam score of 24, spam status of no, score = 2.4.

1) I don't understand the difference between the 2 spam numbers. Which numbers do SpamAssassin use and which numbers do BoxTrapper use?
2) The X Ham report in the header shows " has identified this incoming email as possible spam" so again why did I get the email?

X-Spam-Status: No, score=2.4
X-Spam-Score: 24
X-Spam-Bar: ++
X-Ham-Report: Spam detection software, running on the system "ecbiz124.inmotionhosting.com", has  identified this incoming email as possible spam.  The original message  has been attached to this so you can view it (if it isn't spam) or label  similar future email.  If you have any questions, see  root\@localhost for details.

 

[cPanelMichael]

Hello

You have to multiply 2.4 by 10 to get the "X-Spam-Score" value. Here is an explanation from a support ticket you might find useful:

What happens is that the spam score people are used to dealing with are decimal values, and not integer values (e.g. 1.5, 30.9, 6.4, etc.). When SpamAssassin passes the value to whatever, it passes it as an integer, but to do that without losing any part of the score, it multiplies that decimal value, by 10. So when it does that, your score then becomes a 15 instead of 1.5, or a 309 instead of a 30.9 and so on.

You can see this change take place within the headers of the emails since there are two headers that contain the spam scores. You have the more general X-Spam-Status which has two things, is it spam and the score that us humans are used to (the decimal score). Whereas X-Spam-Score has the score that's passed to other programs, the integer score, which is 10 times the previous score listed in X-Spam-Status.

Thank you.

 

[neil154]

Okay I am starting to better understand. So in the case I described the X Spam score is 24 and this should be the value used to determine the status of the email. Since I have BoxTrapper set to 9.9 why did the email get past BoxTrapper. Also I have Spamassassin set to 5 so why did it get past SpamAssassin? The header information says that it looked like spam so once again I don't know why the spam status is "No".

Please help me understand the issues, my spam mail is driving me crazy but I am using it for business account so I really don't want to miss any real emails for my business.

Thank you for your help!

 

[cPanelPeter]

Hello,

The 24 is actually 2.4 (one of the X-SPAM headers will strip the .) so it looks like 24, but is in reality 2.4.
2.4 is less than 5 and less than 9.9, so that's why it is passing.

 

[neil154]

Hello,

The 24 is actually 2.4 (one of the X-SPAM headers will strip the .) so it looks like 24, but is in reality 2.4.
2.4 is less than 5 and less than 9.9, so that's why it is passing.

Okay, that makes sense. I also assume that even though the header said that it looks like spam it was passes and spam status set to no because of my 5 & 9.9. settings?

 

[cPanelMichael]

That is correct. It was less than your defined score so it was not marked as SPAM.

Thanks.

 

[neil154]

Thanks for the clarification