[Rspamd-Users] messages tagged as spam when sending encrypted and signed via Thunderbird

[Carsten Rosenberg]

Hi

Am 23.04.20 um 09:32 schrieb Stefan Bauer:
>> 2020-04-23 02:33:45 #3322(rspamd_proxy) <652600>; proxy;
>> rspamd_task_write_log: id:
>> <748bc1f3-093a-fde1-f3d1-a8e5e3c8a809 at example.com>, qid: <3C086EB2FF>,
>> ip: 69.133.29.184, user: dmehler at example.com, from:
>> <dmehler at example.com>, (default: T (rewrite subject): [4.80/15.00]
>>
>> [KEYWORD_BL(5.00){},MIME_GOOD(-0.20){multipart/encrypted;},ARC_NA(0.00){},ASN(0.00){asn:10796,
>> ipnet:69.133.0.0/18,
>> country:US;},FREEMAIL_ENVRCPT(0.00){gmail.com;},FREEMAIL_TO(0.00){
>> gmail.com
>> ;},FROM_EQ_ENVFROM(0.00){},FROM_HAS_DN(0.00){},MID_RHS_MATCH_FROM(0.00){},MIME_TRACE(0.00){0:+;1:~;2:~;},RCPT_COUNT_ONE(0.00){1;},RCVD_COUNT_ZERO(0.00){0;},TAGGED_RCPT(0.00){},TO_DN_NONE(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){}]),
>> len: 8305, time: 568.794ms, dns req: 1, digest:
>> <04f566a27ec72c984ce9fac2cdafc07d>, rcpts:
>> <dave.mehler at gmail.com,example at gmail.com>, mime_rcpts:
>> <dave.mehler at gmail.com,>

The threshold for rewrite subject seems to be very low on your
installation or you have a maybe a force_action set.

Also KEYWORD_BL is non-default, maybe there is multimap matching on
these mails.

Removing the KEYWORD_BL the mail would have a negative score.


--

Carsten