Best way to handle spurious fuzzy_denied messages?

[Dan Swartzendruber]

So I just got an email from my VISA company (chase.com).  Rspamd flagged it due (primarily) to FUZZY_DENIED (which got a score of 7.5).  I learned it as ham, but it is still flagged because the number was so high.  Here learn_ham score:

Results for file: 1460049752.M618792P7992.mailserver,S=9771,W=9990:2,S (0.326 seconds)
[Metric: default]
Spam: true
Score: 10.50 / 15.00
Action: add header
Symbol: BAYES_HAM (-2.99)[99.99%]
Symbol: DMARC_POLICY_REJECT (2.00)[alertsp.chase.com]
Symbol: FUZZY_DENIED (7.50)[1:76b441a91d:0.62]
Symbol: HFILTER_HELO_UNKNOWN (2.00)
Symbol: MIME_HTML_ONLY (1.00)
Symbol: R_DKIM_REJECT (1.00)[alertsp.chase.com]
Symbol: URIBL_BLOCKED (0.00)[chase.com.multi.uribl.com]
Message-ID: 1959231193.15198025.1460...@cigp02b4a009.svr.us.jpmchase.net

Sorry, the original scrolled off the screen.  What is the best way to handle this?  Reduce the scoring for fuzzy matches?  Whitelist these senders instead?  If the second, I have a relatively small number of senders I'd like to whitelist.  Is the best way to have a multimap rule that sets a large negative score?  Set 'want_spam = yes' or whatever?  Thanks...

[Alexander Moisseev]

четверг, 7 апреля 2016 г., 21:18:38 UTC+3 пользователь Dan Swartzendruber написал:

Sorry, the original scrolled off the screen.  What is the best way to handle this?  Reduce the scoring for fuzzy matches?  Whitelist these senders instead?  If the second, I have a relatively small number of senders I'd like to whitelist.  Is the best way to have a multimap rule that sets a large negative score?  Set 'want_spam = yes' or whatever?  Thanks...

You can "whitelist" just the `FUZZY_DENIED` symbol for that senders with `settings`.

rspamd.conf.local:

settings {
    subscribe_ru {
        priority = high;
        from = "gl...@mail.subscribe.ru";
        from = "/^namma[0-9]{8}@subscribe\.ru$/";
        apply "default" {
            FUZZY_DENIED = 0.0;
        }
    }
}
 
https://rspamd.com/doc/configuration/settings.html

[Dan Swartzendruber]

Ah, thanks!

On Thursday, April 7, 2016 at 2:18:38 PM UTC-4, Dan Swartzendruber wrote:

So I just got an email from my VISA company (chase.com).  Rspamd flagged it due (primarily) to FUZZY_DENIED (which got a score of 7.5).  I learned it as ham, but it is still flagged because the number was so high.  Here learn_ham score:

Results for file: 1460049752.M618792P7992.mailserver,S=9771,W=9990:2,S (0.326 seconds)
[Metric: default]
Spam: true
Score: 10.50 / 15.00
Action: add header
Symbol: BAYES_HAM (-2.99)[99.99%]
Symbol: DMARC_POLICY_REJECT (2.00)[alertsp.chase.com]
Symbol: FUZZY_DENIED (7.50)[1:76b441a91d:0.62]
Symbol: HFILTER_HELO_UNKNOWN (2.00)
Symbol: MIME_HTML_ONLY (1.00)
Symbol: R_DKIM_REJECT (1.00)[alertsp.chase.com]
Symbol: URIBL_BLOCKED (0.00)[chase.com.multi.uribl.com]

Message-ID: 1959231193.15198025.1460049374844.JavaMail.wasadm@cigp02b4a009.svr.us.jpmchase.net