Test email to myself marked as [-SPAM-]

[#1]

This is not a new problem.  I first noted this on 27th September and raised a question.
Your comment  9:25pm, Thursday 27th September 2007
[Support Wizard Journey]
[I\'m getting email marked as spam that isn\'t]
[Additional Information]
Twice in the past two days I have sent an email to another mailbox on this account that has failed to be delivered because it has been labelled as SPAM. If it is not delivering mail that I know about I can have no confidence about emails sent where I cannot know if it has been delivered. The spam filtering is either set up wrong or is too aggressive. I don\'t know if http://usertools.plus.net/status/archive/1190742288.htm is relevant.
Bob
Copied To: xxxx
Your comment 9:40pm, Thursday 27th September 2007
Uploaded file attachment.
Name: false-positive-spam.txt
Type: text/plain
Download Attachment
Your comment 9:40pm, Thursday 27th September 2007
the full header and contents is attached

xxxx CSC Analyst 7:50am, Saturday 29th September 2007
Dear xxxx,
Thanks for letting us know. In order to help train the spam filter I suggest forwarding a copy of the mail to notspam@despamchecker.plus.com
This will then train the system that mails of this type are not spam.
Regards, xxxx

The problem has continued since then. and I didn't see why it would be necessary to train the spamchecker in this instance.
More recently other emails are being marked as spam including newsletters from Marks & Spencer, Odeon and a daily weather update from Metcheck.  Attempting to train the spamchecker is pointless.  The emails are still marked as spam.
I have no faith at all in the process and for me the false positives are far more irritating than false negatives.  I now do all spamchecking at this end using K9 which hsn't put a foot wrong so far.
bobp

[#2]

That you for that Bobp - it is interesting to hear that it might have been a problem for so long.
I have noticed recently that occasional emails auto-generated from my site on the CGI platform and sent to me have been labelled as spam, but never with 14 out of 15 factors as 0.99000.
I have just sent another test email to myself and received the same result as 16 hours ago.
I also received a reply from CS who seemed unaware that a priority problem had been raised.

[#3]

Quote from: Bob

I doubt the other topic's related Tony. I've failed to replicate either of the problems those customers are reporting and I'm more inclined to think they're dealing with a configuration problem, although of course I could be wrong!

Oi.
It does sound to me like this could somehow be related to the problem I had... it wouldn't explain why one e-mail made it and one didn't (and yes, I've checked it was sent to the right e-mail address etc.), but if the spam platform really is just randomly accusing inter-vISP e-mails of being spam when it shouldn't be, it probably would explain what happened to my e-mail.

[#4]

We're retraining dspam with clean emails at the moment. Once this has completed we should stop seeing these problems.

[#5]

Training the DSPAM filters may not help.
I just sent 3 text emails to myself. The first and last were marked as spam and middle one was marked as 'ham'.
Header X-DSPAM-Factors were:

Quote

X-DSPAM-Result: Innocent X-DSPAM-Processed: Sat Nov  3 07:19:13 2007 X-DSPAM-Confidence: 0.6391 X-DSPAM-Improbability: 1 in 178 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Factors: 27, Delivery-date*Nov, 0.00143, Delivery-date*03+Nov, 0.00712, Received*03+Nov, 0.00712, Received*03+Nov, 0.00712, Support+<, 0.00813, Received*Nov+2007, 0.99000, Received*Nov+2007, 0.99000, Software+(UK), 0.01000, format+At, 0.99000, Date*Nov+2007, 0.99000, Date*Nov, 0.02326, Date*3+Nov, 0.03327, Received*Nov, 0.03397, Received*Nov, 0.03397, Subject*test, 0.04235, Content-Disposition*filename="winmail.dat", 0.05971, Content-Type*name="winmail.dat", 0.05974, Content-Type*tnef, 0.05982, Content-Type*application/ms+tnef, 0.05982, Content-Type*application/ms, 0.05982, Tony, 0.06094, X-Mailer*11, 0.07201, X-Mailer*Outlook+11, 0.07201, Date*07+19, 0.07293, a+test, 0.07358, Content-Disposition*attachment, 0.09784, Content-Type*multipart/mixed, 0.10478

and for the spam ones (parts disguised):

Quote

X-DSPAM-Result: Spam X-DSPAM-Processed: Sat Nov  3 07:21:29 2007 X-DSPAM-Confidence: 0.5716 X-DSPAM-Improbability: 1 in 134 chance of being ham X-DSPAM-Probability: 1.0000 X-DSPAM-Factors: 15, From*"Wxxxxxn+Sxxxxxxe", 0.99000, Message-ID*PORTTONY>, 0.99000, Organization*Wxxxxxn, 0.99000, Organization*Wxxxxxn+Sxxxxxxe, 0.99000, Received*Nov+2007, 0.99000, Received*from+[84.92.80.121], 0.99000, From*Sxxxxxe", 0.99000, Date*Nov+2007, 0.99000, Received*(helo=PORTTONY), 0.99000, Received*[84.92.80.121]+(helo=PORTTONY), 0.99000, Reply-To*mydomain.co.uk>, 0.99000, Received*[84.92.80.121], 0.99000, From*"Wxxxxxn, 0.99000, From*mydomain.co.uk>, 0.99000, test+from, 0.01355

These factors are totally different even down to the fact that the spam ones both have only 15 factors.
I have looked back and the 'false' spam ones ALL have 15 factors and all of the rest of my emails have 27 factors.
I will add this information and the full headers to my CS ticket (ID: 23262442) and, if you don't mind Bob, I will copy them to a personal message to you.
Tony

[#6]

Hi Tony,
I've reopened the problem and got one of the network team looking at this.
Is anyone else seeing the same? If so I'd appreciate the headers, either here or via PM.

[#7]

HI Mand,
I have now done some further tests.
In 2 cases I have got EXACTLY the same emails marked as spam and ham.
In the first case, an email originally marked as spam was later marked as ham when sent again.
In the second case, an email was initially marked as ham and its duplicate was later marked as spam.
In both cases the ham and spam emails were identical - I had even copied and pasted the contents to be sure.
I'm not sure whether the number of factors is a red herring or not as I have been back through my emails and the only spam-marked ones I can find have had just 15 factors. It's almost as though they go through a different process...

[#8]

Mand,
Do you want me to send you a Personal Message with the headers of a pair of identical emails, one marked as 'spam' and the other as 'ham'?

[#9]

I've got some examples from my own testing Tony. Cheers for the help investigating this one though. It's appreciated

[#10]

The priority problem has now been 'downgraded'.
I have just sent myself another email - a duplicate of one I sent on Friday.
Todays (partial header - disguised):

Quote

X-DSPAM-Result: Spam X-DSPAM-Processed: Tue Nov  6 13:00:08 2007 X-DSPAM-Confidence: 0.5045 X-DSPAM-Improbability: 1 in 103 chance of being ham X-DSPAM-Probability: 1.0000 X-DSPAM-Factors: 15, Delivery-date*06+Nov, 0.00196, Received*06+Nov, 0.00360, From*"Wxxxxn+Sxxxxxxre", 0.99000, Message-ID*PORTTONY>, 0.99000, Organization*Wxxxxn, 0.99000, Organization*Wxxxxn+Sxxxxxxre, 0.99000, Received*from+[84.92.80.xxx], 0.99000, From*Sxxxxxxre", 0.99000, Received*(helo=PORTTONY), 0.99000, Received*[84.92.80.xxx]+(helo=PORTTONY), 0.99000, xxxxxxrX+Support, 0.01000, xxxxxxrX, 0.01000, Reply-To*mydomain.co.uk>, 0.99000, Received*[84.92.80.xxx], 0.99000, From*"Wxxxxn, 0.99000

Last Friday's equivalent:

Quote

X-DSPAM-Result: Spam X-DSPAM-Processed: Fri Nov  2 13:24:45 2007 X-DSPAM-Confidence: 0.5790 X-DSPAM-Improbability: 1 in 139 chance of being ham X-DSPAM-Probability: 1.0000 X-DSPAM-Factors: 15, From*"Wxxxxn+Sxxxxxxre", 0.99000, Message-ID*PORTTONY>, 0.99000, Organization*Wxxxxn, 0.99000, Organization*Wxxxxn+Sxxxxxxre, 0.99000, Received*Nov+2007, 0.99000, Received*from+[84.92.80.xxx], 0.99000, From*Sxxxxxxre", 0.99000, Date*Nov+2007, 0.99000, Received*(helo=PORTTONY), 0.99000, Received*[84.92.80.xxx]+(helo=PORTTONY), 0.99000, Reply-To*mydomain.co.uk>, 0.99000, Received*[84.92.80.xxx], 0.99000, From*"Wxxxxn, 0.99000, From*mydomain.co.uk>, 0.99000, Support+<, 0.01880

Either DSPAM is targeting me unduly aggressively, or the training has resulted in little (if any) improvement.

[#11]

Hi Tony,
Mine are far better, although I've just noticed the following:

X-DSPAM-Result: Whitelisted

Looks like the filter's seen enough of my emails to know that the legit stuff I'm getting definitely isn't spam.
More training, and the exclusion of our headers from the emails used to train are our next steps as per my reply to the other thread on this board.

[#12]

So Bob, what should I do - send myself loads of emails containing different texts and then do a 'not spam' for each of them?
The problem is that it is inconsistent - I just sent one and it came back 'innocent'.
Duplicate emails sent within a few minutes of each other get handled completely differently. Surely this must be a fault.
Sent 4 emails all the same. Numbers 1, 2 and 4 were marked as spam and number 3 got through as ham.

[#13]

Emails sent between usernames on my hosted domain are labelled as spam. eg user1@mydomain.co.uk to user2@mydomain.co.uk. I no longer use the @plus.com since the spam debacle.