SPAM & Content Filtering

[timcardk]

Hi There,

A mail was found to be a false positive;
The SMTP Log says;
"Mon, 24 May 2010 17:47:23 -> 195.231.246.134 -> Success: Action=[Accept Connection], Details=[Port 25]
Mon, 24 May 2010 17:47:23 -> 195.231.246.134 -> Success: Action=[Received Hello], Details=[Host=hydra.uif-server.uni-c.dk]
Mon, 24 May 2010 17:47:23 -> 195.231.246.134 -> Success: Action=[Accept Connection], Details=[Port 25]
Mon, 24 May 2010 17:47:23 -> 195.231.246.134 -> Success: Action=[Received Hello], Details=[Host=hydra.uif-server.uni-c.dk]
Mon, 24 May 2010 17:47:23 -> 195.231.246.134 -> Success: Action=[Received Sender], Details=[foraeldreintra@skoleintra.dk]
Mon, 24 May 2010 17:47:23 -> 195.231.246.134 -> Success: Action=[Received Sender], Details=[foraeldreintra@skoleintra.dk]
Mon, 24 May 2010 17:47:24 -> 195.231.246.134 -> Success: Action=[SPF Check], Details=[Domain=skoleintra.dk, Result=NONE]
Mon, 24 May 2010 17:47:24 -> 195.231.246.134 -> Success: Action=[Received Recipient], Details=[tim@familien.carstensen.name]
Mon, 24 May 2010 17:47:24 -> 195.231.246.134 -> Success: Action=[Start Mail Transaction]
Mon, 24 May 2010 17:47:24 -> 195.231.246.134 -> Success: Action=[SPF Check], Details=[Domain=skoleintra.dk, Result=NONE]
Mon, 24 May 2010 17:47:24 -> 195.231.246.134 -> Success: Action=[Received Recipient], Details=[helle@familien.carstensen.name]
Mon, 24 May 2010 17:47:24 -> 195.231.246.134 -> Success: Action=[Start Mail Transaction]
Mon, 24 May 2010 17:47:24 -> 195.231.246.134 -> Success: Action=[Bayesian Scoring], Details=[Score=12.21%]
Mon, 24 May 2010 17:47:24 -> 195.231.246.134 -> Success: Action=[Complete Mail Transaction], Details=[From Host=hydra.uif-server.uni-c.dk, Size=2 KB, From=foraeldreintra@skoleintra.dk, To=tim@familien.carstensen.name]
Mon, 24 May 2010 17:47:24 -> 195.231.246.134 -> Success: Action=[Close Connection]
Mon, 24 May 2010 17:47:24 -> 195.231.246.134 -> Success: Action=[Bayesian Scoring], Details=[Score=12.21%]
Mon, 24 May 2010 17:47:24 -> 195.231.246.134 -> Success: Action=[Complete Mail Transaction], Details=[From Host=hydra.uif-server.uni-c.dk, Size=2 KB, From=foraeldreintra@skoleintra.dk, To=helle@familien.carstensen.name]
Mon, 24 May 2010 17:47:24 -> 195.231.246.134 -> Success: Action=[Close Connection]
"

How can I see what spam filter that trapped this false positive?

Thanks
Tim

[rob]

When a mail is registered as SPAM, a log entry will appear in the SMTP logs that says SPAM Detected. Looking at hte log you provided the mail passed through the system without triggering a filter. I can therefore assume this was something in your content filtering rules which triggered is SPAM. I would recommend examining any SPAM related rules and ensuring they are setup correctly.