Hi all, I recently ran into a strange problem with the Amavis spam score. The headers of a received Spam mail contain the following spam score: Code: X-Spam-Status: Yes, score=8.418 tagged_above=1 required=4.5 tests=[BAYES_50=0.8, DCC_CHECK=1.1, DCC_REPUT_90_94=0.6, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, FROM_FMBLA_NEWDOM=1.499, FROM_SUSPICIOUS_NTLD=0.499, FROM_SUSPICIOUS_NTLD_FP=1.999, FSL_BULK_SIG=0.001, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, T_PDS_OTHER_BAD_TLD=0.01, URIBL_BLACK=1.7] autolearn=no autolearn_force=no When I test the mail manually using spamassassin -D -t , I get the following score: Code: Inhaltsanalyse im Detail: (19.1 Punkte, 5.0 benötigt) Pkte Regelname Beschreibung ---- ---------------------- -------------------------------------------------- 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the Spamhaus DBL blocklist [URIs: gallerysplit.xyz] 1.7 RCVD_IN_MSPIKE_L4 RBL: Bad reputation (-4) [18.104.22.168 listed in bl.mailspike.net] 3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS [22.214.171.124 listed in zen.spamhaus.org] 1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Transportiert via Rechner in Liste von www.spamcop.net [Blocked - see <https://www.spamcop.net/bl.shtml?126.96.36.199>] 2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL [188.8.131.52 listed in psbl.surriel.com] 1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist [URIs: gallerysplit.xyz] -0.0 SPF_HELO_PASS SPF: HELO-Name entspricht dem SPF-Datensatz 0.0 T_PDS_OTHER_BAD_TLD Untrustworthy TLDs [URI: gallerysplit.xyz (xyz)] -0.0 SPF_PASS SPF: Senderechner entspricht SPF-Datensatz 0.0 HTML_FONT_LOW_CONTRAST BODY: HTML-Schriftfarbe ähnlich der Hintergrundfarbe 0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted Colors in HTML 0.0 HTML_MESSAGE BODY: Nachricht enthält HTML 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 1.1 DCC_CHECK Als Massen-E-Mail erkannt von DCC (dcc-servers.net) 0.4 DCC_REPUT_90_94 DCC reputation between 90 and 94 % 2.0 FROM_SUSPICIOUS_NTLD_FP From abused NTLD 0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted 0.5 FROM_SUSPICIOUS_NTLD From abused NTLD 0.1 DKIM_INVALID DKIM or DK signature exists, but is not valid 1.5 FROM_FMBLA_NEWDOM From domain was registered in last 7 days 0.0 FSL_BULK_SIG Bulk signature with no Unsubscribe As you can see, only the URIBL blacklist was checked through amavisd, the other ones (RCVD_IN_SBL_CSS, RCVD_IN_BL_SPAMCOP_NET, ...) were not. This results in a different score. Debian version: 9.12 Amavisd-new version: 2.10.1 SpamAssassin version: 3.4.2 Postfix version: 3.1.14 The server was set up using this tutorial and runs the latest ISPConfig 3.1.15p3. I already made sure that the following is set in /etc/amavis/conf.d/20-debian-defaults: Code: $sa_local_tests_only = 0; And added the following to /etc/spamassassin/local.cf: Code: dns_server 127.0.0.1 # added to fix blocking of URIBL and DNSWL queries Does anyone know what the problem could be?