The results of the integrated SpamAssassin are written in the header of the mail, just like any other SpamAssassin. If you right-click on the mail in your Outlook and select "Message Options", a dialog appears in which you can view the Internet headers of the mail.
There you will find the spam report, which gives information about which rules have been applied to this mail:
X-Spam-Checker version: SpamAssassin 3.1.7 (2006-10-05)
* on server1.intranet.jam-software.com
* at Wed, 09 Apr 2008 15:56:40 +0200
X-Spam status: No, hits=1.0, required= 3.6, autolearn=no
X-Spam Report: * 0.5 HTML_40_50 BODY: Message is 40% to 50% HTML
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 0.0 BAYES_50 BODY: Bayesian spam probability is 40 to 60%
* [score: 0.5077]
* 0.2 HTML_TITLE_EMPTY BODY: HTML title contains no text
* -2.0 SP2E_BodyWordWLRule BODY: SP2E_BodyWordWLRule
* 2.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP address
* [220.127.116.11 listed in dnsbl.sorbs.net]
* 0.0 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
* [18.104.22.168 listed on zen.spamhaus.org]
* 0.3 URIBL_GREY Contains to URL listed in the URIBL greylist
* [URIs: googlepages.com]
Yes, the SpamAssassin used checks SPF records. The default settings for SPF can be found in 25_SPF.cf or the corresponding scores in 50_scores.cf. If you are using "Exchange Server Toolbox" the best way to set your own scores is to use the built-in editor for creating custom SpamAssassin config files which you can find under Spam Options.
For more information about the options, see:
Alternatively, you can manually create your own .cf file in which you define your "rules", this should only come last alphabetically, since SpamAssassin will evaluate the cf files in numerical-alphabetical order. (For example XMySettings.cf).
URIBL (http://www.uribl.com) is a DNS-based Blackhole List which tracks IP addresses which are commonly used for sending spam mails. URIBL is enabled by default for SpamAssassin installations but allows only a certain amount of requests from the same IP every day. If this amount is exceeded, any further requests will be blocked by the URIBL servers with the info notification above.
This typically happens for SpamAssassin installations that use public DNS resolvers such as Google. As any request that is forwarded via the Google servers has the same IP when it reaches the Blackhole list, all requests will share the same limit. For usage of an alternative DNS, please follow these instructions.
For the following domains it is currently useful to set up forwarding to ensure the full functionality of SpamAssassin:
Now determine the name server for each of the mentioned domains.
Open a command prompt and issue the following command (e.g. for "lists.dnswl.org"):
nslookup -querytype=ns list.dnswl.org.
list.dnswl.org nameserver = b.ns.dnswl.org
list.dnswl.org name server = c.ns.dnswl.org
b.ns.dnswl.org internet address = 22.214.171.124
c.ns.dnswl.org internet address = 126.96.36.199
c.ns.dnswl.org AAAA IPv6 address = 2600:3c01::21:1000
This happens if SpamAssassin finds rules with a score of zero. Tests with such a score a generally used in third party rule sets.
They check for a specific spam or ham sign but do not actually assign a score to leave it to the SpamAssassin admin if they want to use it or not to optimize their spam detection.
The message can be avoided by assigning a score to the related test or by removing the channel which belongs the particular rule from the sa-update call.
To assign a score, open 'local.cf' in the configuration directory (<%SACONFIGPATH%>) and add the line following line:
score YET_ANOTHER_TEST 0.0001