KAM_QUITE_BAD_DNSWL Interception

[info.it]

I've encountered a problem, the same sender sends two emails to the same recipients at different times, the first one passes through the mail gateway normally, but the second one is added to the spam queue by the mail gateway, and I found the second email is KAM_QUITE_BAD_DNSWL(3.25) and RCVD_IN_BL_SPAMCOP_NET(1.246) is too high, but both the sender and recipient are the same. RCVD_IN_BL_SPAMCOP_NET(1.246) This value is too high, but why there are two different results under the same sender and recipient.
Normal mail logging
2024-07-28T23:14:47.377559+08:00 pmg01 pmg-smtp-filter[228752]: 80165866A660614C0EB: SA score=0/5 time=3.815 bayes=undefined autolearn= disabled hits=ARC_SIGNED(0.001),ARC_VALID(0.001),DKIM_INVALID(0.1),DKIM_SIGNED(0.1),DMARC_PASS(-0.1),HTML_IMAGE_RATIO_04(0.001), HTML_MESSAGE(0.001),KAM_DMARC_STATUS(0.01),RCVD_IN_MSPIKE_H2(-0.001),SPF_HELO_PASS(-0.001),SPF_PASS(-0.001)

Determine spam records:
2024-07-29T09:46:05.259593+08:00 pmg01 pmg-smtp-filter[244664]: 80170666A6F457DB604: SA score=3/5 time=4.776 bayes=undefined autolearn= disabled hits=ARC_SIGNED(0.001),ARC_VALID(-0.1),DKIM_INVALID(0.1),DKIM_SIGNED(0.1),DMARC_PASS(-0.1),HTML_IMAGE_RATIO_06(0.001),HTML _MESSAGE(0.001),KAM_DMARC_STATUS(0.01),KAM_QUITE_BAD_DNSWL(3.25),RCVD_IN_BL_SPAMCOP_NET(1.246),RCVD_IN_DNSWL_HI(-1),RCVD_IN_MSPIKE _H2(-0.001),SPF_HELO_PASS(-0.001),SPF_PASS(-0.001)

Translated with www.DeepL.com/Translator (free version)

 

[mbrother]

Hi,

Maybe the content of your email has URL listed in blacklist of Spamhaus (KAM_QUITE_BAD_DNSWL) or SpamCop (RCVD_IN_BL_SPAMCOP_NET)?