So, still dealing with spam issues (although minor so I’ve just been dealing with them). Today decided to look into asking for advice on my two problems, 1) spam getting through and 2) emails getting incorrectly marked as spam. Would love some insight or advice…
Starting with spam getting through, I have SA set to 1. I’m not an SA expert, but here are the SA headers from a spam I received recently and a couple comments (typical html porn spam with images hosted on .ru servers)…
X-SpaX-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on 39d5d113b0b5
X-Spam-Report:
* -0.0 BAYES_20 BODY: Bayes spam probability is 5 to 20%
* [score: 0.1648]
* 0.0 T_PDS_PRO_TLD .pro TLD
* [URI: prosept.pro (pro)]
* 0.0 HTML_MESSAGE BODY: HTML included in message
* 0.0 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image
* area
* 0.1 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME
* 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was
* blocked. See
* http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
* for more information.
* [URIs: benchmarkemail.com]
* -5.0 RCVD_IN_DNSWL_HI RBL: Sender listed at https://www.dnswl.org/,
* high trust
* [195.140.146.15 listed in list.dnswl.org]
* 0.1 URIBL_SBL_A Contains URL's A record listed in the Spamhaus SBL
* blocklist
* [URIs: images.benchmarkemail.com]
* 1.6 URIBL_SBL Contains an URL's NS IP listed in the Spamhaus SBL
* blocklist
* [URIs: images.benchmarkemail.com]
* -0.0 T_SCC_BODY_TEXT_LINE No description available.
X-Spam-Status: No
A couple of concerns I have with this are the old 2018 version of SA which has a pretty significant DOS vuln (CVE-2019-12420) and a blocked URIBL. Considering that the SA version is not being kept up to date, I’m assuming neither are the URIBL (also concerned about other code on the Helm not being kept current).
Additionally, the -5 points received for the IP in DNSWL is incorrect. Checking with the DNSWL directly…
…and images.benchmarkemail.com is clearly identified in a URIBL (glad to see at least one getting through)…
…but that wasn’t enough to override the incorrect DNSWL -5 score. 
@helm_community , is there anyway we can get SA updated to resolve CVE-2019-12420 as well as to update URIBL please? Not sure what can be done about that innacurate dnswl.org score.
OK, now my questions about whitelisting. I’ve been using sieve, but I don’t know if incorrectly or if I’m just not understanding how it works. I’ve never used sieve scripts before, so it’s highly likely. 
Using Sieve 0.6.1 add-on for Thunderbird. For some reason it seems that my scripts work for a few days, and then stop. Reconnecting and re-saving my script seems to fix things for a short time. It almost seems like the scripts are working only while the add-on is connected (client side?!?!) or are just ignored after a while.
Here are some examples of if statements I’ve tried that all work for a few days, then begin to fail resulting in all targeted emails getting dropped into spam.
require ["include", "fileinto", "imap4flags"];
if anyof(address :is :domain "from" "wirelesstag.net", address :is :domain "from" "ecowitt.net") {
fileinto "Inbox";
}
if address :is :domain "from" "wirelesstag.net" {
fileinto "Inbox";
}
if address :is "from" "support@ecowitt.net" {
fileinto "Inbox";
}
Any advice on getting something working permanently would be greatly appreciated! 
Thanks!
