I'll need more info.  The headers of the message as it
        arrives in your inbox the output of 
                  ChrisP.
      
        Quite a few emails are getting tagged as spam. Here's one
          example. An email from Arcamax.com (my daily comics) always
          gets a [Spam 10]. I've forwarded it to notspam several times
          with no results. When I paste the source into my "test" block
          and run it, I see: 
         
        This message: url: facebook.com 1 
        This message: url: nexac.com 1 
        This message: url: rlcdn.com 5 
        This message: url: arcamax.com 66 
        This message: url: .com 1 
        This message: url: bookdaily.com 1 
        This message: exip: 216.174.43.154 
        
        This message: bodyhash: 186925 2065185 2991893 557120
          587432 
        This message: source: bad base testfile.tmp 
        Best Match: X-Aspam: Total 1.8 
        Best Match: X-Aspam: Best match was sample
          aspam_good\m362.msg 
        
        Best Match: X-Aspam: URLS scored 0.8 dailyink.com
          facebook.com twitter.com arcamax.com bookdaily.com 
        Best Match: X-Aspam: Words 0.0 +cartoons -educate -february
          +eat -jerry -fwd --0500 +comment -sender 
        Poly: 0.0 
        Aspam: -1.8 
        Mfilter: 1.1 *: 1.050000 SPF Pass=-0.5, dnswl_none=-0.1,
          High tags-to-text ratio=1.8, Low text-to-images ratio=1.0,
          tenplus images=0.6, Aspam=-1.8 
         
        -1.8 doesn't look bad. In addition I have this in my
          mfilter.rul: 
         
        if (isin(From,HIDDEN@ax.com")) then 
        call whitelist("Whitelist") 
        accept "Whitelist" 
        end if 
         
         
         
        What have I missed?