Spamassassin has recently started assigning SPAM qualification
to perfectly respectable email.
What can I do about it?

--
Timothy Murphy
e-mail: gayleard /at/ eircom.net
tel: +353-86-2336090, +353-1-2842366
s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland

--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

On 01/13/2011 03:41 PM, Timothy Murphy wrote:
> Spamassassin has recently started assigning SPAM qualification
> to perfectly respectable email.
> What can I do about it?

Spamassassin tells you why it classified something in the headers.

X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on dell.pink
X-Spam-Level: **********
X-Spam-Status: Yes, score=10.2 required=5.0 tests=DNS_FROM_RFC_ABUSE,
INVALID_TZ_GMT,MIME_BASE64_TEXT,MIME_BOUND_DD_DIGI TS,
UNPARSEABLE_RELAY,X_MESSAGE_INFO autolearn=no version=3.1.0
X-Spam-Report:
* 3.6 MIME_BOUND_DD_DIGITS Spam tool pattern in MIME boundary
* 1.1 INVALID_TZ_GMT Invalid date in header (wrong GMT/UTC timezone)
* 3.5 X_MESSAGE_INFO Bulk email fingerprint (X-Message-Info) found
* 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay
* lines
* 1.5 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding
* 0.5 DNS_FROM_RFC_ABUSE RBL: Envelope sender in abuse.rfc-ignorant.org
Received: from dell.pink (localhost.localdomain [127.0.0.1])
by dell.littlepinkcloud.COM (8.13.5/8.13.5) with ESMTP id k48I3pMU013359
for <aph@localhost>; Mon, 8 May 2006 14:03:52 -0400

Andrew.
--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

On Thu, Jan 13, 2011 at 10:41 AM, Timothy Murphy <gayleard@eircom.net> wrote:
> Spamassassin has recently started assigning SPAM qualification
> to perfectly respectable email.
> What can I do about it?
>

This is what end up needing to do every 1-1.5 yrs on my mail server.
Take all of your incorrectly flagged email and put it into its own
folder/directory in your email system.

You have some options:

1. Review the score distribution among these emails and determine
which RULE(s) is offending/incorrect. Then reduce either the global
or local setting for that RULE(s). Or change your SPAM required_score
threshold to a higher number.

Example:
3.0 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
2.8 RCVD_HELO_IP_MISMATCH Received: HELO and IP do not match, but should

I think RCVD_IN_XBL should be only 1.0 instead of 3.0, so I modify:
~/.spamassassin/user_prefs

score RCVD_IN_XBL 1.00

You can also add whitelists.

2. Or you can re-sort your spam into 2 folders IS_SPAM (for actual
spam) and IS_HAM (for non spam, actual email) and rebuild the
journals/tokens for them:

# sa-learn --spam ~/mail/IS_SPAM
# sa-learn --ham ~/mail/IS_HAM

Hopefully this will make SpamAssassin relearn the correct matching.


I hope this helps. Read the spamassassin wiki for more ideas.
http://wiki.apache.org/spamassassin/

--
Mauriat Miranda
http://www.mjmwired.net/linux
--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

Andrew Haley wrote:

> On 01/13/2011 03:41 PM, Timothy Murphy wrote:
>> Spamassassin has recently started assigning SPAM qualification
>> to perfectly respectable email.
>> What can I do about it?
>
> Spamassassin tells you why it classified something in the headers.

Thanks very much for your response, which helps greatly.

I see that these messages lose a lot of points because
3.2 FH_DATE_PAST_20XX The date is grossly in the future
Not quite sure how that happened.

Actually, all my email, accepted or not,
has a warning about the time of the message.
I'm not sure how this has happened,
as all the machines involved seem to have the right time.

But I'll study the documentation,
and see if I can get to the bottom of it.

--
Timothy Murphy
e-mail: gayleard /at/ eircom.net
tel: +353-86-2336090, +353-1-2842366
s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland

--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

Mauriat Miranda wrote:

>> Spamassassin has recently started assigning SPAM qualification
>> to perfectly respectable email.
>> What can I do about it?

> This is what end up needing to do every 1-1.5 yrs on my mail server.
> Take all of your incorrectly flagged email and put it into its own
> folder/directory in your email system.
...
> I hope this helps. Read the spamassassin wiki for more ideas.
> http://wiki.apache.org/spamassassin/

Thanks for your response.
I'll follow your advice and study the documentation.

--
Timothy Murphy
e-mail: gayleard /at/ eircom.net
tel: +353-86-2336090, +353-1-2842366
s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland

--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

On 01/13/2011 12:31 PM, Timothy Murphy wrote:
> But I'll study the documentation,
> and see if I can get to the bottom of it.

Just out of curiosity, what email client are you using? I ask because
I'd like to get spamassassin working but I don't know how to integrate
it with what I have.
--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

> Thanks very much for your response, which helps greatly.
>
> I see that these messages lose a lot of points because
> 3.2 FH_DATE_PAST_20XX The date is grossly in the future
> Not quite sure how that happened.
>
> Actually, all my email, accepted or not,
> has a warning about the time of the message.
> I'm not sure how this has happened,
> as all the machines involved seem to have the right time.
>
> But I'll study the documentation,
> and see if I can get to the bottom of it.
>

There was an error with the regex matching within this rule that made it
break in 2010. It has since been fixed. Update spamassassin - either RPM
or using sa-update.

--Blake
--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

On Thu, 2011-01-13 at 12:44 -0800, Joe Zeff wrote:
> On 01/13/2011 12:31 PM, Timothy Murphy wrote:
> > But I'll study the documentation,
> > and see if I can get to the bottom of it.
>
> Just out of curiosity, what email client are you using? I ask because
> I'd like to get spamassassin working but I don't know how to integrate
> it with what I have.

If you're interested in spam filtering for email clients (rather than
servers) you may find Bogofilter easier to handle. I find it works very
well with Evolution.

poc

--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

On 01/13/2011 03:44 PM, Joe Zeff wrote:
> On 01/13/2011 12:31 PM, Timothy Murphy wrote:
>> But I'll study the documentation,
>> and see if I can get to the bottom of it.
>
> Just out of curiosity, what email client are you using? I ask because
> I'd like to get spamassassin working but I don't know how to integrate
> it with what I have.

What do you have?

Spamassassin can be integrated in a number of places. I believe that
the spamassassin RPM includes an example for procmail integration. Each
user can configure how they integrate spamassassin with their
.procmailrc file. Another point of interface can be as a sendmail
milter. Look for the spamass-milter RPM. I get mine from the
city-fan.org repo (along with slightly more up-to-date packages for
other related email support, including sendmail, dovecot, etc). Using
the spamass-milter, I no longer have a need for the procmail rules as my
spam gets recognized and dealt with when its transferred (as opposed to
when its delivered).

I have milters for SPF, Greylist, ClamAV, and SpamAssassin, and DNSBL
configured for spamcop.net, abuseat.org, spamhaus.org, and dsbl.org.

Altogether, they really do cut down on the amount of incoming SPAM.

--
Kevin J. Cummings
kjchome@verizon.net
cummings@kjchome.homeip.net
cummings@kjc386.framingham.ma.us
Registered Linux User #1232 (http://counter.li.org)
--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines

On 01/13/2011 01:29 PM, Patrick O'Callaghan wrote:
> If you're interested in spam filtering for email clients (rather than
> servers) you may find Bogofilter easier to handle. I find it works very
> well with Evolution.

How does either of them work with Thunderbird?
--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines