This stuff probably should go on the wiki if other people validate it, but I wanted to share a couple things I have done recently that have significantly improved my spam detection without increasing false positives.
1) The RBLs, which I know some people (including forum moderators) like a lot, and others (including forum moderators) don't like at all, each assign a score to the message. My own experience has been that having hits on three RBLs won't give a sufficient score to push the message over the "tag" threshold even if you don't have pesky things like the auto-whitelist getting in the way. Lowering the tag percentage from 33 to 29 (admin gui, Global Settings, AS/AV) lowers the actual point-score required from 6.2 to 5.8, and this is enough to make a big difference on multi-RBL spam.
2) The Bayesian filters alone can't get a message tagged as spam either--this one opens a big debate because some feel that the "Spam" designation should be reserved for the real unrepentent bulk emailers and not for other purveyors of junk that (at least in theory) you can unsubscribe from. I find that from my users' perspective this doesn't wash because I have beat into their heads that unsubscribe links are poison and shouldn't be used, and because they tell me "If I say it's spam, I want your server to treat it as spam!"
I fixed this issue by raising the scores for high-hit Bayesian messages. I added the following lines to the bottom of my /opt/zimbra/conf/spamassassin/local.cf file:
The scores for bayes negatives or equivocals are unchanged, but this adds an extra point and a half to the extreme high scores and saves me a lot of moaning from users.
#My tweaks to the Bayes scoring system - DWM
score BAYES_00 0.0001 0.0001 -2.312 -2.599
score BAYES_05 0.0001 0.0001 -1.110 -1.110
score BAYES_20 0.0001 0.0001 -0.740 -0.740
score BAYES_40 0.0001 0.0001 -0.185 -0.185
score BAYES_50 0.0001 0.0001 0.001 0.001
score BAYES_60 0.0001 0.0001 1.0 1.0
score BAYES_80 0.0001 0.0001 2.5 2.5
score BAYES_95 0.0001 0.0001 5.5 5.5
score BAYES_99 0.0001 0.0001 6.5 6.5
3) I had several messages that, despite the high Bayes score, have been getting through due to an evil little entry called the Bonded Sender Program. Now I know there are people who believe in the BSP, and I really don't want to get in a flame war, but essentially this is a program whereby those who subscribe to the program--for a price and agreement to follow certain rules of conduct--get a pass to send unsolicited messages. Spamassassin gives BSP hits a -4.5 score, which pretty well overrides everything else you've done and makes the message come through anyhow (BSP's own website actually advocates a -100 score! ).
Now I and my users don't want somebody else's business client list overriding our own opinions of what's junk, so I added the following to my local.cf file:
and that took care of those messages. Interestingly, with a score of zero, the BSP score doesn't even show in the header of messages that were using it to get through before I made the change.
# Score to eliminate Bonded Sender Program (BSP) whitelisting
score RCVD_IN_BSP_TRUSTED 0
score RCVD_IN_BSP_OTHER 0
score RCVD_IN_BONDEDSENDER 0
Anyway, hope this is helpful to some of the rest of you. Now if we could just get that pesky auto-whitelist to behave. . .