Results 1 to 8 of 8

Thread: Spam weirdness

Hybrid View

  1. #1
    Join Date
    Jul 2007
    Location
    San Jose, CA
    Posts
    1,027
    Rep Power
    10

    Angry Spam weirdness

    This is for all you SpamAssassin gurus out there. I have a specific low-volume commercial emailer--low enough not to get on all the blacklists because he targets construction dealers such as us--for whom the only real key (short of blacklisting a domain) that would really catch all his junk is the fact that he's in Singapore, so all his emails come to me as future-dated. Here's a header that shows that in fact, the future dating is being recognized by SpamAssassin:
    No, score=3.896 tagged_above=-10 required=4 tests=[BAYES_50=0.001, DATE_IN_FUTURE_12_24=2.189, DEAR_SOMETHING=1.605, HTML_MESSAGE=0.001, RDNS_NONE=0.1]
    That's not enough to get him tagged as spam in my system, and I'm a little reluctant to lower my threshold even further than I already have overall. However, if I could raise that DATE_IN_FUTURE_12_24 to a higher score, say an even 3 points, it would solve my problem.

    I tried to do this by adding the following lines to my /opt/zimbra/conf/spamassassin/local.cf:
    Code:
    # Increase future date score to control Asian spam
    score DATE_IN_FUTURE_24_48 3.599 3.599 3.599 3.599
    I have a variety of other settings in local.cf that appear to be working, including enhanced Bayes scoring and commercial whitelist penalties. However this particular line seems to refuse to work at all. I've tried it both with the single score and all four scores, neither way works.

    Can anyone point me in the direction of why this line, among all the others, is being ignored?

    In case there is an issue with conflicting rules or orders, here is my entire local.cf:
    Code:
    #My tweaks to the Bayes scoring system - DWM
    score BAYES_00 0.0001 0.0001 -2.312 -2.599
    score BAYES_05 0.0001 0.0001 -1.110 -1.110
    score BAYES_20 0.0001 0.0001 -0.740 -0.740
    score BAYES_40 0.0001 0.0001 -0.185 -0.185
    score BAYES_50 0.0001 0.0001 0.001 0.001
    score BAYES_60 0.0001 0.0001 1.0 1.0
    score BAYES_80 0.0001 0.0001 2.5 2.5
    score BAYES_95 0.0001 0.0001 5.5 5.5
    score BAYES_99 0.0001 0.0001 6.5 6.5
    
    # Score to penalize Bonded Sender Program (BSP) whitelisting
    score RCVD_IN_BSP_TRUSTED 2
    score RCVD_IN_BSP_OTHER 2
    score RCVD_IN_BONDEDSENDER 2
    
    # Score to penalize Habeas whitelisting
    score HABEAS_ACCREDITED_COI 2
    score HABEAS_ACCREDITED_SOI 2
    score HABEAS_CHECKED 2
    
    # Score to penalize ISIPP/IADB SuretyMail whitelisting
    score RCVD_IN_IADB_VOUCHED 2
    score RCVD_IN_IADB_DOPTIN 2
    score RCVD_IN_IADB_ML_DOPTIN 2
    
    # Score to penalize DNSWL whitelisting
    score RCVD_IN_DNSWL_LOW 2
    score RCVD_IN_DNSWL_MED 2
    score RCVD_IN_DNSWL_HI 2
    
    # Turn off 'Auto-Whitelist'
    use_auto_whitelist 0
    
    # Increase future date score to control Asian spam
    score DATE_IN_FUTURE_24_48 3.599 3.599 3.599 3.599
    Thanks, folks!

    Dan

  2. #2
    Join Date
    Jan 2008
    Posts
    9
    Rep Power
    7

    Default Did you try a spamassassin LINT?

    May be it would say if there is a conflict...

  3. #3
    Join Date
    Jul 2007
    Location
    San Jose, CA
    Posts
    1,027
    Rep Power
    10

    Default

    The spamassassin utilities are not loaded with Zimbra, so no, I have not. I may have to download them and cobble them in but like to avoid messing with the install if I can help it. . .

  4. #4
    Join Date
    Jan 2008
    Posts
    9
    Rep Power
    7

    Wink A quick workaround

    Add a new rule with the same catch condition as the original one... New name with the added score...
    This way the message would trigger one additional rule and that's it...

    Hope it helps.

  5. #5
    Join Date
    Jul 2007
    Location
    San Jose, CA
    Posts
    1,027
    Rep Power
    10

    Default

    Well Mike almost hit it yesterday in an offline chat, but I just noticed what is probably the problem this morning. The header shows a hit in DATE_IN_FUTURE_12_24 and I was changing the scores for _24_48. I have now revised the CORRECT rule in local.cf and will post back success or failure based on the next emails that come in.

    Don'cha just hate how these damn computers can't read our minds?

  6. #6
    Join Date
    May 2006
    Location
    USA
    Posts
    6,242
    Rep Power
    21

    Default

    Told him to edit as they stood in the regular scores file - then bug me if they didn't apply when he stuck them in local.cf

    Possibilities include:
    DATE_IN_FUTURE_03_06
    DATE_IN_FUTURE_06_12
    DATE_IN_FUTURE_12_24
    DATE_IN_FUTURE_24_48
    DATE_IN_FUTURE_48_96
    DATE_IN_FUTURE_96_XX
    From the other side:
    DATE_IN_PAST_03_06
    DATE_IN_PAST_06_12
    DATE_IN_PAST_12_24
    DATE_IN_PAST_24_48
    DATE_IN_PAST_96_XX

Similar Threads

  1. Spam/Ham training under Outlook/Thunderbird/etc.
    By chuckm in forum Administrators
    Replies: 23
    Last Post: 03-18-2009, 12:01 PM
  2. Trying to understand Zimbra's anti-spam system
    By TaskMaster in forum Users
    Replies: 11
    Last Post: 01-25-2008, 09:59 AM
  3. Spam Tag/Bayes Filter weirdness
    By SpecialKdkj in forum Administrators
    Replies: 4
    Last Post: 12-14-2007, 01:55 PM
  4. Spam being scored with BAYES_00
    By flyerguybham in forum Administrators
    Replies: 6
    Last Post: 04-24-2007, 01:07 PM
  5. Training spam and ham
    By Justin in forum Developers
    Replies: 2
    Last Post: 10-31-2006, 03:39 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •