Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 480
  • Last Modified:

SpamAssassin problem

Hi Experts.

My question is: Can i modify the custom rules that spamassassin uses?..

i want to do this because some mails that we are receiving are being marked as spam and they really are not.  We receive many mails with the body text in UPPERCASE, FROM address beginning and ended in numbers, many forwarded messagges, priority high, etc. and the custom rules of spamassassin give a high score for them.

If i cannot modiyfy this rules, how can i modify they scores.. or what else can i do??

Thanks.
0
rbraym
Asked:
rbraym
  • 2
  • 2
1 Solution
 
rmharwoodCommented:
Hi,

Yes you can customize the scores on your system. You will first need to find out which rules are affecting your message. You can do this by running the message through the spamassassin command. For example:

    cat message | spamassassin -t

This will tell you what rules are being matched and what their score is.

Once you've found out what rule you want to score differently, add an entry to /etc/mail/spamassassin/local.cf to include something like:

    score UPPERCASE_50_75 0.25

Where 0.25 is the score you want to give to that test.

Hope this helps. Let me know if you need further information.
0
 
rbraymAuthor Commented:
Hi,  rmharwood.. thanks for your reply

The following is the header of one NON-SPAM mail marked as SPAM by spamassassin:

X-Euro-MailScanner-SpamCheck: spam, SpamAssassin (score=5.2, required 5,
      ASCII_FORM_ENTRY 1.07, FROM_ENDS_IN_NUMS 0.74, HTML_00_10 1.21,
      HTML_MESSAGE 0.10, MIME_BOUND_NEXTPART 0.35, RCVD_IN_ORBS 0.50,
      UPPERCASE_25_50 1.24)

So, the rules i have to modify the score are:  FROM_ENDS_IN_NUMS,  UPPERCASE_25_50, etc??.. each one must have an entry in local.cf file?

Thanks.
0
 
grbladesCommented:
Hi rbraym,
I might add "score FROM_ENDS_IN_NUMS 0.2" or something similar in local.cf as a score of 0.74 seems a little harsh.
Have you considered whitelisting this senders email address?
0
 
rmharwoodCommented:
>So, the rules i have to modify the score are:  FROM_ENDS_IN_NUMS,  UPPERCASE_25_50, etc??.. each one must have an entry in local.cf file?

You only need to specify scores for the rules you want to change. You might need to play around with the numbers to get exactly what you want. Notice that this particular message has scored 5.2 so you would have to lower the score by at least 0.2 in this case to not have it marked as spam.
0
 
rbraymAuthor Commented:
Hi  grblades..  every time when i receive a mail like this, i put it in the whitelist... the problem is we receive so many mails marked as SPAM when the really are not.. that's why i want to modify the score of the rules.

Thanks.

rbraym.
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now