2

Is it possible to configure SpamAssassin to filter incoming email, based on specific words in the subject line? For instance, all emails with the words "orange delight" anywhere in the subject, would be accepted (not marked as Spam).

I know of one SF writer who has an an email list, that only accepts replies from people who include a word pair that he specifies - but it could be custom software (or just a package other than SpamAssassin).

I've looked through the docs, but if there is such an option, I missed it.

Cyclops
  • 1,169
  • 2
  • 9
  • 13

1 Answers1

2

You can write an SA rule to search the subject line for a particular word or phrase, then assign that rule a highly negative number. Then make the required score for mail to be delivered something very negative.

This would be easier to do somewhere other than SA however, because SA takes many scoring factors into consideration, where you're just looking for a simple pass/fail based on a phrase. A word of warning, SA is very complicated and writing your own rules is somewhat difficult, there's really no "easy" way to do it. Further if you have sa-update running you have to be careful about where you write your rule or it may be overwritten.

Your MTA's delivery agent may have some sort of filtering capability. I use dropmail (part of the Courier-MTA package) and it has quite extensive filtering capabilities, making a job like this trivial.

Chris S
  • 77,945
  • 11
  • 124
  • 216
  • Do you mean use my MTA's delivery agent *instead* of SpamAssassin, or configure it to work *with* SpamAssassin somehow? Maybe it can tell SA to not filter specific emails? FYI, I'm on a CentOS VPS (and wishing I werent... :( – Cyclops Sep 19 '11 at 18:57
  • An MTA (Mail Transfer Agent) is sever software that shuffles mail from one piece of software to another. Mail comes in from some software, usually another mail server (MTA) or a Mail User Agent (MUA, eg Outlook or Thunderbird); MTA does its thing, sends the e-mail off to another mail server or to a Mail Delivery Agent (MDA). The MDA is what stores the e-mail, possibly in a Maildir, database, or something else. SA is a 3rd part of the equation, the MTA or the MDA could call SA to rate the e-mail, then somewhere along the chain someone actually acts on that rating. SA is **not** an MTA or MDA. – Chris S Sep 19 '11 at 19:49
  • To make a bit of sense of all this, my e-mail server uses Courier for the MTA, dropmail for the MDA (to a Maildir), SpamAssassin for SPAM filtering, and ClamAV for virus filtering. E-Mails come into my MTA, if the e-mail is for someone local it accepts the e-mail and passes it to Dropmail. Dropmail runs the e-mail through SA and ClamAV; if it's got a virus it gets deleted; if it's spam then Dropmail delivers it to my "Inbox\Spam" folder. Dropmail also does a bunch of other filtering, if the e-mail is from my bank it gets filed away in my "Finanace" folder. Stuff like that. – Chris S Sep 19 '11 at 19:55
  • What I am essentially proposing is that you take a look at your MDA. It probably has a filtering capability. (side note: some MTAs do not separate out the MDA; mine is interchangeable as most are, if you're MDA doesn't support filtering then you might be able to replace it easily). You should be able to setup a filter pretty easily that goes something like `If !(/^Subject:.*ABC ZYX/) then Deliver_To /dev/null` (note: the if statement is a regex query to see if "ZBC XYZ" appears in the subject line). I'm not sure what mail system comes with CentOS, but it's probably pretty well documented. – Chris S Sep 19 '11 at 20:00
  • My comment-question may not have been very clear, I realize SA doesn't deliver mail. :) What I'm not clear on, is if you're saying use *only* the MDA's filtering, and simply disable SA. Or if it's possible to tell the MDA to deliver *some* emails, and on other emails, check with SA for spam before delivering. In other words, if SpamAssassin is enabled - will it be called on *every* email, or can the MDA bypass checking for emails that match a filter? – Cyclops Sep 19 '11 at 20:42
  • SA doesn't act on e-mail by itself, it just rates the e-mail. So it's entirely possible to filter every e-mail through SA, then if an e-mail does not have the "safe word" in the subject to act on the SA score. In such a setup you could set the Spam threshold very low, but if the safety word is in the subject then the e-mail is delivered regardless. This is not something configured in SA however, it's configured in whatever filtering is acting on the SA Score. – Chris S Sep 19 '11 at 22:04
  • You're quite correct - I thought that clicking "enable SpamAssasin" was all it took, but as you say, that only applies a rating to incoming email. I finally found where in cPanel I had to create some *filters* to actually *do something* with that rating. :) Live and learn... – Cyclops Sep 24 '11 at 18:30