2

Users on my server have been receiving spam, consistently, for some time now. I have most of spamassassin's plugins enabled, and I have made sure to enable verbose logging, where I can see that all of the plugins are working.

Why is it, then, that my users are able to receive the same exact junk mail several times in a day without the message being flagged in some way?

Here are the relevant headers of an email that I personally have received several copies of:

X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
  sub.domain.tld
X-Spam-Level: ***
X-Spam-Status: No, score=3.0 required=4.0 tests=BAYES_50,FSL_HELO_NON_FQDN_1,
  HELO_NO_DOMAIN,HTML_MESSAGE,RCVD_IN_BRBL_LASTEXT,RDNS_NONE autolearn=no
  version=3.3.1

Have I accidentally missed the plugin that can see that I, and others, have received the same message multiple times in a short period of time?

Caleb Gray
  • 350
  • 3
  • 8

1 Answers1

2

Your baesian filter don't sure the message is spam - BAYES_50.

You need to build some interaction between users and bayesian. Messages marked as spam or moved into certain folder should be streamed to the sa-learn with --ham/--spam flag. When user few times send the same messages to the sa-learn, bayesian tokens obtains enough weight to block such messages in the future.

Kondybas
  • 6,964
  • 2
  • 20
  • 24
  • I ended up writing a cron job that uses sa-learn to scan mailboxes and then remove spam from a user's folder once it's done learning from the message. I can see this being a very powerful system. Thanks so much for your direction on this. :) – Caleb Gray Apr 09 '12 at 17:31
  • 1
    If you have use dovecot as IMAP server, you can use antispam-plugin instead croning a job. That plugin analyze every message movement across user's inbox. And you can configure some additional operations for certain events. F.e. if user moves message into "Spam" dovecot immediately invoke `sa-learn --spam` for that message. So bayes trained just when user make a decision. – Kondybas Apr 10 '12 at 17:38