Is there anything better than spamassassin?

Question

Level 1

16 points

Is there anything better than spamassassin?

I'm not sure if the spammers are getting better at their job, but Spamassassin just doesn't seem to do it anymore. Even set down to 3, a lot gets through. I'm testing today at 2, hoping real messages don't get caught.

Been using spam trainer and have fed the junk account multi-thousands of messages over a year, but is seems not to do anything.

I rarely put anything in the notjunk account, but the count in the spam trainer email report keeps going up for the "ham" (as well as the "spam"). Is it required to put plain "good" messages in there? I thought you were supposed to put only good messages mistakenly tagged as spam in there.

I'll get a message that got through with this in the header as it should be:

X-Spam-Flag: NO
X-Spam-Score: 2.793
X-Spam-Level: **
X-Spam-Status: No, score=2.793 tagged_above=2 required=3 tests=[BAYES_80=2, RDNS_NONE=0.793, SPF_HELO_PASS=-0.001, URIBL_BLOCKED=0.001]

But some messages (good and spam) don't contain the X-Spam entries in the header at all. Anybody know why?

So is there anything else (free or paid) I can add to the server to do a better job than what Spamassassin and spam trainer are doing? Or do I need to change something about what I'm using?

Using latest El Capitan and Server.

Thanks very much!

Mac mini, OS X Server

Posted on Aug 9, 2016 4:50 PM

Reply

Answer 1

Aug 9, 2016 4:55 PM in response to scottl31

Back before i got an email provider with decent server side filters, I used SpamSieve. It appears to have been updated for El Cap.

Reply

Answer 2

scottl31 Author

Level 1

16 points

Aug 9, 2016 5:02 PM in response to IdrisSeabright

SpamSieve looks like a client level thing. I was hoping for something to do or put at the server level. Any other ideas?

Reply

Answer 3

Aug 9, 2016 5:13 PM in response to scottl31

Oops. Sorry. Missed the server part. It's been one of those days.

Reply

Answer 4

Rantung

Level 1

8 points

Dec 28, 2016 10:17 AM in response to scottl31

Hi, late to this discussion, I know, but I was wondering what you've found since.

As for the spamassassin questions (I've been dealing a fair amount with underperforming spamassassin as well):

1. If there are no headers appearing in messages, it means they are below the 'tag level'. This is a parameter set in /Library/Server/Mail/Config/amavisd/amavisd.conf (the parameter is sa_tag_level_deflt). I think the default is something like 0, which is high when you have false negatives (spam being identified as ham). I set it to -2, but you may need to go lower.

2. The amount of ham is increasing because Bayesian auto-learn is turned on... this isn't a problem as long as misidentified spam gets thrown into the spam bin. If false negatives aren't getting corrected, then you get a feedback loop where misidentified spam gets identified as ham and everything passes the Bayes testing.

Until you get your false negatives under control, you can turn autolearn off by editing /Library/Server/Mail/Config/spamassassin/local.cf. In my experience, you need to add changes you make to the top of the file if you want them to take effect. The command you want to insert is bayes_auto_learn 0 if you want to turn autolearning off. OS X Server really mangles this file, so you want to run spamassassin --lint after editing the file, comment out any offending lines until the lint comes out clean, then do a postfix reload.

3. In my experience, the primary cause of false negatives from spamassassin in OS X is the RP_MATCHES_RCVD test. Currently, the test has a weight of -3.1 by default, (enough to override most Bayes results) and triggers when the From address matches the Reply-to address, which is something a lot of spammers seem to do. You can change this by editing /Library/Server/Mail/Config/spamassassin/local.cf and adding the line score RP_MATCHES_RCVD <new_score>, where new_score is something more reasonable like -0.01 (setting it to zero means the test is skipped).

Reply