How can I teach SpamAssassin to identify more Spam email?

Question

How can I teach SpamAssassin to identify more Spam email?

Answer

While the SpamAssassin service is a great tool for fighting against incoming SPAM messages, unwanted emails continue to change in order to try and bypass these checks. The sa-learn utility (located at /usr/local/cpanel/3rdparty/bin/sa-learn) is included to help SpamAssassin keep up with your needs. The account owner can use this tool to teach the SpamAssassin database what messages you deem as 'spam' or 'ham' (legitimate mail) directly, in order to update its detection database to meet your personal needs.

Note: To use the sa-learn tool, the SpamAssassin service will need to be running and enabled for the related account, and Auto-delete must be disabled for SpamAssassin so that any false positives can be marked as 'ham.' 

Warning: The sa-learn utility should not be run as the 'root' user, and instead should be run as the target cPanel user.
 

1. Log into Webmail for an email account.
2. Move all spam from the Inbox to the spam/Junk folder.
3. Move any legitimate email in the spam/Junk folder to the Inbox.
4. Access the server's command line as the cPanel user via SSH, or via cPanel / Terminal.

5. Run the following commands to teach SpamAssassin via the sa-learn utility:

   Maildir Format

   SPAM:

   # /usr/local/cpanel/3rdparty/bin/sa-learn -p /home/$cpusername/.spamassassin/user_prefs --spam /home/$cpusername/mail/$domain.tld/$user/.Junk/{cur,new}

   HAM:

   # /usr/local/cpanel/3rdparty/bin/sa-learn -p /home/$cpusername/.spamassassin/user_prefs --ham /home/$cpusername/mail/$domain.tld/$user/{cur,new}

   MDBox Format

   SPAM:

   # /usr/local/cpanel/3rdparty/bin/sa-learn --mbox -p /home/$cpusername/.spamassassin/user_prefs --spam /home/$cpusername/mail/$domain.tld/$user/.Junk/{cur,new}

   HAM:

   # /usr/local/cpanel/3rdparty/bin/sa-learn --mbox -p /home/$cpusername/.spamassassin/user_prefs --ham /home/$cpusername/mail/$domain.tld/$user/{cur,new}

   Note: Depending on the SpamAssassin configuration, spam email may instead be stored in: /home/$cpusername/mail/$domain.tld/$user/.spam/{cur,new}

   Note: $cpusername, $domain.tld, and $user must be replaced with the cPanel user's username, the email domain name, and the email account's username, respectively.

Note: SpamAssassin should be trained with at least 1,000 'spam' messages and 1,000 'ham' messages. The more messages SpamAssassin is trained on, the more accurate the spam identification will be. However, training SpamAssassin with more than 5,000 messages doesn't significantly improve its accuracy.

Additional Resources

Exim Configuration Manager Basic Editor: Apache SpamAssassin™ Options

Mailbox Conversion

How to disable Auto-Delete from the Spam Filter