How to teach SpamAssassin to identify more spam

Introduction

While the SpamAssassin service is a great tool for fighting against incoming SPAM messages, unwanted emails continue to change in order to try and bypass these checks. The sa-learn utility (/usr/local/cpanel/3rdparty/bin/sa-learn) is included to help SpamAssassin keep up with your needs. The account owner can use this tool to teach the SpamAssassin database what messages you deem as 'spam' or 'ham' (legitimate mail) directly, in order to update its detection database to meet your personal needs.

Please note that the sa-learn utility should not be run as the 'root' user.

Procedure

Please note that to use the sa-learn tool, the SpamAssassin service will need to be running and enabled for the related account, and Auto-delete must be disabled for SpamAssassin so that any false positives can be marked as 'ham.'

1. Log into Webmail for an email account.
2. Move all spam from the Inbox to the spam/Junk folder.
3. Move any legitimate email in the spam/Junk folder to the Inbox.
4. Access the server's command line as the cPanel user via SSH or "Terminal" in cPanel.
5. Run the following command to teach SpamAssassin to identify 'spam' messages.
   • maildir mailbox format

     /usr/local/cpanel/3rdparty/bin/sa-learn -p /home/$cpusername/.spamassassin/user_prefs --spam /home/$cpusername/mail/$domain.tld/$user/.Junk/{cur,new}

   • mdbox mailbox format

     /usr/local/cpanel/3rdparty/bin/sa-learn --mbox -p /home/$cpusername/.spamassassin/user_prefs --spam /home/$cpusername/mail/$domain.tld/$user/.Junk/{cur,new}

   Please note that "$cpusername," "$domain.tld," and "$user" must be replaced with the cPanel user's username, the email domain name, and the email account's username, respectively.
6. Run the following command to teach SpamAssassin to identify 'ham' messages.
   • maildir mailbox format

     /usr/local/cpanel/3rdparty/bin/sa-learn -p /home/$cpusername/.spamassassin/user_prefs --ham /home/$cpusername/mail/$domain.tld/$user/{cur,new}

   • mdbox mailbox format

     /usr/local/cpanel/3rdparty/bin/sa-learn --mbox -p /home/$cpusername/.spamassassin/user_prefs --ham /home/$cpusername/mail/$domain.tld/$user/{cur,new}

   Please note that "$cpusername," "$domain.tld," and "$user" must be replaced with the cPanel user's username, the email domain name, and the email account's username, respectively.

Please note that SpamAssassin should be trained with at least 1000 'spam' messages and 1000 'ham' messages. The more messages SpamAssassin is trained on, the more accurate the spam identification will be. Training SpamAssassin with more than 5000 messages doesn't significantly improve its accuracy.

Additional resources

Exim Configuration Manager Basic Editor: Apache SpamAssassin™ Options

Mailbox Conversion

How to disable Auto-Delete from the Spam Filter