Spamassassin score not catching everything

companero

• November 05, 2014 09:40

Hello I've been messing around with spamassassin and managed to contain the impressive amount of spam i was getting with the following settings (i use buehost) bayes_auto_learn_threshold_nonspam 1 bayes_auto_learn_threshold_spam 5 bayes_min_ham_num 200 bayes_min_spam_num 200 required_score 3 rewrite_header subject ***SPAM*** skip_rbls_checks 0 use_bayes checked use_bayes_rules 1 use_dcc 1 use_pyzor 1 use_razor2 1 Im not really sure if dcc/pyzor/razor are enabled but they are set and also i added this rule to account filtering: Spam bar contains +++++++ or Spam score is above (#s only) 7 -> Discard Message So it worked really nice, even deleting spam with score equal or over 7 and keeping at the spam box those with lower score that were still marked as spam, just because sometimes its legit email and i need to review it/add to whitelist. Anyway, from one day to another, a lot of email started to pass through all of those rules, even with scores as high as 14, so my question is, what did i do wrong? Here are some examples Content analysis details: (7.7 points, 3.0 required) Content analysis details: (7.0 points, 3.0 required) Content analysis details: (9.0 points, 3.0 required) Why does it happen? Could it be im getting so much spam that spamassassin cant really check them all? Before i was auto deleting messages, i was getting about 200 spam emails with scores over 10 DAILY, it was just crazy I hope someone can guide me on my quest to kill spam :) regards companero [COLOR="silver">- - - Updated - - - Oh by the way, if anybody can recommend me a good account filtering rule to discard messages, it would be great because spammers are getting good at bypassing spamassassin and i do get a lot of spam email with scores between 4 and 6

• 

  cPanelMichael

  • November 05, 2014 16:38

  Hello :) It's possible the spammers have just modified their emails to make it through SpamAssassin (e.g. they are getting better at bypassing the rules). Have you consulted with your hosting provider to see if they can enable additional spam filtering options (e.g. RBLs) to see if that makes a difference? Thank you.

  0
• 

  companero

  • November 05, 2014 16:55

  Hello Michael Well, asking bluehost people to enable/disable things is a bit tricky. They always have something to say to avoid requests so it isnt really a good idea heh. Im thinking that maybe spamassassin isnt processing all the spam, or the rules cant really do it either, because these are the important headers, which they dont look modified: X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on ***.bluehost.com X-Spam-Flag: YES X-Spam-Level: ********* X-Spam-Status: Yes, score=9.8 required=3.0 tests=BAYES_99,BAYES_999, X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on ***.bluehost.com X-Spam-Flag: YES X-Spam-Level: *********** X-Spam-Status: Yes, score=12.0 required=3.0 tests=BAYES_99,BAYES_999,D X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on ***.bluehost.com X-Spam-Flag: YES X-Spam-Level: ******** X-Spam-Status: Yes, score=8.4 required=3.0 tests=BAYES_99,BAYES_999, Its not really a big deal, but still surprised some spam is making it through regards companero

  0
• 

  cPanelMichael

  • November 05, 2014 17:03

  I recommend consulting with your hosting provider about this, as it's not really something you have much control over without root access to the system. Thank you.

  0
• 

  companero

  • November 05, 2014 17:07

  Alright will do as you say and we will see what do they answer, thanks for your help :)

  0

Please sign in to leave a comment.