SpamAssassin not as good as before :(

haimat

Hi all SpamAssassin users!

I am using SA since some months now and never had to look back. It filtered
around 98-99% of all spam mails out. But since one or two months, I would
say the false negative rate is around 30%, but I do not have any idea why
this could be.

On another SA installation with serveral virtual email domains I have
exactly the same problem ... but here again, problem exists since one or
two months.

Did so many spammers changed their spam technics? What could be done (if
possible only with SA's help) to reach my hit rate of 99% again? An update
to SA version 2.60 did not change anything

Thanks for any suggestions!
Greetings, Matthias

NightSpirit · Posted: Wed Jan 28, 2004 9:48 pm Post subject:

HI,

I too have found the default spamassassin configuration to be inadequate for the mail I get

My soon-to-be-replaced debian mail server is running version 2.20 so a little bit older now which was why I didn't really blame it for letting so much spam through the net.

Spammers will have changed tactics since when you first started using spamassassin. Obviosuly, as soon as anti-spam picks up the common spam techniques, the evil spammers make up new ones to get their emails to you.

Its a constant battle it seems, but the simple solution is to go through the spam you are getting that hasn't been marked, and create your own personal rules to score them higher. That's what I did and it's doing pretty well

I have added a 16k body.cf and 5k header.cf which have lots of custom rules in that I have writen based on the spam I used to get. Now my inbox sees only one or two spam emails in a week compared to 10+ i used to get daily!

Just remember to restart spamd after you change any rules or spamc will not use them when checking your mail. There is supposed to be some commandline to verify that you have not made any typos in your config but it always throws an error at me so I just save an email to text file, pipe that through manually and watch to make sure there are no errors in the output.

----
Additional:

It's best to have a Perl book handy or some other reference material that covers regular expressions as many rules need some pretty strange stings in there to weed out those spam emails. But atleast you are learning something while you weed out the rubbish from your daily emails

_________________
Currently playing with Applescript ... hmmm

Steffen · Apprentice Joined: 14 Jul 2002 Posts: 159

I don't know if it applies to you, but I've put an email address in the source code of my website, which exists but isn't used by anybody and hasn't been officially published anywhere. Therefore I can be sure that every email arriving there is spam and I then I let SpamAssassin learn form the emails arriving there with

Telamon · Tux's lil' helper Joined: 29 Dec 2003 Posts: 129

You might want to download some extra rulesets. There are a few good ones (Tripwire, BigEvil...) You can find some of them at http://mywebpages.comcast.net/mkettler/sa/antidrug.cf or
http://www.merchantsoverseas.com/wwwroot/gorilla/sa_rules.htm

Just download these and put them in /etc/mail/spamassassin and you're all set.

Also, there is an auto-download script available at http://www.exit0.us/index.php/RulesDuJour that you can setup to automatically download and install the newest updates at regular intervals.

Koon · Retired Dev Joined: 10 Dec 2002 Posts: 518