Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: SpamAssassin: users

Marking very similar messages as spam...

 

 

SpamAssassin users RSS feed   Index | Next | Previous | View Threaded


caleb at calebgray

Apr 8, 2012, 9:55 AM

Post #1 of 3 (325 views)
Permalink
Marking very similar messages as spam...

Users on my server have been receiving spam, consistently, for some time now.
I have most of spamassassin's plugins enabled, and I have made sure to
enable verbose logging, where I can see that all of the plugins are working.

Why is it, then, that my users are able to receive the same exact junk mail
several times in a day without the message being flagged in some way?

Here are the relevant headers of an email that I personally have received
several copies of:

X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
sub.domain.tld
X-Spam-Level: ***
X-Spam-Status: No, score=3.0 required=4.0
tests=BAYES_50,FSL_HELO_NON_FQDN_1,
HELO_NO_DOMAIN,HTML_MESSAGE,RCVD_IN_BRBL_LASTEXT,RDNS_NONE autolearn=no
version=3.3.1


Have I accidentally missed the plugin that can see that I, and others, have
received the same message multiple times in a short period of time?

If you're on serverfault.com, you can find my original post
http://serverfault.com/questions/377686 here . I'll upvote and accept your
answer there. :P
--
View this message in context: http://old.nabble.com/Marking-very-similar-messages-as-spam...-tp33652293p33652293.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.


eliezer at ngtech

Apr 8, 2012, 10:07 AM

Post #2 of 3 (300 views)
Permalink
Re: Marking very similar messages as spam... [In reply to]

On 08/04/2012 19:55, calebgray wrote:
> Users on my server have been receiving spam, consistently, for some time
> now. I have most of spamassassin's plugins enabled, and I have made sure
> to enable verbose logging, where I can see that all of the plugins are
> working.
>
> Why is it, then, that my users are able to receive the same exact junk
> mail several times in a day without the message being flagged in some way?
>
> Here are the relevant headers of an email that I personally have
> received several copies of:
>
> X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
> sub.domain.tld
> X-Spam-Level: ***
> X-Spam-Status: No, score=3.0 required=4.0 tests=BAYES_50,FSL_HELO_NON_FQDN_1,
> HELO_NO_DOMAIN,HTML_MESSAGE,RCVD_IN_BRBL_LASTEXT,RDNS_NONE autolearn=no
> version=3.3.1
>
> Have I accidentally missed the plugin that can see that I, and others,
> have received the same message multiple times in a short period of time?
>
> If you're on serverfault.com, you can find my original post here
> <http://serverfault.com/questions/377686>. I'll upvote and accept your
> answer there. :P
>
> ------------------------------------------------------------------------
> View this message in context: Marking very similar messages as spam...
> <http://old.nabble.com/Marking-very-similar-messages-as-spam...-tp33652293p33652293.html>
> Sent from the SpamAssassin - Users mailing list archive
> <http://old.nabble.com/SpamAssassin---Users-f195.html> at Nabble.com.
you can use pastebin in a case of spam mail...
and most of it is not understandable cause of missing logs and stuff.

Regards,
Eliezer

--
Eliezer Croitoru
https://www1.ngtech.co.il
IT consulting for Nonprofit organizations
eliezer <at> ngtech.co.il


jhardin at impsec

Apr 8, 2012, 10:08 AM

Post #3 of 3 (299 views)
Permalink
Re: Marking very similar messages as spam... [In reply to]

On Sun, 8 Apr 2012, calebgray wrote:

> Users on my server have been receiving spam, consistently, for some time now.
> I have most of spamassassin's plugins enabled, and I have made sure to
> enable verbose logging, where I can see that all of the plugins are working.
>
> Why is it, then, that my users are able to receive the same exact junk mail
> several times in a day without the message being flagged in some way?
>
> Here are the relevant headers of an email that I personally have received
> several copies of:
>
> X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
> sub.domain.tld
> X-Spam-Level: ***
> X-Spam-Status: No, score=3.0 required=4.0
> tests=BAYES_50

"BAYES_50" means that bayes has no data upon which to make a judgement
for this message.

Are these false negatives (missed spams) being fed back into the Bayes
learning process so that it can recognize them in the future? It appears
not, from the above question.

Having an effective anti-spam system _does_ place some responsibility upon
you and your user base to help the system tune itself to your particular
message stream.

There are regular discussions of how to set up spam training folders for
users in various designs of email systems. I suggest you search the
mailing list archives and do some reading. Note that "learning" is often
used as a synonym for "training" so you'll want to search on both
keywords, and also include "user", for example "spam learning folders for
users".

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Ignorance is no excuse for a law.
-----------------------------------------------------------------------
5 days until Thomas Jefferson's 269th Birthday

SpamAssassin users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.