Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I’ve noticed that I’m getting junk mail from Norwegian companies that send from servers that Postfix says failed certificate verification. Is it possible to give these messages a lower spam score with SpamAssassin?

My mail is delivered locally by Dovecot through SpamAssassin:

mailbox_command = /usr/bin/spamc --headers -e /usr/lib/dovecot/deliver -c /etc/dovecot/dovecot.conf -m "${EXTENSION}"
share|improve this question
Rephrase your question. Higher or lower score? 2.5 or -2.5? And which rule gets triggered right now that you want to lower/increase? – mailq Nov 11 '11 at 20:03

I believe you means the postfix "certificate verification failed" message which is logged due to an unsuccessful cert verification on a STARTTLS attempt.

As STARTTLS is most probably optional for an MX, there would be little value on scoring up stuff that failed the certificate verification, especially since this could happen to perfectly valid servers as well.

Anyway, if your mind is set to it, a feasible option would be to score on the base of headers which postfix would insert for correctly established TLS connections when smtpd_tls_received_header is set to "yes". Spammers are less likely to take the trouble to order an SSL certificate and set up their SMTP server to use TLS, but I would not score too much though - some of the spam is coming in through freemailers which typically would be TLS-enabled - you would build a freeway for this kind of spam with an overly high score advantage for TLS connections.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.