Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Users on my server have been receiving spam, consistently, for some time now. I have most of spamassassin's plugins enabled, and I have made sure to enable verbose logging, where I can see that all of the plugins are working.

Why is it, then, that my users are able to receive the same exact junk mail several times in a day without the message being flagged in some way?

Here are the relevant headers of an email that I personally have received several copies of:

X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
  sub.domain.tld
X-Spam-Level: ***
X-Spam-Status: No, score=3.0 required=4.0 tests=BAYES_50,FSL_HELO_NON_FQDN_1,
  HELO_NO_DOMAIN,HTML_MESSAGE,RCVD_IN_BRBL_LASTEXT,RDNS_NONE autolearn=no
  version=3.3.1

Have I accidentally missed the plugin that can see that I, and others, have received the same message multiple times in a short period of time?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Your baesian filter don't sure the message is spam - BAYES_50.

You need to build some interaction between users and bayesian. Messages marked as spam or moved into certain folder should be streamed to the sa-learn with --ham/--spam flag. When user few times send the same messages to the sa-learn, bayesian tokens obtains enough weight to block such messages in the future.

share|improve this answer
    
I ended up writing a cron job that uses sa-learn to scan mailboxes and then remove spam from a user's folder once it's done learning from the message. I can see this being a very powerful system. Thanks so much for your direction on this. :) –  Caleb Gray Apr 9 '12 at 17:31
1  
If you have use dovecot as IMAP server, you can use antispam-plugin instead croning a job. That plugin analyze every message movement across user's inbox. And you can configure some additional operations for certain events. F.e. if user moves message into "Spam" dovecot immediately invoke sa-learn --spam for that message. So bayes trained just when user make a decision. –  Kondybas Apr 10 '12 at 17:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.