3

Is it possible to configure SpamAssassin to filter incoming email, based on specific words in the subject line? For instance, all emails with the words "orange delight" anywhere in the subject, would be accepted (not marked as Spam).

I know of one SF writer who has an an email list, that only accepts replies from people who include a word pair that he specifies - but it could be custom software (or just a package other than SpamAssassin).

I've looked through the docs, but if there is such an option, I missed it.

Improve this question

1 Answer 1

Reset to default
2

You can write an SA rule to search the subject line for a particular word or phrase, then assign that rule a highly negative number. Then make the required score for mail to be delivered something very negative.

This would be easier to do somewhere other than SA however, because SA takes many scoring factors into consideration, where you're just looking for a simple pass/fail based on a phrase. A word of warning, SA is very complicated and writing your own rules is somewhat difficult, there's really no "easy" way to do it. Further if you have sa-update running you have to be careful about where you write your rule or it may be overwritten.

Your MTA's delivery agent may have some sort of filtering capability. I use dropmail (part of the Courier-MTA package) and it has quite extensive filtering capabilities, making a job like this trivial.

Improve this answer
7
  • Do you mean use my MTA's delivery agent instead of SpamAssassin, or configure it to work with SpamAssassin somehow? Maybe it can tell SA to not filter specific emails? FYI, I'm on a CentOS VPS (and wishing I werent... :(
    – Cyclops
    Sep 19, 2011 at 18:57
  • An MTA (Mail Transfer Agent) is sever software that shuffles mail from one piece of software to another. Mail comes in from some software, usually another mail server (MTA) or a Mail User Agent (MUA, eg Outlook or Thunderbird); MTA does its thing, sends the e-mail off to another mail server or to a Mail Delivery Agent (MDA). The MDA is what stores the e-mail, possibly in a Maildir, database, or something else. SA is a 3rd part of the equation, the MTA or the MDA could call SA to rate the e-mail, then somewhere along the chain someone actually acts on that rating. SA is not an MTA or MDA.
    – Chris S
    Sep 19, 2011 at 19:49
  • To make a bit of sense of all this, my e-mail server uses Courier for the MTA, dropmail for the MDA (to a Maildir), SpamAssassin for SPAM filtering, and ClamAV for virus filtering. E-Mails come into my MTA, if the e-mail is for someone local it accepts the e-mail and passes it to Dropmail. Dropmail runs the e-mail through SA and ClamAV; if it's got a virus it gets deleted; if it's spam then Dropmail delivers it to my "Inbox\Spam" folder. Dropmail also does a bunch of other filtering, if the e-mail is from my bank it gets filed away in my "Finanace" folder. Stuff like that.
    – Chris S
    Sep 19, 2011 at 19:55
  • What I am essentially proposing is that you take a look at your MDA. It probably has a filtering capability. (side note: some MTAs do not separate out the MDA; mine is interchangeable as most are, if you're MDA doesn't support filtering then you might be able to replace it easily). You should be able to setup a filter pretty easily that goes something like If !(/^Subject:.*ABC ZYX/) then Deliver_To /dev/null (note: the if statement is a regex query to see if "ZBC XYZ" appears in the subject line). I'm not sure what mail system comes with CentOS, but it's probably pretty well documented.
    – Chris S
    Sep 19, 2011 at 20:00
  • My comment-question may not have been very clear, I realize SA doesn't deliver mail. :) What I'm not clear on, is if you're saying use only the MDA's filtering, and simply disable SA. Or if it's possible to tell the MDA to deliver some emails, and on other emails, check with SA for spam before delivering. In other words, if SpamAssassin is enabled - will it be called on every email, or can the MDA bypass checking for emails that match a filter?
    – Cyclops
    Sep 19, 2011 at 20:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .