2

I have problem with lots of spam. My server setup is VPS with CentOS 6.5 and Dovecot+Postfix+Spamassassin.

Here is source of one of the messages:

Return-Path: <nancy_mitchell@tagbook.co.nz>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on xxxxxx.xx
X-Spam-Level: 
X-Spam-Status: No, score=-0.5 required=3.0 tests=HTML_MESSAGE,
    HTML_MIME_NO_HTML_TAG,MIME_HTML_ONLY,RP_MATCHES_RCVD,URIBL_BLOCKED
    autolearn=ham version=3.3.1
Delivered-To: mail@xxxxxx.xx
Received: by mx.xxxxxx.xx (Postfix, from userid 5001)
    id 584194399E; Sun, 14 Sep 2014 04:34:03 +0200 (CEST)
Received: from tagbook.co.nz (tagbook.co.nz [119.47.112.73])
    by mx.xxxxxx.xx (Postfix) with ESMTP id 6089C43119
    for <mail@xxxxxx.xx>; Sun, 14 Sep 2014 04:33:59 +0200 (CEST)
Date: Sun, 14 Sep 2014 14:33:56 +1200
From: "Nancy Mitchell" <nancy_mitchell@tagbook.co.nz>
Reply-To:"Nancy Mitchell" <nancy_mitchell@tagbook.co.nz>
Message-ID: <59a5f3f-c3c7f-b8@tagbook.co.nz>
To: mail@xxxxxx.xx
Subject: RE:  Lol adooya
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit


<h2><a href="http://www.dirtymath.co.kr/data/question/g0702/login.html?ZGpwQmRqcGxndixndw==">adooya</a></h2>
<div> The  artifact  was instantly forgotten-as I hoped, although  it  took
</div>

As you can see, this message only got spam score -0.5. Anybody got any idea, what to do with this? It's pretty annoying.

  • Do you use bulk detectors (razor/pyzor/dcc) as Aragon0 suggested? – AnFi Sep 14 '14 at 21:10
4

Turning off a few spamassassin tests

According to my SA configuration from the above tests only RP_MATCHES_RCVD yields negative score (ham indicator). RP_MATCHES_RCVD scores between -1.5 and -0.5 (local/network, with bayes/without bayes).

You may consider turning the test off as described in man Mail::SpamAssassin::Conf.

~/.spamassassin/user_prefs

score RP_MATCHES_RCVD 0
  • I did this, and it worked better. I combined it with solution from @Aragon0 and it works like a charm now. Thanks – FHR Sep 15 '14 at 14:10
3

Install DCC, Pyzor and Razor2. That improves detection significantly. If you still get spam, write some meta-rules (for example DCC + Blacklist = +2 score). I block more than 300 spams per week with an accuracy beyond 99% with that method.

  • Thank you, I installed Pyzor and Razor. The detection is much better now. – FHR Sep 15 '14 at 14:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.