My New Knowledge Of Spam Assassin

[robok]

Here is my Spam Assassin Config:

 

 

bayes_auto_learn 1

bayes_auto_learn_threshold_nonspam 0.1

bayes_auto_learn_threshold_spam 8.0

required_score 4

rewrite_header subject **SPAM** (_HITS_)

score BAYES_99 2.5

score BAYES_00 0.0

use_bayes 1

 

 

Once you put these into your config file, they then show up within cPanel for configuration.

 

A couple notes:

 

bayes_auto_learn 1 -- Turns on auto learn, might be on by default.

 

bayes_auto_learn_threshold_nonspam 0.1 --- this is the highest score of sending non-spam into the auto learner. By inspection, I saw a lot of Spam w/ score of 2 or 3 incorrectly being sent to auto_learn. I recommend a LOW number, maybe even negative (see BAYES_00)

 

bayes_auto_learn_threshold_spam 8.0 --- this is the lowest score for spam to go into the auto_learn, anything higher goes in as spam for training.

 

required_score 4

rewrite_header subject **SPAM** (_HITS_)

Anythng with score 4 or higher gets a new heading. _HITS_ puts the score into the header which is interesting.

 

 

 

score BAYES_99 3.5 -- This is the points an email gets for coming up with a 99% probablility of being spam. If your Bayes seems too agressive, you can lower these points making SA rely on other techniques more.

 

 

score BAYES_00 0.0 -- this is the score, by default a negative number, that an email gets for having no probability of spam. THIS IS WHERE SA IS GOING WRONG LATELY. Spammers copy poetry and plain text into a message and get a low score b/c SA gives them -2.5 points or something like that. I have recently rasised this to zero hoping that it will then catch more of the "normal looking" spam. I cannot tell you if that works yet or not.

 

 

use_bayes 1 -- tells it to use Bayes in addtion to other tests.

 

 

 

In thunderbird, if you show headers, you can see the spam score for both spam and non-spam. This is very useful to learn what is going on. Looking at the headers for SPam that slipped through is very informative and may guide you to tweak above.

 

 

THIS IS JUST SOME SIMPLE EXPERIMENTING ON MY PART. I AM BY NO MEANS AN EXPERT. YMMV.

 

Cheers!

[TCH-Bruce]

Let us know if it helps. Anything that helps combat spam is a good thing.