[prev in list] [next in list] [prev in thread] [next in thread] 

List:       spamassassin-users
Subject:    Re: How to tell if DnsBlocklists are definitely being used by my Spamassassin setup
From:       Sebastian Arcus <s.arcus () open-t ! co ! uk>
Date:       2015-11-30 20:45:25
Message-ID: 565CB565.1040902 () open-t ! co ! uk
[Download RAW message or body]

On 30/11/15 18:01, Reindl Harald wrote:
>
>
> Am 30.11.2015 um 18:30 schrieb Sebastian Arcus:
>>> spamassassin -D  < /path/to/spam-example.eml
>> Thank you Harald. I did - and it looks like SA does contact lots of
>> DNSBL's and it receives various messages in reply. Nothing that looks
>> like failures or errors. I can attach the output here - but it is a lot.
>> Would this mean that the DNSBL's are working correctly in my setup - but
>> spammers somehow manage to keep on sending from "clean" domains all the
>> time - and I should look into some other way of stopping this type of
>> spam? The messages I'm talking about are typical spam, with one or two
>> sentences in the email body and one or two links - usually advertising
>> life insurance, solar panels and similar. None of them are from proper
>> companies or entities I have ever dealt with
>
> you main problem is that bayes is not working because there are no 
> BAYES_xx tags in your headers - collect as many as possible clear spam 
> *and* clear ham samples, you need at least 200 ham samples to start 
> bayes used
Thank you for that. Bayes was enabled, but looking closer at the debug 
output, it wasn't used as there weren't enough tokens/samples. Although 
I've been training it for years, it never really worked as the training 
was done as root, while the spam filtering is done as another user - 
separate databases used, wrong permissions etc.. After setting up a 
site-wide bayes database as per the wiki instructions and fixing file 
permissions etc., and feeding it about 300 spam messages (I don't get a 
lot of spam in general) and 12,000 ham messages of my own hand sorted 
email, the score for the same sample spam message I mentioned in my 
original post jumped from 1.4 to 104.5 !!

I had no idea that bayes filtering can have such a dramatic effect on a 
message with only a small amount of text in it! I will probably need to 
keep an eye on things and follow through with more tweaking and try and 
implement your other suggestions - but at the moment the difference it 
makes is dramatic. Thank you.

[prev in list] [next in list] [prev in thread] [next in thread]