Increse spam security, section 5, 15 Options

[prixon]

Configure server-wide Spamassassin

pico /etc/mail/spamassassin/local.cf
Add this:

report_safe 0
required_score 12

# The default score for BAYES and SURBL is too low compare to my reject threshold(see section5) at 15
score BAYES_99 6.00

# Check here for the detail of the URIBL data sources
# http://answers.google.com/answers/threadview?id=422251
score URIBL_SBL 4.50
score URIBL_AB_SURBL 6.50
score URIBL_OB_SURBL 4.50
score URIBL_SC_SURBL 6.00
score URIBL_WS_SURBL 4.50
score URIBL_PH_SURBL 6.00


# Enable server-wide Vipul's Razor in Spamassassin
# Remove razor_config line if you want to disable Vipul's Razor
razor_config /var/spool/mqueue/.razor/razor-agent.conf


# Enable server-wide DCC in Spamassassin
# Remove dcc_home line if you want to disable DCC
dcc_home /var/dcc

5. Spam Protection
Exiscan allow exim invoking SpamAssassin to obtain $spam_score and $spam_report. If you install all programs in the section1, scored will calculate from Spamassassin+SARE+Razor+DCC. Since the false positive rate with spam scanning is high compared to virus scanning, it is wise to implement a scheme with multiple spam thresholds with different actions. As my preferences, I set score at 15 for reject thresholds, 12

what do i have to change in order to get score at 15 for reject thresholds, 12 ?

recently i have notice that many many spam mails are passing trhu and not being marked as is there anything else i could do aswell to increse the detection ?

thanks in advance.

[pairote]

You could reduce the reject theshold from 15 to 11 or whatever you want. But it increase the chance you reject the valid email.

Another way is increase the score for specific SA rules such as SURBL rules.

score URIBL_SBL 4.50
score URIBL_AB_SURBL 6.50
score URIBL_OB_SURBL 4.50
score URIBL_SC_SURBL 6.00
score URIBL_WS_SURBL 4.50
score URIBL_PH_SURBL 6.00

You may increase it. But again it increase the chance you reject the valid email.

[prixon]

You could reduce the reject theshold from 15 to 11 or whatever you want. But it increase the chance you reject the valid email.

Another way is increase the score for specific SA rules such as SURBL rules.

score URIBL_SBL 4.50
score URIBL_AB_SURBL 6.50
score URIBL_OB_SURBL 4.50
score URIBL_SC_SURBL 6.00
score URIBL_WS_SURBL 4.50
score URIBL_PH_SURBL 6.00

You may increase it. But again it increase the chance you reject the valid email.

what do you think of the idea of make a code to interact with exim and every email marked as spam or with a x score will receive a return e-mail if they are not spam they will see the e-mail open the confirmation page and then write the code of that confirmation page, after that the e-mail will be delivered.

[pairote]

No. As email senders are always fake. You server will be blocked from variuos RBL, and big guy such as AOL, Hotmail, and etc.

[prixon]

No. As email senders are always fake. You server will be blocked from variuos RBL, and big guy such as AOL, Hotmail, and etc.

well i am testing a perl code that verify if the e-mail is good or not and so far i havent receive any single spam into it plus the spam config from here.

it trys a helo, check the mx then deny or not so far every e-mail i tested aswell worked fine to detect if it was true or false and all the emails were queued fine for delivery.

CPAN module: Mail::VRFY

[pairote]

Valid email doesn't mean it is not faked. It will worsen if your auto email sent to innocent people. That means you are spamming to prevent spam mail. It doesn't right logic.

[prixon]

Valid email doesn't mean it is not faked. It will worsen if your auto email sent to innocent people. That means you are spamming to prevent spam mail. It doesn't right logic.

i see your point on that, but if u just use it to verify, i think it did be a great tool against those random letter email such as "asjdhkad@somedomain.com", "ahsdenk@somedomain.com" and so on.

Since some of those passed trhu my exim i was using this code to check it and store all the invalid e-mails so far none passed.

[pairote]

The only way to fix those email pattern is setting the default email for that domain to :fail:.