Scores

Grant Phillips wrote:
> Hello,
> 
>  
> 
> I seem to continue receiving spam, it keeps slipping
past even after a
> good couple of thousands of emails. What do you think
the best score’s
> are to set? I currently have it set at
> 
>  
> 
> -999.000
> 
> 5.000
> 
> 5.000

Your scores are perfectly reasonable--they're the values
that
SpamAssassin was calibrated against, after all.  There
should be no need
to lower your spam threshold just to catch more spam; better
instead to
consider a more thorough set of tests.

Consider adding collaborative network tests like Razor,
Pyzor, and/or
DCC--or all of them if you like.  These add feedback from
others who've
received the same spam, so if a whole lot of other people
have received
the same spam and classified it as such, SpamAssassin can
boost the
score accordingly.

Consider adding the SPF and DomainKeys plugins as well,
which can
provide additional clues about forged sender addresses.

Consider installing RulesDuJour and subscribing to a bunch
of the SARE
rules (from <http://www.rulesempo
rium.com>), which catch a lot of the
items that otherwise slip through the cracks of the default
SpamAssassin
rules.  These are updated pretty regularly, and with the
RulesDuJour
script you can keep your rules up to date automatically.

Consider using a recent version of SpamAssassin; newer
versions contain
newer rules with updated scores that are better-balanced
against current
spam.

If you're using SpamAssassin 3.1.x, be sure to also take
advantage of
the sa-update utility to check for updates to the default
SpamAssassin
rules.

Finally, check the rules that /are/ being triggered when you
receive
spam.  Check for rules like ALL_TRUSTED that suggest you've
misconfigured SpamAssassin, and BAYES_00, which suggests
that your Bayes
database is corrupt.  There's a big difference between spam
that goes
undetected (i.e. triggers an insufficient number of rules)
and spam that
gets falsely diagnosed as non-spam.

-- 
Robert LeBlanc <rjlrenaissoft.com>
Renaissoft, Inc.
Maia Mailguard <http://www.maiamail
guard.com/>


_______________________________________________
Maia-users mailing list
Maia-usersrenaissoft.com
http://www.renaissoft.com/mailman/listinfo/maia-users

I have both the following rules Listed under the
spamassassin rules on the
maia gui.

ALL_TRUSTED Passed through trusted hosts only via SMTP
-1.800 192 3.2
BAYES_00 Bayesian spam probability is 0 to 1% -2.599 304 5.0

So what have I done wrong? =S

Thanks for your help so far mate.

Regards,
Grant Phillips

-----Original Message-----
From: Robert LeBlanc [mailto:rjlrenaissoft.com] 
Sent: Friday, 21 July 2006 1:32 PM
To: Grant Phillips
Cc: maia-usersrenaissoft.com
Subject: Re: [Maia-users] Scores

Grant Phillips wrote:
> Hello,
> 
>  
> 
> I seem to continue receiving spam, it keeps slipping
past even after a
> good couple of thousands of emails. What do you think
the best score's
> are to set? I currently have it set at
> 
>  
> 
> -999.000
> 
> 5.000
> 
> 5.000

Your scores are perfectly reasonable--they're the values
that
SpamAssassin was calibrated against, after all.  There
should be no need
to lower your spam threshold just to catch more spam; better
instead to
consider a more thorough set of tests.

Consider adding collaborative network tests like Razor,
Pyzor, and/or
DCC--or all of them if you like.  These add feedback from
others who've
received the same spam, so if a whole lot of other people
have received
the same spam and classified it as such, SpamAssassin can
boost the
score accordingly.

Consider adding the SPF and DomainKeys plugins as well,
which can
provide additional clues about forged sender addresses.

Consider installing RulesDuJour and subscribing to a bunch
of the SARE
rules (from <http://www.rulesempo
rium.com>), which catch a lot of the
items that otherwise slip through the cracks of the default
SpamAssassin
rules.  These are updated pretty regularly, and with the
RulesDuJour
script you can keep your rules up to date automatically.

Consider using a recent version of SpamAssassin; newer
versions contain
newer rules with updated scores that are better-balanced
against current
spam.

If you're using SpamAssassin 3.1.x, be sure to also take
advantage of
the sa-update utility to check for updates to the default
SpamAssassin
rules.

Finally, check the rules that /are/ being triggered when you
receive
spam.  Check for rules like ALL_TRUSTED that suggest you've
misconfigured SpamAssassin, and BAYES_00, which suggests
that your Bayes
database is corrupt.  There's a big difference between spam
that goes
undetected (i.e. triggers an insufficient number of rules)
and spam that
gets falsely diagnosed as non-spam.

-- 
Robert LeBlanc <rjlrenaissoft.com>
Renaissoft, Inc.
Maia Mailguard <http://www.maiamail
guard.com/>



_______________________________________________
Maia-users mailing list
Maia-usersrenaissoft.com
http://www.renaissoft.com/mailman/listinfo/maia-users

Grant Phillips wrote:
> I have both the following rules Listed under the
spamassassin rules on the
> maia gui.
> 
> ALL_TRUSTED Passed through trusted hosts only via SMTP
-1.800 192 3.2
> BAYES_00 Bayesian spam probability is 0 to 1% -2.599
304 5.0
> 
> So what have I done wrong? =S

Oh, there's nothing wrong with having those rules
/installed/--indeed, a
SpamAssassin installation would be incomplete without them. 
What I was
trying to say was that if these rules are /triggering/ on
mail items
that you consider to be spam, then there's a problem to
fix.  When you
look at a mail item in the Maia GUI's mail viewer, you
should see a list
of the rules that were triggered.  Take a look at some of
the spam items
that way, and see if ALL_TRUSTED or BAYES_00 show up in the
list of
triggered rules for those mail items.

If you see ALL_TRUSTED showing up in your spam items, it
means you need
to set your trusted_networks and/or internal_networks
setting in your
local.cf file to tell SpamAssassin the IP addresses/ranges
of the mail
servers that are part of your network.  This enables
SpamAssassin to
correctly determine which "Received:" headers to
ignore for the purpose
of determining the first "untrusted" mail server
in the list.  See
<htt
p://wiki.apache.org/spamassassin/TrustPath> for a
more detailed
explanation.

If you see BAYES_00 showing up in your spam items (it's
normal to see
BAYES_00 triggered by /non-spam/, but it should never be
triggered by
/spam/), it means your Bayes database has become corrupt,
and needs to
be cleared.  This is usually the result of training
mistakes, or a lack
of Bayes training in the first place that allowed learning
mistakes to
accumulate and get worse.  The only fix for it is to empty
the Bayes
database tables--bayes_expire, bayes_seen, bayes_token, and
bayes_vars.

You'll probably also have to wipe the AWL table as well, if
you've
experienced problems with BAYES_00 and/or ALL_TRUSTED, since
SpamAssassin will have tarnished the reputations of many of
your senders
as a result of these mistakes.

-- 
Robert LeBlanc <rjlrenaissoft.com>
Renaissoft, Inc.
Maia Mailguard <http://www.maiamail
guard.com/>

_______________________________________________
Maia-users mailing list
Maia-usersrenaissoft.com
http://www.renaissoft.com/mailman/listinfo/maia-users