MailScanner Tweak

[billy79]

I have a customer who has his MailScanner pretty optimized and is really happy with it. However since the new year he has gotten a ton of these "Happy NW" emails and is wondering why mailscanner is not tagging them as spam.


Now in the header it does show as:

MailScanner-Information: Please contact the ISP for more information
X-MailScanner: Found to be clean
X-MailScanner-SpamCheck: spam, SpamAssassin (not cached,
score=9.802, required 5, BAYES_99 3.50, RCVD_FORGED_WROTE 2.80,
RCVD_IN_SORBS_DUL 2.05, RCVD_IN_SORBS_WEB 1.46)
X-VMailScanner-SpamScore: sssssssss


Is there anything I can do to make MailScanner grab these and not see them as a good email?

 

[brianoz]

What are your spam thresholds? That actually had a score of 9 so should have been tagged with a default threshold of 5.

 

[Lyttek]

Indeed...

since there are two settings/values with MailScanner (spam and high-spam) it's possible it's getting flagged as spam ( required=5 and this has a score of 9+) but their high-spam (and auto delete setting if configured) may be 11 for instance. This would then flag the message as spam but deliver it.

So, some adjustment may be necessary.

I personally have my filters set to 3 and 4 respectively and that catches about 95% of spam.

 

[billy79]

I have not logged in and double checked yet but this users says they have there thresholds set at 5 for low spam and that it was not tagged.

I will play with it some more, thanks for your help.

 

[mctDarren]

Add a custom rule to spamassassin to boost the score of these emails:

## NEW YEAR SPAM
header  HPYNW   Subject =~ /happy.*nw/i
score   HPYNW   4.800

add this to /etc/mail/spamassassin/local.cf - note that the space between each part of both lines are TABS, not spaces. That should push the score of these above your high spam threshold so that, should they have their high spam action set to delete, they shouldn't even see these.