The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Spamassassin score not catching everything

Discussion in 'E-mail Discussions' started by companero, Nov 5, 2014.

  1. companero

    companero Member

    Joined:
    Nov 5, 2014
    Messages:
    14
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Website Owner
    Hello
    I've been messing around with spamassassin and managed to contain the impressive amount of spam i was getting with the following settings (i use buehost)

    bayes_auto_learn_threshold_nonspam 1
    bayes_auto_learn_threshold_spam 5
    bayes_min_ham_num 200
    bayes_min_spam_num 200
    required_score 3
    rewrite_header subject ***SPAM***
    skip_rbls_checks 0
    use_bayes checked
    use_bayes_rules 1
    use_dcc 1
    use_pyzor 1
    use_razor2 1

    Im not really sure if dcc/pyzor/razor are enabled but they are set and also i added this rule to account filtering:

    Spam bar contains +++++++ or Spam score is above (#s only) 7 -> Discard Message

    So it worked really nice, even deleting spam with score equal or over 7 and keeping at the spam box those with lower score that were still marked as spam, just because sometimes its legit email and i need to review it/add to whitelist.

    Anyway, from one day to another, a lot of email started to pass through all of those rules, even with scores as high as 14, so my question is, what did i do wrong?

    Here are some examples

    Content analysis details: (7.7 points, 3.0 required)
    Content analysis details: (7.0 points, 3.0 required)
    Content analysis details: (9.0 points, 3.0 required)

    Why does it happen? Could it be im getting so much spam that spamassassin cant really check them all?

    Before i was auto deleting messages, i was getting about 200 spam emails with scores over 10 DAILY, it was just crazy

    I hope someone can guide me on my quest to kill spam :)

    regards
    companero

    - - - Updated - - -

    Oh by the way, if anybody can recommend me a good account filtering rule to discard messages, it would be great because spammers are getting good at bypassing spamassassin and i do get a lot of spam email with scores between 4 and 6
     
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,811
    Likes Received:
    671
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello :)

    It's possible the spammers have just modified their emails to make it through SpamAssassin (e.g. they are getting better at bypassing the rules). Have you consulted with your hosting provider to see if they can enable additional spam filtering options (e.g. RBLs) to see if that makes a difference?

    Thank you.
     
  3. companero

    companero Member

    Joined:
    Nov 5, 2014
    Messages:
    14
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Website Owner
    Hello Michael
    Well, asking bluehost people to enable/disable things is a bit tricky. They always have something to say to avoid requests so it isnt really a good idea heh.
    Im thinking that maybe spamassassin isnt processing all the spam, or the rules cant really do it either, because these are the important headers, which they dont look modified:

    X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on ***.bluehost.com
    X-Spam-Flag: YES
    X-Spam-Level: *********
    X-Spam-Status: Yes, score=9.8 required=3.0 tests=BAYES_99,BAYES_999,

    X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on ***.bluehost.com
    X-Spam-Flag: YES
    X-Spam-Level: ***********
    X-Spam-Status: Yes, score=12.0 required=3.0 tests=BAYES_99,BAYES_999,D

    X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on ***.bluehost.com
    X-Spam-Flag: YES
    X-Spam-Level: ********
    X-Spam-Status: Yes, score=8.4 required=3.0 tests=BAYES_99,BAYES_999,

    Its not really a big deal, but still surprised some spam is making it through

    regards
    companero
     
  4. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,811
    Likes Received:
    671
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    I recommend consulting with your hosting provider about this, as it's not really something you have much control over without root access to the system.

    Thank you.
     
  5. companero

    companero Member

    Joined:
    Nov 5, 2014
    Messages:
    14
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Website Owner
    Alright will do as you say and we will see what do they answer, thanks for your help :)
     
Loading...

Share This Page