I've activated some new SpamAssassin rules. Please let me know here if you notice anything, good or bad.

JT

Excellent. I noticed chickenpox earlier today:



and blackhair just now:



I will try and provide feedback. Weird timing as I just decided this morning to turn off all the BLs available on my spamcop mail account and only use SpamAssassin. I am trying it set on 3 for now. Others will likely be able to provide feedback more quickly because I only receive about 20 spam per day and I know others can top that. I will post spam to the NG and reference them from this thread if I see anything coming through with low scores.

Have you thought about using the rule known as "Antidrug"? I know you have concerns about doctors who may use spamcop mail and how this would affect them, but we could always find out from other admins of SA how serious a problem this really is.

Can you comment on whether or not all blades are using the same SA rules or not?

And, what blacklists are being used within SA to add to the cumulative scores, is it just the spamcop bl? and if so, is it implemented on all blades?

Just curious.
Thanks a bunch

Disregard my question about the rule "Antidrug", I see it is implemented, I just received a hit for Vi[at]gra. (For those who do not know, the tests below that indicate this are "LOCAL_DRUGS_MALEDYSFUNCTION" and "LOCAL_DRUGS_MALEDYSFUNCTION_OBFU".) For completeness, here is the Antidrug ruleset



So far I have received no false positives or false negatives, but have received minimal spam since you added the new rules. I am really pleased that we have the "Antidrug" rule in effect.

Great job JT!

The rule RCVD_IN_BL_SPAMCOP_NET is redundant and should be removed. Having it in SpamAssassin prevents users who want to run without the SpamCop block-list from making use of SpamAssassin. Those who get false positives from the SpamCop BL are forced to remove SpamAssassin from their configuration too.

SpamAssassin and SpamCop BL have separate activations in the user configuration. RCVD_IN_BL_SPAMCOP_NET defeats this separation.

Actually I see that SpamAssassin has loads of these
"RCVD_IN_" filters. Probably all of them should be
disabled. At a minimum the ones that have explicits checks
in the SpamCop mail system should.

http://www.spamassassin.org/tests.html

lawless and all- I guess I have mixed feelings on this.

If a SpamCop mail user chooses to ONLY turn on SA then theoretically one should get the most benefit of the spamcop bl. The supposed glory of SA is that one spam characteristic does not by itself qualify the message as spam. So I figure if SA is configured optimally, then a message from a friend of mine who happens to be on the spamcop bl should make it through. The key is adjusting either the score that "RCVD_IN_BL_SPAMCOP_NET" contributes and/or adjusting the end user's "SA held level." From what I can see the "RCVD_IN_BL_SPAMCOP_NET" test contributes 2.25 by default, perhaps this is too much of a contribution for a single test? Also, since JT implemented SA I think it is fair to say that many users have probably dropped their individual "SA held levels" lower over time. Now that JT has added additional tests, users may want to consider raising their "SA held levels" due to higher overall scores. I currently have my "SA held level" set on 3 and if the "RCVD_IN_BL_SPAMCOP_NET" does contribute 2.25 then I likely have a problem. The question is: Is it more appropriate for me to raise my "SA held level" or for JT to lower the amount of points that "RCVD_IN_BL_SPAMCOP_NET" contributes?

I can defintely see a problem for users who want to use SA, but do not want to use the spamcop bl period, but really it sounds like the issue is FPs due to the "RCVD_IN_BL_SPAMCOP_NET" test and this can likely be solved by making adjustments vs turning it off.

lawless, can you share some of your individual setup with us? Scores of FPs and what # you are holding SA tagged mail on would be interesting.

I don't presently have a problem with the SCBL because of a laborious effort I made to create my own relay to prevent false-positives. See my earlier post in the NG "Harrowing. . ."

However several SC users don't want to go to the trouble to create or find their own clean MXs, and they are susceptible to what I call "sudden total false positive syndrome." This happened to me. SC BLs your web-host provider's inbound MX, and suddenly ALL your e-mail gets blocked.

Roy Lewallen posted in the old NNTP news group that he started getting all his e-mail blocked, and so removed the SCBL from his check-list. Then he also had to remove SpamAssassin due to the RCVD_IN_BL_SPAMCOP_NET tagging. He is clearly very annoyed.

I want this removed because Julian favors aggression an experimentation over stability. I fully expect that he will get carried away sometime in the future and play havoc on my filtering. I want to be able to turn SCBL off when it gets out-of-hand while keeping SpamAssassin in the picture.

I just received spam that was barely caught by SA with my current settings. My threshold of 3 held this barely. Entire spam in "spam NG" under "SpamAssassin score of 3.6". Headers here:



At this very moment I have not reported the spam, but interestingly the spamcop bl for 67.21.92.114 shows that the IP is listed.

I know the SA score on this mail is nothing out of the ordinary, I am just left wondering why the mail did not trip the SA "RCVD_IN_BL_SPAMCOP_NET" test.

Does anyone have evidence of the "RCVD_IN_BL_SPAMCOP_NET" test being tripped on an email received via blade6?

lawless wrote:



I am not suggesting that this course of action if correct right now, but why couldn't JT simply change the score assigned to an email from the "RCVD_IN_BL_SPAMCOP_NET" test from 2.25 to 1?

Curious, you did not answer what kind of SA scores you were seeing on the FP emails you received, nor what threshold you are using for SA either. Care to post some info so a clearer picture can be formed? I am curious.

Sorry I'm late -- I just discovered this forum.

I posted some comments recently on spamcop.mail about the false positives I suddenly began getting from SpamAssassin. Nearly all my legitimate email was getting blocked, so I've had to disable SpamAssassin, which until recently was doing great with a threshold of 4.

The legitimate messages are now mostly getting a SpamAssassin score of 12, apparently solely due to a SpamCop blocklist listing. I posted a few abbreviated headers on sc.mail. I didn't check, but the listing might be my domain web host, which gets listed briefly from time to time. I relay all my incoming mail through the domain, so when it gets listed, all incoming email gets held regardless of its origin if I include the SpamCop blocklist as a criterion for holding. I found some time ago that I could remove the SpamCop blocklist and enable SpamAssassin (along with most of the other block lists) and get very good spam rejection with virtually no false positives. Now that SpamAssassin redundantly includes the SpamCop as a score-12 criterion, I've had to disable SpamAssassin also. Quite a bit more spam gets through, but at least the false positives have dropped back to virtually zero.

Much as I hate spam, I don't hate it enough to sacrifice legitimate email. And, try as I do to carefully scan the 200-300 spams per day I get, I do miss one once in a while if it's in the held mail list.

So, for me it makes no difference how you fiddle the SpamAssassin rules -- as long as it rejects mail that's from or relayed through a SpamCop-blocklisted address, I won't use it.

Roy Lewallen

Roy -

I went back to the Newsgroups and read through the threads that you initiated there. I saw some of the headers you posted that showed the SA test "RCVD_IN_BL_SPAMCOP_NET" contributing 12 points towards the total SA score. I feel this is a major problem and a single test should never be worth 12 points. The examples you posted were from earlier this month I think, maybe only a week ago.

I think the solution is to assign a value of 1 or 2 to the "RCVD_IN_BL_SPAMCOP_NET" test. Having it set for 12 assumes that the spamcop bl is infallible.

Even if "your" server is on the spamcop bl then your wanted mail would still come through with a score under your threshold (at least the majority of it) under this scenario.

On a slightly different note, I am hoping that JT can let us know if the SA tests and scores that are implemented are indeed equal on all blades, because if they are not this makes it harder for us to pick an effective SA threshold.

Chickenpox rule really freaks out at UUencoded PBEM game files. Tsk tsk.

Feedback on antidrug rule:

This rule has made the most difference for the spam I receive. At least 5 messages I have received since you implemented antidrug would have passed through if it were not for tripping antidrug and gaining additional points. (Note that I am only using SA, no blacklists are checked for may mail account)

I received my first false negative since the new SA rules were implemented, with a score of 1.2, entire spam posted in spam NG under "SpamAssassin score of 1.2" The false negative in quesiton had misspelled versions of "viagra" and "cialis", which apparently the antidrug rule could not detect.

Roy,

Until Friday or so, we were using the SpamCop Blacklist in SpamAssassin. Since this is redundant, and not necessarily what everybody wants (like you), we turned this off a couple days ago.

SpamAssassin and the SpamCop blacklist are now completely separate again.

JT

Well, I have not looked at the scoring, sorry, but 5 of 10 items in my inbox this AM were spam! That is up from average of 2 per sesssion recently, 0 or 1 60 days ago.

Overall I think either the filtering is failing OR the spammers are doing something we are NOT catching.

David

JT, Thanks for pulling the RCVD_IN_BL_SPAMCOP_NET filter.

The new SpamAssassin filters seem to be letting less spam
through. I didn't do a careful message-level study, but the
number that slipped through on my spamtrap account
dropped from a handful a day to nearly zero. The weekend,
which is usually especially bad, was especially good. I
run the spamtrap account at threshold "4", and my normal
accounts at "6".

Well my trial of usng only SpamCop's SA to filter my mail is over. I am getting too many false negatives due to low scores. I will probably turn all of the BLs back on now to help filter my account. Posted three recent spams received in my inbox to the spam NG, under SpamAssassin score of 1.7, 1.6, and 1.4 respectively. I just wanted to try this to get a feeling for how effective the SpamCop SA implementation is.

I do think our blocking options are somewhat unique in that we have SA and the BLs separate. It would be cool if the checking of BLs were integrated into SA and each given an appropriate score (1, 2, etc.), but apparently that is not going to happen because JT just turned off the "RCVD_IN_BL_SPAMCOP_NET." I vote for the reversal of this if it is ever reconsidered in the future.

A note to those who use a threshold of 2 or 1 with SA, I want to point out that this is not usually how SA is used. The lower we set our threshold for SA the less benefit we gain from its ability to provide a combined total score of spaminess and the more whitelisting would have to be used. Maybe "2" works for some, but "1" does not make any sense to me. I do not care what people set their scores on, I am merely suggesting that recommending to people that the option to set your SA threshold on 1 (and perhaps 2) is not really the solution to the problem. If users feel they have to set it as low as 1 to block spam, then something needs to be adjusted in the SpamCop SA implentation.

Tweaking SA can go on forever, so let me be clear that I am not faulting JT with what he has set up here. I am pleased with the addition of the new rules, but from my testing I have found that the current SA implementation is not optimal (at least for the mail I receive.)

JT,

Thanks! I'll turn SpamAssassin back on and see how it does. Before the SpamCop SpamAssassin blocking, out of 200 or 300 or so spams per day, something like a dozen were getting through SpamAssassin (set to 4) and the other block lists, with virtually no false positives. That was just fine -- hopefully it'll return to that level.

Roy

About the new Chickenpox rule: I noticed that Chickenpox alerts in a few legitimate emails I received.

One was in a text-only newsletter I get.
I think it was triggered by lines such as these



(I put the Xs in place of the site name)

The result was

My spam-free weekend was apparently a coincidence, as a flood ensued. This inspired a close review of SpamAssassin settings and the ratcheting down of thresholds to 4 for working accounts and 3 for the spam trap.

Also looked up Jennifer, the author of ChickenPox, BlackHair, PopCorn and Weeds. Impressive! Anyone who can write regular expressions like that is a genius!

http://www.emtinc.net/spamhammers.htm

Whatever you did, please undo it

All of a sudden EVERY mail I get is marked as spam. I can't even send a mail to myself without it coming back as spam. This just started in the last week to week and a half so it has to be as a result of whatever change you made.

I just sent a test message from one of my domains to another one of my domains, all within the same server. Here is the header:

************************
X-MailScanner-SpamCheck: spam, Infinite-Monkeys, SpamAssassin (score=-4.9,
required 5, BAYES_10, MSG_ID_ADDED_BY_MTA_3), spam, Infinite-Monkeys, SpamAssassin (score=-4.9,
required 5, BAYES_10, MSG_ID_ADDED_BY_MTA_3)
X-MailScanner-Information: Please contact the ISP for more information
Status:
************************

A mail sent to me came in with this header:

************************
X-MailScanner-SpamCheck: spam, Infinite-Monkeys, SpamAssassin (score=0.1,
required 5, HTML_50_60)
Status:
************************

Here is another sample:

************************
X-MailScanner-SpamCheck: spam, Infinite-Monkeys, SpamAssassin (score=-12.3,
required 5, BAYES_20, IN_REP_TO, MSG_ID_ADDED_BY_MTA_3, NO_REAL_NAME,
REFERENCES, X_AUTH_WARNING)
Status:
************************

They are all different but the all come in marked as SPAM. The filter is worthless when all mails are tagged as Spam. In the past about 75% of the spam I received was properly identifided with only about 2-5% of the spam mails improperly identified such as mails from mailing lists I am on. Since this last change they are now all marked SPAM making the filter worthless.

Lew

None of these header lines are added by SpamCop's SpamAssassin. Do you have a complete header that implicates SpamCop's SpamAssassin and you are willing to share? Thanks!

As JeffG noted, the headers you posted aren't added by SpamCop. They were added by some other mail server or your own email program. Also, the scores in those headers are very low (one of them was negative). No program, not ours or anyone elses, should be blocking messages with scores that low.

If all of your email is being blocked, you might want to check out the answers on this page:
http://www.spamcop.net/fom-serve/cache/336.html

JT

Hello,

Upon checking my records closer I seem to have mispoken. I frankly am a little naive about my server configuration because I had someone else do the work on it. I think I only have one spam package. This is what the installer said I had:

"MailScanner was installed with SpamAssassin support and Clam Antivirus"

So perhaps what is being reported is not directly from SpamAssassin, but could be a filtered response provided by MailScanner. The small amount of reading leads me to believe that the Mailscanner product grabs the income mail, puts them in a queue, then it uses a ruleset (SpamAssassin) to analyze the mail and then sends the mail on. Apparently the header information I have provided is generated by MailScanner which is why you didn't recoginize them as being SpamAssassin headers, however the change in SpamAssassin rules seems to be what would "drive" how MailScanner behaves?

About the 3rd week of February my mail quit flowing smoothly, it would get held for hours and then release. Then the mail seemed to function properly and on March 2 or perhaps late March 1st my mail began to misbehave again. The mail would queue for up to 5-6 hours and then I would get delivered a big chunk. Then they would queue up again and hours later another big chunk would come my way. No server changes were being made in this time frame. The first time we checked the server we found that Apache was pegging the server so we did an Apache reset which temporarily fixed the problem. The mail problems continued for several maddening days and then all of a sudden the mail started flowing "smoothly" again. However the mail started coming ALL marked as Spam, HighScore Spam, or Virus. None of the mail was coming through "unidentified". Suddenly yesterday some of the mail started coming through as unmarked but a lot of it was spam so a lot of spam (a LOT) of spam is still coming throun unidentifed.

I was "blaming" SpamAssassin for the problem as the change in how my mail seemed to operate seemed to tie to what I read here about a change to the SpamAssassin product at the same time.

Even when things seem to be working properly they aren't, i.e. I have to review all of my mail and manually sort it. Having Mailscanner identitfy something as Spam only makes me slightly more suspicious of my email but I have to go through every single mail (at a subject level) and sort out what I think is spam. On rare occaision I delete mail that isn't spam and I still read a lot of mail that is spam to determine if it is spam or not.

Obviously I am not the only one who is tired of spam but when you get 3000 mails on an average day, dealing with spam takes WAY too much of my time.

I would like to come up with a solution that won't bog down my server and will more reliably sort my mail for me.

Thanks for your time and trouble.

Lew

The problem, then, is with your vendor's SpamAssassin installation on your mailserver. Are you training the bayesian filter in that installation? Please discuss this with your vendor - it has nothing whatsoever to do with SpamCop. Thanks!

I guess I still am not clear enough....

The Spam Assassin software was done almost a year ago, last June to be exact. It worked fun for nine months and started messing up in March for no apparent reason. I had everyone involved that worked on it involved in a solution and they all denied having anything to do with my current problem and that made sense since how could something break now that worked fine for 9 months.

When I came here and found that changes were made to the code at the same time the problems started it seemed like I had suddenly found the reason.

When something breaks you look at what changed. Since nothing was changed on the server but the software was changed then that seemed to be the reason.


Frankly I was not told anyting about training the bayesian filter. I know people who do that when they run the filtering software on their local PC but I don't know how to do that with the server-based software.

For now the software is working like before. It seems to have gotten over the mode where it marked all new email as spam. It is back to catching some, misidentifying others, and missing a lot of the spam.

Lew

I've reported, and have had held, several thousand spams since you removed SpamCop from the SpamAssassin criteria. I've been running SpamAssassin at a threshold of 4. Out of all those spams, not a single one was falsely flagged positive by SpamAssassin. So for me, the fix worked great -- thanks!

I've had maybe a dozen or so legitimate emails held due to listings on block lists other than SpamCop (whose blocklist I don't use as a filter). Something like a couple of hundred spams have gotten through the filter, but Mozilla catches those with very near 100% reliability. So the system working well for me. Thanks again.

Roy Lewallen

Maybe it would work fine if SpamAssassin added just 1,5 / 2 to its scoring when an IP is listed in the SpamCop BL.

JT --

You probably already know, but Chris Santerre has created a new custom rules website located here:
http://www.rulesemporium.com/

Also, I have read recently that the anti-drug rule has had several improvements added to it, following snipped from Matt Kettler regarding version 0.60:


There are more changes but I think this one alone warrants updating to the 0.60 version of antidrug.

Can you comment on whether or not rules dujour is implemented for SpamCop's SA implementation to automatically update our custon rules? (Here: http://sandgnat.com/rdj/rules_du_jour)

No, we're not using the scripting to update the SA rules. I'm a little uncomfortable with stuff like that happening automatically without any intervention here.

I will, though, look at incorporating the updated drugs rule.

JT