Rationale to semi-automate SPAM reporting

[sinkr]

Hello--

I have recently installed SpamAssassin at our site, employing more DNS/RBL support, as well as Razor, Bayes, and DCC checking.

Since the spam now comes to me nicely marked up, I can do a number of things in my procmail ruleset, such as filter to a folder, but more importantly/interestingly enough: complete the first part of the SpamCop reporting process (or, forward the email to my reporting address.)

I've read through the rules and can't 100% tell if this is acceptable, which is why I'm querying here, but I'm wondering about the implications of this, considering the SA reports are now included in the original spam email as a different MIME attachment.

Anyhow, I'm still completing the web-based portion of the reporting by hand and am doing final sanity checks (because we know all filtering on heuristics is flawed.)

Any comments on this process would be greatly appreciated.

[StevenUnderwood]

Are you reporting spam received for all addresses at your site? I don't think that is allowed. I do report spam for a few of the role accounts at work (jobs, info, etc) but those are receive only accounts and I err on the side of deleting the message when there is a question.

How do you know that user X did not sign up for that information and does not want to tell you the truth?

I had a user that signed up for several porn site emails but when confronted, denied everything. A check of the firewall logs, showed his machine had been to the site at the time the message stated he had signed up for the lists.

[dbiel]

If you are simply talking about submitting spam specificly directed to you, then the automated submission is just fine. The key is that you must review each parse individually for correctness before actually sending the reports.

You may want to check out the following for more information http://forum.spamcop.net/forums/index.php?...indpost&p=16012