Spam not blocked

[towerman]

Hi guys,

I've two different cases where PMG doesn't work as I expect (for sure I've done some wrong configurations)

1. It happens that mail sent with a Return-Path / Received: from domain totally different from From: domain are not signed as spam.
   Is there something that I can implement?
2. My bayesian filter has not learned so much, all the messages are signed as BAYES_00§
   Is there any method to "reset" it or "force" to learn?

Sorry for the noob questions.
Thanks!

 

[Stoiko Ivanov]

It happens that mail sent with a Return-Path / Received: from domain totally different from From: domain are not signed as spam.

This is (sadly) not really a good indicator that a mail is spam (e.g. most mails from regular mailing-lists work like that) .
You will end up with quite a few false positives!
that being said this article describes a potential way : https://www.roaringpenguin.com/wiki/index.php/Spoofed_Addresses

@ bayes:
check out spamassassin's documentation: https://wiki.apache.org/spamassassin/BayesInSpamAssassin
https://wiki.apache.org/spamassassin/BayesFaq
also there were quite a few threads in this forum describing various (successful and not so successful) experiences with bayes filters

currently it seems to me that the best tool against spam is a good selection of RBL-lists and a properly configured DNS-server

Hope this helps!

 

[heutger]

Hi,

here is something like what you're looking for: https://github.com/extremeshok/spamassassin-extremeshok_fromreplyto, however, I already removed it again from my setup as result in too much false positives as @Stoiko Ivanov sad.

For bayes, I would be happy, if PMG would make it easier (e.g. like rspamd or via quarantine, although I don't use and dislike quarantine). You need to learn via sa-learn, either via command line or need to wait until your PMG autolearns 200 spam and 200 ham. If you always have bayes_00 also for spam you may have learned wrong messages, e.g. downloaded spam archives. With autolearning my one year installation still has not yet learned 200 spam, so it's better to learn by yourself.

sa-learn --clear you can delete the database and start from the scratch.

@Stoiko Ivanov: Honestly Pregreet reject is good, RBL as well, own rules is great too, but for the last fine tuning bayes is a glance. For sure, best if you then reject high score spam.