Originally posted at www.jaguarpc.com by thisisit3

- START

Contrary to popular belief, spam is easy to combat. All it takes is a well configured SpamAssassin running on the server. Unfortunately the definition of “well configured” is very loosely defined in this context as its completely different for every domain/server.

One such example is the average person who blocks emails that contain the word “viagra”, but an actual medical doctor may use that word rather regularly.

So here is how to make SpamAssassin block 99% of spam:

STEP 1 - Raise score for Realtime Blackhole lists (RBL)

The default scores for RBLs are set too low. For example, if an email is marked as spam by SORBS then there is no reason giving it a score of 2. Based on my tests over a two year period RBLs are very safe to use. There are some issues with SpamCop but those always resolve after a few days.

Edit your “/etc/mail/spamassassin/local.cf” and add:

Code:

STEP 2 - Raise score for BAYES

The default scores for BAYES are set to the lowest possible. These scores are automaticaly generated by a special script used by the developers of SpamAssassin and its generates the score based on all the rules. Unfortunately the high probability scores are too low, for example a 90% probability is a definit spam, so there is no reason why its score should be 2.

Edit your “/etc/mail/spamassassin/local.cf” and add:

Code:

STEP 3 - S.A. Rules Emporium (SARE)

There is a special team of commandos who track daily spam. These guys have sat down and written rules that target specific strings within spam. One such tick is to scan for telephones and addresses used in spam, thus they don’t need to look for “viagra” in all its different variations instead they look for the phone or address of the guy selling them. As a result, their rules allow a doctor to get emails with “viagra” in them, while blocking spam at the same time.

These guys go even further, they have rules for:
- Rules to detect commonly abused redirectors and uri obfuscation techniques.
- Addresses and phone numbers harvested from spam
- Bayes poison using lists of words with equal length
- HTML coding rules that detect various spammer tricks applied through HTML coding within messages
- Header rules that are not found in other SARE rulesets.
- Rule set which flags specific spam and/or spam from specific spammers
- SARE Adult rules are designed to catch spam with “Adult” material.
- SARE “BML” rules are designed to catch “business, marketing and educational” spam.
- SARE Fraud rules are designed to catch “Nigerian 419″, “International Lotto”, etc. type scams.
- LOADS OF OTHERS…

Their website is at: http://www.rulesemporium.com/

Below are the safest rule sets which can be used everywhere. Just go to your “/etc/mail/spamassassin/” directory and run the following commands from the shell, thats all you need to do, they are automatically included when SA scans that directory.

Code:

STEP 4 - Final step

Finally, make sure your required score is still set to the default 5 because all the above rules expect that it hasn’t been changed.

Code:

Once you’ve run your system with the above and you are comfortable with the results, you may automaticaly delete spam with a score of 8 or more. The safest way is to create a filter rule in cPanel (Mail -> Email Filtering):

Code:

The result is this:

$message_headers contains “X-Spam-Level: ********”

- END

I’ll add that if you have PLESK you can make this last change by editing the ’spam filter’ setting instead.

In a hotel in Eau Claire the day before a consult with a client. A geek and his camera strikes again!