1 Topic by twarren

  • twarren
  • Member
  • Offline
  • Registered: 2020-12-17
  • Posts: 3

Topic: SpamAssassin giving Low Score to Obvious Spam

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version 1.3.2:
- Deployed with iRedMail Easy or the downloadable installer?  Downloadable Installer vs 0.9.7
- Linux/BSD distribution name and version: CentOS 7
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Web server (Apache or Nginx): Apache
- Manage mail accounts with iRedAdmin-Pro? No
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

SpamAssassin is flagging obvious Spam emails with an extremely low score of 0-1. 


/etc/amavisd/amavisd.conf:
$sa_tag_level_deflt  = -10;  # add spam info headers if at, or above that level
$sa_tag2_level_deflt = 6.2;  # add 'spam detected' headers at that level
$sa_kill_level_deflt = 6.9;  # triggers spam evasive actions (e.g. blocks mail)



Example Email Header:
X-Virus-Scanned: amavisd-new at mail.XXXX.net
X-Spam-Flag: NO
X-Spam-Score: 0.164
X-Spam-Level:
X-Spam-Status: No, score=0.164 tagged_above=-10 required=6.2
    tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1,
    HEADER_FROM_DIFFERENT_DOMAINS=0.249, HTML_IMAGE_RATIO_02=0.001,
    HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001,
    T_REMOTE_IMAGE=0.01, URIBL_BLOCKED=0.001]
    autolearn=no autolearn_force=no
Authentication-Results: mail.XXXX.net (amavisd-new);
    dkim=pass (1024-bit key) header.d=leenom.com;
    domainkeys=pass (1024-bit key)
    header.from=personalizationmall@leenom.com header.d=leenom.com
Received: from mail.XXXX.net ([127.0.0.1])
    by mail.XXXX.net (mail.XXXX.net [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id ANtJRxXLEXlm for <XXXX@XXXX.net>;
    Wed, 16 Dec 2020 15:35:42 -0500 (EST)
Received: from mail.leenom.com (web.tachyonsd.com [104.206.155.2])
    by mail.XXXX.net (Postfix) with ESMTP id 73C5D14F76
    for <XXXX@XXXX.net>; Wed, 16 Dec 2020 15:35:41 -0500 (EST)


Email itself in Plain Text:
Exclusive Designs on Dozens of Gifts with Fast Shipping
Contact photo
From Personalizationmall <personalizationmall@leenom.com> on 2020-12-16 15:36
Details HTML
Exclusive Designs on Dozens of Gifts with Fast Shipping

http://www.leenom.com/prefacing-proprie … 0GX6LML0ih



Update Preferences- http://www.leenom.com/e3U4S2395C8Jk617b … d-percents



I have implemented bayesian filters for SpamAssassin as of today, so they haven't had time to reach the required 200 Spam/Ham to start learning.  However, it seems to me that these emails should be flagged as spam, but they are getting a low score.  The emails are coming from multiple domains, multiple IP addresses, multiple senders.  This also seems to be affecting multiple users on multiple domains on the mail server.


Greylisting is also enabled, and functioning on the mail server.  Any assistance that you can provide would be appreciated.  Thanks!

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,088

Re: SpamAssassin giving Low Score to Obvious Spam

Software is not like human brain, something obvious to you doesn't mean obvious to the software, so don't go mad, this is quite normal.

You can train the auto-learning system and wait for it to tag a better score for further emails. smile

3 Reply by twarren

  • twarren
  • Member
  • Offline
  • Registered: 2020-12-17
  • Posts: 3

Re: SpamAssassin giving Low Score to Obvious Spam

My question was more centered around: "How do I improve SpamAssassin's scoring to recognize these types of emails".  It was not "Why isn't the software as smart as I am...".

To reiterate, is there something that you can identify which has been misconfigured or can be tweaked in order to improve the SpamAssassin filtering? 

Secondly, in order for the Bayesian filters to work properly, do I need both 200 spam AND 200 ham identified, or will just 200 spam start the process working?

As these emails are receiving such a low score (lower than the emails from you btw), how will the Bayesian filter recognize them without filtering out legitimate email as well? 

Thanks for your time!

4 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,088

Re: SpamAssassin giving Low Score to Obvious Spam

twarren wrote:

To reiterate, is there something that you can identify which has been misconfigured or can be tweaked in order to improve the SpamAssassin filtering? 

I don't see any misconfiguration based on the mail headers.

twarren wrote:

Secondly, in order for the Bayesian filters to work properly, do I need both 200 spam AND 200 ham identified, or will just 200 spam start the process working?

Yes, 200 AND 200.

twarren wrote:

As these emails are receiving such a low score (lower than the emails from you btw), how will the Bayesian filter recognize them without filtering out legitimate email as well? 

This is how bayes works. it tags scores based on learnt tokens, not other matched SpamAssassin rules.

5 Reply by twarren

  • twarren
  • Member
  • Offline
  • Registered: 2020-12-17
  • Posts: 3

Re: SpamAssassin giving Low Score to Obvious Spam

Ok, on the SPAM and HAM, I have not seen even one HAM message yet that is not junk, while I have several hundred that have been marked as SPAM. 

How would I go about acquiring the 200 HAM messages?  If I take a message previously marked as Junk, and then flag it as a HAM, and then flag it as SPAM again, that will defeat the purpose of the bayesian learning won't it?

Do I just have to wait potentially months until I find 200 messages that are HAM?

6 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,088

Re: SpamAssassin giving Low Score to Obvious Spam

twarren wrote:

How would I go about acquiring the 200 HAM messages?  If I take a message previously marked as Junk, and then flag it as a HAM, and then flag it as SPAM again, that will defeat the purpose of the bayesian learning won't it?

This is not gonna work.

twarren wrote:

Do I just have to wait potentially months until I find 200 messages that are HAM?

Try to train SA with the sa-learn command line too with 200 clean messages.