[ale] OT : SpamAssassin becoming inefective

[Thomas Wood]

We had a similar problem at work after initially getting SA running.  A 
couple pieces of advice:

Subscribe to the SA-Talk mailing list sponsored by Spam Assassin.  It's 
loaded with good advice but gets several hundred messages on a normal 
day so filter it...heavily.

Add a ruleset like Back Hair, Evil Numbers or Say No to Drugs.  The 
names are a bit funny but they each tend to specialize in recognizing 
one type of spam and eradicating it.  They're maintained by people on 
the SA-Talk list too, so additions are welcome and added pretty fast.

Turn on RBLs and point it at SORBs.  This is the most reliable of the 
different DNS blacklist zones I've used.  You'll probably want to add 
SPEWS and Spamhaus to give you a better idea of what's happening in the 
RBL Zones so that you don't kill somebody like comcast.net (currently 
listed in SORBs).

Use bayes filtering.  This is probably one of the most powerful 
features of SA.  Once we got it working with SA (we had some weird 
compilation issues at first but that's Solaris for ya), the number of 
spams slipping passed SA dropped drastically--on the order of 95%.

If you must send a bounce message when you don't deliver mail for 
spamminess (the RFCs say you should) please don't include the SA 
report.  It just makes the spammers more effective.  Create an email 
drop so people can report errors--if any to you.

Once all that's in place, you should have a pretty solid barrier 
against spam.  Anything you see at that point is probably a pretty well 
crafted message.  Do the whole community a favor and report it back to 
SA Talk.  One of the ruleset maintainers can add some regexs to their 
list to kill that.

If you have any more questions, feel free to contact me on or off list.

wood


On Mar 27, 2004, at 12:29 PM, Nathan J. Underwood wrote:

> Just curious to know if anyone else that is using SpamAssasin is 
> starting to see more and more spam beating it?  I have been using it 
> for about a year, and had been seeing 5-10 SPAM messages per day 
> beating SpamAssassin with the default setting (score of 5).  In the 
> last 2 weeks or so, though, I'm getting 30-80 through, and have even 
> dropped the score down to 4.7.  Just curious to see if anyone else had 
> been seeing this too?
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale