High Scoring Spam Actions

[Mark Nienberg]

At the risk of not answering your question, I think it is better to let SpamAssassin do
the RBL checks instead of MailScanner or sendmail.  That way, if a legitimate sender
is mistakenly on a RBL, it only contributes a few points to the SpamAssassin score.
It won't be enough to reject the mail.  On the other hand, if spam comes in and the
sender is on one or more RBLs, then the SA scores will get kicked up a bit, possibly
enough to change it from spam to high-scoring spam.  In other words, RBLs are best
used as ONE criterion in determining the probability that a message is spam, not as
the ONLY criterion.

Mark

On 31 Oct 2003 at 10:19, Mark Spieth wrote:

> Before I go through the trouble of setting up a test server I figured I
> would send this out to the list..
>
> When dealing with high spam, More importantly email coming in from mail
> servers which are tagged as high spam due to being on a RBL list.
> Currently I have our high spam action set to:
>
> High Scoring Spam Actions = bounce delete
>
> I really need to send a bounce message back even though I realize that
> 99.9% of all messages are from spoofed or fake email addresses. The
> problem is when one of our customers receives an email from one of their
> customers which may be accidentally on a blacklist I can at least bounce
> the message back to them so it just doesn't go into a black hole and
> they don't realize it was never delivered. The above action works fine,
> But here is my problem.
>
> Should a message come in as From:user at domain1.com To:user at domain1.com
> and is tagged as high spam, user at domain1.com would receive the bounce
> message. Even though they did not really send the first message because
> the spammer spoofed the from email address. There is only 1 domain that
> has complained about this. I want to run a ruleset for high spam actions
> which will basically do a
>
> #Domain1.com rules set
> FROMANDTO domain1.com delete
> #everyone else
> bounce delete
>
> How would I formulate the rules set?
>
> Mark Spieth - Director of Internet Services
> Northeast Ohio Digital Inc.
> http://www.neod.net
> mspieth at neod.net
> 330-830-6551
>
> CONFIDENTIALITY NOTICE: The materials attached hereto are confidential
> and the property of the sender. The information contained in the
> attached materials is privileged and/or confidential and is intended
> only for the use of the above-named individual(s) or entity(ies). If you
> are not the intended recipient, be advised that any unauthorized
> disclosure, copying, distribution or the taking of any action in
> reliance on the contents of the attached information is strictly
> prohibited. If you have received this transmission in error, please
> discard the information immediately.


--
Mark W. Nienberg, SE
Tipping Mar + associates
1906 Shattuck Ave, Berkeley, CA  94704
visit our website at http://www.tippingmar.com