Spam autolearning and spam blacklists

[Magnusson, Andrew]

What I'm looking for isn't to block it -- it's blocking fine -- but to make
it so low-SpamAssassin-scoring email doesn't get autolearned as 'not spam'
when it's been tagged by one or more spam blocklists. Ideally, I'd like it
autolearned as spam.


In a word - yes.
If you look in the MailScanner.conf file you will see:
# Spam Detection and Spam Lists (DNS blocklists)
# ----------------------------------------------
#

# Do you want to check messages to see if they are spam?
# Note: If you switch this off then *no* spam checks will be done at all.
#       This includes both MailScanner's own checks and SpamAssassin.
#       If you want to just disable the "Spam List" feature then set
#       "Spam List =" (i.e. an empty list) in the setting below.
# This can also be the filename of a ruleset.
Spam Checks = yes

# This is the list of spam blacklists (RBLs) which you are using.
# See the "Spam List Definitions" file for more information about what
# you can put here.
# This can also be the filename of a ruleset.
Spam List = ORDB-RBL SBL+XBL # MAPS-RBL+ costs money (except .ac.uk)

# This is the list of spam domain blacklists which you are using
# (such as the "rfc-ignorant" domains). See the "Spam List Definitions"
# file for more information about what you can put here.
# This can also be the filename of a ruleset.
Spam Domain List =

# If a message appears in at least this number of "Spam Lists" (as defined
# above), then the message will be treated as "High Scoring Spam" and so
# the "High Scoring Spam Actions" will happen. You probably want to set
# this to 2 if you are actually using this feature. 5 is high enough that
# it will never happen unless you use lots of "Spam Lists".
# This can also be the filename of a ruleset.
Spam Lists To Reach High Score = 5

If you tweak the setting regarding spam lists and your high scoring action
you can easily block spam :)


Mr Michele Neylon
Blacknight Internet Solutions Ltd
http://www.blacknight.ie/
Tel. +353 59 9137101
________________________________________
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf
Of Magnusson, Andrew
Sent: 25 April 2004 15:41
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: [MAILSCANNER] Spam autolearning and spam blacklists

We're seeing a lot of these lately: 
Apr 25 10:33:32 external-smtp MailScanner[23350]: Message 75AE584846 from
4.7.254.117 (lnwbompvnxmso at attorney.ac) to localdomain.com is spam,
spamcop.net, CBL, DSBL, SBL+XBL, SpamAssassin (score=0, required 7,
autolearn=not spam)
This mail is certainly spam, but SpamAssassin doesn't have rules for it and
hence not only gives it a 0 score but autolearns it as not spam. This is, of
course, badly messing with our Bayes database. Is there any way to tell it
(via MailScanner?) that if it hits 1 or more spam blacklists (4 in this
case) it sohuld be autolearned as spam, regardless of SpamAssassin score?
Andrew Magnusson 
Internet Product Analyst
COCC
1-877-678-0444 extension 640 



-- 
Email scanned by Blacknight for viruses and dangerous content.
Visit http://www.blacknight.ie for more information

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
For further info about MailScanner, please see the Most Asked
Questions at    http://www.mailscanner.biz/maq/     and the archives
at    http://www.jiscmail.ac.uk/lists/mailscanner.html

--
*** This message originates from COCC, Inc.

If the reader of this message, regardless of the address or routing, is not an intended recipient, you are hereby notified that you have received this transmittal in error and any review; use, distribution, dissemination or copying is strictly prohibited.  If you have received this message in error, please delete this e-mail and all files transmitted with it from your system and immediately notify COCC, Inc. by sending reply e-mail to the sender of this message. 

Thank you. ***

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
For further info about MailScanner, please see the Most Asked
Questions at    http://www.mailscanner.biz/maq/     and the archives
at    http://www.jiscmail.ac.uk/lists/mailscanner.html