Spam Detection Around 55%

[Matt Kettler]

Daniel Straka wrote:
> I've seen number of spam detected as high as 82% of all incoming email
> on Sundays. On weekdays that number drops down to around 55% and I'd say
> that a lot (2000 or so) are getting through on those days. A lot of them
> are the stock spam with gif. Here's what spamassassin --lint
> returns...does this indicate problem that if fixed would make a big
> difference? I don't know anything about configuring the pyzor or dcc
> things.
> 
> mail1:/home/dstraka # spamassassin --lint
> [13926] warn: config: SpamAssassin failed to parse line,
> "/usr/bin/pyzor" is not valid for "pyzor_path", skipping: pyzor_path
> /usr/bin/pyzor
> [13926] warn: config: failed to parse line, skipping: dcc_path
> /usr/local/bin/dccproc
> [13926] warn: lint: 2 issues detected, please rerun with debug enabled
> for more information


If you don't have DCC, or pyzor, comment out their lines in
spam.assassin.prefs.conf.

Why those are even present in this file is beyond me.

Why does MailScanner decide I've installed dcc in /usr/local/bin. What if I
installed it with PREFIX=/usr?

It's my own opinion that *everything* in that file should be commented out by
default, except "envelope_sender_header".

I could *maybe* see keeping "use_auto_whitelist", but only because I think the
AWL isn't ready to be run on production servers (it lacks reasonable expiry)

the bayes_ignore_header settings are a good idea, but are useless unless
manually edited. Thus, they should be commented out by default.

All the rest of the options that are in there aren't a function of MailScanner,
they're a function of other aspects of your system.



The existing file assumes:

you have DCC and pyzor installed, and have enabled their plugins
you don't use NFS, so flock is safe
you have working DNS (likely, but not always true)
you don't want to use the AWL.

The last 3 are probably safe for 99% of sites, but the NFS bit could really bite
someone in the butt.