How to manually test an email?

[Glenn Steen]

On 14/08/07, paul @ firespam <paul at firespam.com> wrote:
>
> On Tue, 2007-08-14 at 14:08 +0100, Gareth wrote:
> > This is what I got :-
> > ...<snip>
>
> I have just upgraded my MailScanner + SpamAssassin to the latest
> versions and now get this:
>
> Content analysis details:   (7.6 points, 5.0 required)
>
>  pts rule name              description
> --------------------------------------------------
>  0.1 RDNS_NONE              Delivered to trusted network by a host with
> no rDNS
>  2.5 FRT_PRICE              BODY: ReplaceTags: Price
>  3.6 FRT_SYMBOL             BODY: ReplaceTags: Symbol
>  1.4 TVD_FUZZY_SYMBOL       BODY: TVD_FUZZY_SYMBOL
>  0.0 HS_INDEX_PARAM         URI: Link contains a common tracker pattern.
>  0.0 HTML_MESSAGE           BODY: HTML included in message
>
> Which is obviously much better and closer to your results although I
> still have a few questions...
>
> 1) In order for my bayes database to work properly do I need to
> regularly manually train it? I was under the impression this was an
> automated process.
It is, but the autolearning is, depending on things like the
relationship between header and body rules, number of messages handled
etc, sometimes a slow process. You can "jumpstart" your bayes by
- keeping a corpus of SPAM and HAM messages that you manually train it
with, to exceed the required 200 of each it knows.... After that, the
score set chosen will be different and you'll start seeing bayes hits.
- Instead jump start it with a "starter db" for bayes. Fortress
systems has one on their support site (http://www.fsl.com/support
IIRC:). Since these will not really be matching your mailflow, it is
frowned upon by some. Still an easy way of getting bayes going.

... or just have more patience:-).

To keep your bayes db functioning well, if for example the
autolearning doesn't seem to be that effective, you can let a few
trusted users train it for you. How to do this will of course depend
entirely on your setup. MailWatch can be an invaluable tool for this.

> 2) Why are no RBL checks being reported on? I have setup spamassasin to
> skip RBL checks, but MailScanner is set to use a few RBLs. Does this
> mean that the RBLs are not being checked at all?
>
When testing spamassassin, like you do now, don't expect it to
magically test MailScanner. MailScanner uses serial lookups, so it is
a generally bad idea to have more than one or two defined there. And
since it is a definitive spam/ham thing there, you could as well "save
some resources" and do them in your MTA. Spamassassin is most
efficient, since it will do the lookups in parallell... Turn bls back
on and you'll start seeing them.

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se