Detecting forwarded spam

[Andrew MacLachlan]

True enough. It would be prudent to not trust a foreign server too much - although you could give an arbitrary score of 2 to anything previously marked as spam, then let your own host add to that. Alternatively you could take the foreign MTAs word as gospel and assign a score of 1000 to such messages.
I know that this isn't 100% what he wanted, but I guess it would be useful to some.

Far more useful to me would be something that detects backscatter...

----- Original Message ----
From: Scott Silva <ssilva at sgvwater.com>
To: mailscanner at lists.mailscanner.info
Sent: Wednesday, 16 May, 2007 9:09:43 PM
Subject: Re: Detecting forwarded spam

>> Michael Masse spake the following on 5/15/2007 10:20 AM:
> 
>>> Is there a way for MailScanner to detect if a forwarded message has already been detected as spam by another system, therefore not needing to run it's own spam check?  
>>>
>>> We have a large number of users who used to use a separate email provider and they now just have that email forwarded to their account here.    Their old system detects spam and creates a header entry like:
>>> X-Spam-Report: IsSpam=yes
>>>
>>> Right now our system just ignores that, so I was wondering if I can get our Mailscanner to take this into account and not bother with spamassassin checks if it sees this in the header?     I'm sure I could make a spamassassin rule to assign points if it saw this, but the whole point is to not have to get spamassassin involved.   
>>>
>>> Is this possible, or should I just stick with a spamassassin rule?
>>>
>>> Mike
>>>
>>>
>>>     
>> You could write a custom function to do this, and maybe you could get Julian
>> to write it for you for some $$$ (money, deniro, cash, mammon, greenbacks,
>> script, coinage, euros, pounds sterling, etc...).
> 
> Yes: for a suitable bribe, I could write you a Custom Function to do this.
> 
> Jules
> 
>Andrew MacLachlan spake the following on 5/16/2007 8:37 AM:
> Might it be better to write that so that it can score the message in SA?
> Just my £0.02...
>
That would be the easiest to write, with a suitable positive score if the
header is there, but might not do exactly as he wants as he wanted to avoid
spamassassin processing.
-- 

MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!