Fried Spam
August 15th, 2007Author: Russ
We’re taking a different approach to spam these days. We’ve installed SpamAssassin to help us identify it. And we’re modifying the headers so our clients can decide what to do with it.
Basically, SpamAssassin has a big list of rules. Each message is compared against the rules. If it mentions “viagra,” it gets a positive score. There are positive scores and negative scores. At the end of the comparisons, the total is calculated and SA determines if it should classify the message as spam or not (ham). The default, out of the box setting is to classify each email with a score of above 5 to be spam. We’re currently using 8 as our benchmark, and erring on the cautious side.
On the flip side of the coin, some messages score very highly; 20, 22, et cetera. We’re taking all messages that score above 15 and marking them as definately spam. Actually, “marking” isn’t the right word. We’re vaporizing them into their constituent electrons and using them to power the coffee pot.
If you’re one of our clients, you can configure a filter in your email program to filter out all messages with a specific header. If you can use a “custom header”, I recommend setting it to send all messages that contain “X-Spam-Score: ******” to a separate folder that you can look at and determine if it’s working for you (and delete them once a week). If you have to use the Subject line, match something like “**** SPAM ****” and send those to the same folder. Once you determine your own level of acceptance, you can set the filter to delete rather than store those messages.
August 18th, 2007 at 11:19 am
Bravo Russ.
I am glad to see this in place. It is saving my bacon over the other methods we have deployed.
I am a Eudora user and I have decided to throw all the stuff with a score as low as three into a different mailbox to see how well SA scores things. It is going to help my dsposition as well as a few other things.
In case others want to try this, just have your mail client filter out (flag it, status it, label it or transfer it) any header that has *** in it. That is right. Concurrent asterisks (asterii?) are in the header matching the score.