HowTo: Control Spam

Filed under: Technical References

Posted: March 7, 2009

The department servers use Spamassassin and Procmail in the mail delivery process. You can control how these programs work by editing the user configuration files for each.

Spam Assassin’s user configuration file is ~/.spamassassin/user_prefs

Procmail’s user configuration file is ~/.procmailrc

Please note that Procmail is called after Spam Assassin, which is why you can filter for Spam Assassin headers (as in the examples below). This also means if you try to use procmail for whitelisting but the user sends something that scores really high (10 or above), the message will still either bounce or be lost. In practice, this rarely happens.

Spam Assassin

Although you can add any of the directives as documented on the Spam Assassin website, the most useful are listed here.

required_score 6.31
whitelist_from myotheraccount@example.org
blacklist_from spammer@example.com

The “required_score” will change the value at which messages are flagged as spam in the “Subject:” line. 6.31 is our current setting. You should check your message headers (X-Spam-Score:) to see what your highest scoring ham (real) email is and set this value to that plus .5 just to be safe.

The other two lines will add emails to the whitelist (allows all email from that address) or the blacklist (deny all email from that address). Only one email is allowed per line, but those lines may be repeated.

Procmail

Procmail is a much more flexible program then what is mentioned here. Read the procmailrc man page (not on shell servers, see procmailrc(5) on die.net) for more information about how rules work and what else you can do with them. The following rules are only for simple spam management.

Say you wish to keep emails marked as spam (to later check for false positives), but you don’t want to see that spam in your Inbox folder. You can create a rule such as:

:0
* ^X-Spam-Status: Yes
.spam/

which will deliver the email to a folder called “spam” instead of your Inbox. Note that the period at the beginning of the name is required if you want to view the folder via IMAP (including webmail).

Here’s an example of whitelisting via Procmail:

:0
* ^From whitelisted@example.org
$DEFAULT

Here’s an example of blacklisting via Procmail:

:0
* ^From blacklisted@example.com
/dev/null