Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function

2014-12-15 Thread Herbert Eppel



On 15.12.2014 21:04 UK Time, LuKreme wrote:

On Dec 15, 2014, at 10:20 AM, Herbert Eppel  wrote:

In view of the fact that some of my domains are increasingly inundated with 
spam, I would like to reduce the SpamAssassin score from the default value of 5 
to a lower value, in order to make SpamAssassin more 'aggressive'


This is not the way to go, though it seems to make sense. The rulesets are 
designed around the idea that pushing past a 5.0 indicates a strong possibility 
that the message is spam and that a sore of 4.5 is not. If you drop the score 
to 4.5, you are not making SA more aggressive, you are intentionally marking 
message that SA says are not spam as spam.

A better way is to adjust scores. Carefully.

The best way is to train babes, but train it well. If your host doesn’t allow 
this, maybe you can find a host that does?

Also, what is your server doing BEFORE receiving the message to block spam? 
Most mail providers with cPanel seem to do either nothing or nearly nothing.

Good filters and postscreen (or postscreen-like) before SMTP transaction will 
do *far* more to alleviate your spam problem.



Thanks for your reply.

I'm not sure what you mean by "adjust scores" and how to go about it.

I don't really want to switch from QiQ as provider, because apart from 
the spam issue I'm very happy with their service.


Herbert Eppel
www.HETranslation.co.uk


Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function

2014-12-15 Thread Herbert Eppel

On 15.12.2014 20:51 UK Time, Martin Gregorie wrote:

On Mon, 2014-12-15 at 18:20 +, Herbert Eppel wrote:


Thanks for your reply, but I'm afraid as an ordinary SA user with
limited knowledge of these matters I have, quite frankly, no idea what
you are talking about.


We may be able to offer more relevant help if we understood how your
mail system is connected up.

So far it looks as though your mail is:

- received by your ISP's main mailserver
- passed to SA which adds spam scoring headers
- then passed through your ISP's spam filter, which deletes any message
   with a score high enough to be treated as spam.

What happens after that?

Are you simply pointing a mail reader at your ISP's system and using
POP3 or IMAP to retrieve mail from their server?

- if so, what mailreader are you using?

   Different Mailreaders have varying ways of handling spam. These
   range from quite elaborate and configuring to nothing at all.

- if you are doing something different or more elaborate, tell us what
   you're using and how its connected.



Hi Martin

Thanks for your helpful reply.

I mainly use Thunderbird in POP3 mode to retrieve mail from the 
server(s). As you are probably aware, Thunderbird has a junk training 
facility that quite adequately deals with spam that gets through at the 
server level.


The spam overload problem mainly arises at times when I read mail on my 
smartphone, in which case I don't have the additional Thunderbird spam 
filtering available, and my QiQ mailbox tends to be swamped with spam, 
which is why I want to try and get a better grip on the spam situation 
at the server level.


Regards

Herbert Eppel
www.HETranslation.co.uk


Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function

2014-12-15 Thread Herbert Eppel

On 15.12.2014 20:14 UK Time, Tom Hendrikx wrote:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

On 15-12-14 19:16, Herbert Eppel wrote:


On 15.12.2014 18:03 UK Time, Joe Quinn wrote:

On 12/15/2014 12:34 PM, Herbert Eppel wrote:

On 15.12.2014 17:27 UK Time, Joe Quinn wrote:

On 12/15/2014 12:20 PM, Herbert Eppel wrote:

I use QiQ.co.uk for web hosting and associated e-mail
services. QiQ offer SpamAssassin as an integrated feature
that is accessible via cPanel – see screenshot below.

In view of the fact that some of my domains are
increasingly inundated with spam, I would like to reduce
the SpamAssassin score from the default value of 5 to a
lower value, in order to make SpamAssassin more
'aggressive'. However, I don't really want to enable Spam
Auto-Delete because I want to be able to check the spam
folder for false positives, but apparently there is no way
to change the setting without simultaneously enabling the
"Spam Auto-Delete" function.

Am I missing something?

Thank you

Herbert Eppel www.HETranslation.co.uk


You'll need to ask QiQ. SA is only a classifier. It takes an
email as input and outputs score results, plus a modified
email with spam headers.

I would also caution against lowering the score threshold
more than 0.5 or so. There's a point where it goes from
"catching more spam" to "catching more of everything".


Thanks for your reply.

I already asked QiQ support. They asked me to ask SA :-)

Here is their reply: /I will take a look at the filter but
would imagine if that is how Spam Assassin made the program
that way, then there is nothing we can do to change it, though
contacting Spam Assassin for advice may be the way forward, as
we do not provide Spam Assassin, it is a part of cPanel - both
third party programs./

The question remains: How can I change the SA score without
simultaneously enabling the "Spam Auto-Delete" function?

Perhaps I need to ask cPanel support?

Herbert Eppel www.HETranslation.co.uk

(bringing this back on list)

Quite likely. I am not familiar enough with cPanel to know the
level of configuration it gives, but my educated guess would be
that it's up to QiQ to configure their install of cPanel. It
shouldn't hurt to ask cPanel people anyway, even if it's just for
them to say exactly what options QiQ should set that opens the
option to classify without discard.


Ooops, I didn't realise I had replied privately. Thanks for your
further reply.

Is there another way to access the SA score setting, outside
cPanel?



I think this is more a cPanel question than a spamassassin one. A very
quick google pointed me towards
https://documentation.cpanel.net/display/ALD/Apache+SpamAssassin

After skimming that, it seems to me that your hosting provider (QIQ)
needs to configure cPanel for you in order to have mail labeled as
spam delivered (to your spam folder or otherwise). Also, in the
default settings, mail labeled as spam by spamassassin is already
dropped (auto-delete spam): you can only change the score threshold in
the gui.

So RTFM, try out some cPanel settings, and contact QIQ when you have a
better understanding of what you can do yourself, and what cPanel
should be able to provide given that QIQ does some tweaking for you.

As far as the level of technical insights you've shown in your
messages until now, I don't think it's useful (or fair) to get into
the gory details of spamassassin config with you. I'm not being
unfriendly but I'm guessing that you use cPanel for a reason: you're
not the seasoned (e-mail) admin that is comfortable tinkering with
command line and manual config file editing.

Kind regards,
Tom


Thanks for your reply.

FWIW, I regard myself as quite a seasoned computer and e-mail user, and 
I'm not afraid of editing the registry and Mozilla config files, for 
example, provided I have some guidance.


It's just that the finer details of spam prevention are quite new to me.

With my other mail accounts (Gmail and GMX), spam is automatically 
handled very adequately at the server level, but it seems manual 
tweaking is required with my QiQ accounts in order to get the spam 
situation under control.


As for spam auto-delete, the screenshot I sent with my original message 
shows that this is in fact disabled.


Regards

Herbert Eppel
www.HETranslation.co.uk





Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function

2014-12-15 Thread Herbert Eppel



On 15.12.2014 20:09 UK Time, Jari Fredriksson wrote:

On 15.12.2014 20:16, Herbert Eppel wrote:


On 15.12.2014 18:03 UK Time, Joe Quinn wrote:

On 12/15/2014 12:34 PM, Herbert Eppel wrote:

On 15.12.2014 17:27 UK Time, Joe Quinn wrote:

On 12/15/2014 12:20 PM, Herbert Eppel wrote:

I use QiQ.co.uk for web hosting and associated e-mail services.
QiQ offer SpamAssassin as an integrated feature that is accessible
via cPanel – see screenshot below.

In view of the fact that some of my domains are increasingly
inundated with spam, I would like to reduce the SpamAssassin score
from the default value of 5 to a lower value, in order to make
SpamAssassin more 'aggressive'. However, I don't really want to
enable Spam Auto-Delete because I want to be able to check the
spam folder for false positives, but apparently there is no way to
change the setting without simultaneously enabling the "Spam
Auto-Delete" function.

Am I missing something?

Thank you

Herbert Eppel
www.HETranslation.co.uk


You'll need to ask QiQ. SA is only a classifier. It takes an email
as input and outputs score results, plus a modified email with spam
headers.

I would also caution against lowering the score threshold more than
0.5 or so. There's a point where it goes from "catching more spam"
to "catching more of everything".


Thanks for your reply.

I already asked QiQ support. They asked me to ask SA :-)

Here is their reply:
/I will take a look at the filter but would imagine if that is how
Spam Assassin made the program that way, then there is nothing we
can do to change it, though contacting Spam Assassin for advice may
be the way forward, as we do not provide Spam Assassin, it is a part
of cPanel - both third party programs./

The question remains: How can I change the SA score without
simultaneously enabling the "Spam Auto-Delete" function?

Perhaps I need to ask cPanel support?

Herbert Eppel
www.HETranslation.co.uk

(bringing this back on list)

Quite likely. I am not familiar enough with cPanel to know the level
of configuration it gives, but my educated guess would be that it's
up to QiQ to configure their install of cPanel. It shouldn't hurt to
ask cPanel people anyway, even if it's just for them to say exactly
what options QiQ should set that opens the option to classify without
discard.


Ooops, I didn't realise I had replied privately. Thanks for your
further reply.

Is there another way to access the SA score setting, outside cPanel?

Herbert Eppel
www.HETranslation.co.uk



SpamAssassin has global settings in text files in the server, and also
*possibly* user definable settings also in a text file(s) in the disk of
the server. If you have a home directory the server (shell access) *and*
QiQ has configured SpamAsassin to allow user configured settings, then
yes. If neither of these options evaluate to "yes" then no.




Thanks for your reply. I have access to /.spamassassin/user_prefs - is 
that what you mean?


Herbert Eppel
www.HETranslation.co.uk


Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function

2014-12-15 Thread Herbert Eppel

On 15.12.2014 18:38 UK Time, Reindl Harald wrote:



Am 15.12.2014 um 19:20 schrieb Herbert Eppel:

On 15.12.2014 18:02 UK Time, Reindl Harald wrote:

besides that using RBL scoring and wise filters for dynamic PTRs and
invalid HELO names *before* SA on the MTA level should reject most spam
without false positives

3 months:

* 25 delivered ham messages
* 85 MTA level rejects
*  32000 SA hits


Thanks for your reply, but I'm afraid as an ordinary SA user with
limited knowledge of these matters I have, quite frankly, no idea what
you are talking about.

Don't hesitate to tell me to RTFM, but if you feel like elaborating a
little, ideally in an 'acronym-free environment', I would be grateful.


for postfix just Google for the parameters below and read
http://www.postfix.org/POSTSCREEN_README.html which will kill 90% of all
junk before it ever touchs the expensive content filter

since only the dialup-balcklists have the reject score of 8 and all
others need at least confirmation based on trust-level of the RBL
combined with some whitelists you achieve both:

* large amount of catches
* avoid false positives

this like "127.0.0.[4..7]" are the RBL response codes of aggregated
lists which has the benefit postscreen needs only do a single dns lookup
and weight the results (RTFM of the RBL's itself)

postscreen_dnsbl_ttl = 5m
postscreen_dnsbl_threshold = 8
postscreen_dnsbl_action = enforce
postscreen_greet_action = enforce
postscreen_dnsbl_sites =
  dnsbl.sorbs.net=127.0.0.10*8
  zen.spamhaus.org=127.0.0.[10;11]*8
  b.barracudacentral.org=127.0.0.2*7
  dnsbl.inps.de=127.0.0.2*7
  dnsbl.sorbs.net=127.0.0.5*7
  zen.spamhaus.org=127.0.0.[4..7]*7
  zen.spamhaus.org=127.0.0.3*5
  bl.mailspike.net=127.0.0.2*5
  bl.mailspike.net=127.0.0.[10;11;12]*4
  bl.spamcop.net=127.0.0.2*4
  bl.spameatingmonkey.net=127.0.0.[2;3]*4
  dnsrbl.swinog.ch=127.0.0.3*4
  zen.spamhaus.org=127.0.0.2*3
  dnsbl.sorbs.net=127.0.0.7*3
  dnsbl.sorbs.net=127.0.0.8*2
  dnsbl.sorbs.net=127.0.0.6*2
  dnsbl.sorbs.net=127.0.0.9*2
  wl.mailspike.net=127.0.0.[18;19;20]*-2
  list.dnswl.org=127.0.[0..255].0*-2
  list.dnswl.org=127.0.[0..255].1*-3
  list.dnswl.org=127.0.[0..255].2*-4
  list.dnswl.org=127.0.[0..255].3*-5


Thanks for your further reply, but all this stuff is quite new to me, 
and I'm quite mystified by it, to be honest.


Grüße nach Wien

Herbert Eppel
www.HETranslation.co.uk


Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function

2014-12-15 Thread Jari Fredriksson
On 15.12.2014 23:40, Axb wrote:
> On 12/15/2014 10:04 PM, LuKreme wrote:
>> The best way is to train babes
>
> now THAT is a challenge...
>
> What do you feed them during the process?
> diamonds? an appt in the Burj Khalifa? a Veneno Roadster?
>
> 
>
I know that this adds just the noise but it should be obvious that axb
wrote from a cell phone with auto correct...

-- 
jarif.bit




signature.asc
Description: OpenPGP digital signature


Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function

2014-12-15 Thread Axb

On 12/15/2014 10:04 PM, LuKreme wrote:

The best way is to train babes


now THAT is a challenge...

What do you feed them during the process?
diamonds? an appt in the Burj Khalifa? a Veneno Roadster?





Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function

2014-12-15 Thread LuKreme
On Dec 15, 2014, at 10:20 AM, Herbert Eppel  wrote:
> In view of the fact that some of my domains are increasingly inundated with 
> spam, I would like to reduce the SpamAssassin score from the default value of 
> 5 to a lower value, in order to make SpamAssassin more 'aggressive'

This is not the way to go, though it seems to make sense. The rulesets are 
designed around the idea that pushing past a 5.0 indicates a strong possibility 
that the message is spam and that a sore of 4.5 is not. If you drop the score 
to 4.5, you are not making SA more aggressive, you are intentionally marking 
message that SA says are not spam as spam.

A better way is to adjust scores. Carefully.

The best way is to train babes, but train it well. If your host doesn’t allow 
this, maybe you can find a host that does?

Also, what is your server doing BEFORE receiving the message to block spam? 
Most mail providers with cPanel seem to do either nothing or nearly nothing.

Good filters and postscreen (or postscreen-like) before SMTP transaction will 
do *far* more to alleviate your spam problem.

-- 
you cannot code around infinite implementations of OCD -John C Welch



Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function

2014-12-15 Thread Martin Gregorie
On Mon, 2014-12-15 at 18:20 +, Herbert Eppel wrote:

> Thanks for your reply, but I'm afraid as an ordinary SA user with 
> limited knowledge of these matters I have, quite frankly, no idea what 
> you are talking about.
> 
We may be able to offer more relevant help if we understood how your
mail system is connected up.

So far it looks as though your mail is: 

- received by your ISP's main mailserver
- passed to SA which adds spam scoring headers
- then passed through your ISP's spam filter, which deletes any message 
  with a score high enough to be treated as spam.

What happens after that?

Are you simply pointing a mail reader at your ISP's system and using
POP3 or IMAP to retrieve mail from their server? 

- if so, what mailreader are you using? 

  Different Mailreaders have varying ways of handling spam. These 
  range from quite elaborate and configuring to nothing at all.

- if you are doing something different or more elaborate, tell us what
  you're using and how its connected.


Martin






Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function

2014-12-15 Thread Tom Hendrikx
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

On 15-12-14 19:16, Herbert Eppel wrote:
> 
> On 15.12.2014 18:03 UK Time, Joe Quinn wrote:
>> On 12/15/2014 12:34 PM, Herbert Eppel wrote:
>>> On 15.12.2014 17:27 UK Time, Joe Quinn wrote:
 On 12/15/2014 12:20 PM, Herbert Eppel wrote:
> I use QiQ.co.uk for web hosting and associated e-mail
> services. QiQ offer SpamAssassin as an integrated feature
> that is accessible via cPanel – see screenshot below.
> 
> In view of the fact that some of my domains are
> increasingly inundated with spam, I would like to reduce
> the SpamAssassin score from the default value of 5 to a
> lower value, in order to make SpamAssassin more
> 'aggressive'. However, I don't really want to enable Spam
> Auto-Delete because I want to be able to check the spam 
> folder for false positives, but apparently there is no way
> to change the setting without simultaneously enabling the
> "Spam Auto-Delete" function.
> 
> Am I missing something?
> 
> Thank you
> 
> Herbert Eppel www.HETranslation.co.uk
> 
 You'll need to ask QiQ. SA is only a classifier. It takes an
 email as input and outputs score results, plus a modified
 email with spam headers.
 
 I would also caution against lowering the score threshold
 more than 0.5 or so. There's a point where it goes from
 "catching more spam" to "catching more of everything".
>>> 
>>> Thanks for your reply.
>>> 
>>> I already asked QiQ support. They asked me to ask SA :-)
>>> 
>>> Here is their reply: /I will take a look at the filter but
>>> would imagine if that is how Spam Assassin made the program
>>> that way, then there is nothing we can do to change it, though
>>> contacting Spam Assassin for advice may be the way forward, as
>>> we do not provide Spam Assassin, it is a part of cPanel - both
>>> third party programs./
>>> 
>>> The question remains: How can I change the SA score without 
>>> simultaneously enabling the "Spam Auto-Delete" function?
>>> 
>>> Perhaps I need to ask cPanel support?
>>> 
>>> Herbert Eppel www.HETranslation.co.uk
>> (bringing this back on list)
>> 
>> Quite likely. I am not familiar enough with cPanel to know the
>> level of configuration it gives, but my educated guess would be
>> that it's up to QiQ to configure their install of cPanel. It
>> shouldn't hurt to ask cPanel people anyway, even if it's just for
>> them to say exactly what options QiQ should set that opens the
>> option to classify without discard.
> 
> Ooops, I didn't realise I had replied privately. Thanks for your
> further reply.
> 
> Is there another way to access the SA score setting, outside
> cPanel?
> 

I think this is more a cPanel question than a spamassassin one. A very
quick google pointed me towards
https://documentation.cpanel.net/display/ALD/Apache+SpamAssassin

After skimming that, it seems to me that your hosting provider (QIQ)
needs to configure cPanel for you in order to have mail labeled as
spam delivered (to your spam folder or otherwise). Also, in the
default settings, mail labeled as spam by spamassassin is already
dropped (auto-delete spam): you can only change the score threshold in
the gui.

So RTFM, try out some cPanel settings, and contact QIQ when you have a
better understanding of what you can do yourself, and what cPanel
should be able to provide given that QIQ does some tweaking for you.

As far as the level of technical insights you've shown in your
messages until now, I don't think it's useful (or fair) to get into
the gory details of spamassassin config with you. I'm not being
unfriendly but I'm guessing that you use cPanel for a reason: you're
not the seasoned (e-mail) admin that is comfortable tinkering with
command line and manual config file editing.

Kind regards,
Tom
-BEGIN PGP SIGNATURE-
Version: GnuPG v1

iQIcBAEBCAAGBQJUj0ErAAoJEJPfMZ19VO/1UBkQAMH9iUJBMnoU30UmH142IrYQ
Hdh/8CzS77kNHJ/P4vslFDumHca6vLVhEEc8tivLa0OlPl5gs7d0jOEmyDP5XWdq
+B6OUZIiwhsDfmKzT2FiO8xxw2JK4qwC+CDae0K+ul+SLOz9mbhuDWg+GamvuqmK
yoVu4tWkKQ4Kl+5iDczBnxjWJLDckt/ut97VsbJOK1giNGu1NLA+Mhswn+aKznYP
dIAEIP0UacgKfQJj5+I744CPwJcTUz0eErPzqWsBvyo5CuVOjBpiTG/qhBBEsJ4P
94bHSX0R9WzrI33HTHqYR1WCQ1ZTY21ETUOzEjo/XypNqtTPkwiGLvFGtngwp1vk
NOzNBPrA6/+bBCrmKgv7VKnBXEK1/1j3fXW5SpPHhNBusbStQ4Tr+83EMlPkNqc/
hNtztSDbRTBbsB4igTXwKXPx4sYnSvSOc1rwjAgjMJuYkENPv7TDGjHo8K7Wsyvq
aF0v9ekxOYSYSD31P70hmJ1iqKFPYVjaxH3skE5EH+bHJRtht7x6IMeVjUhiUxeT
wdUkpttgUH/TUjDGu6nsK1p+PC5N2JfvTC2nuk2qDB62UqcXmbh6XFCynodXe4cb
hWsGfFY0tWsVBxZm+iMv9aqqpX0a+QuGl+mVd6UEGROfzM0l71KqPvBL5koI+hr6
qAx9HxCzuzZ79/uWEO8c
=wVtz
-END PGP SIGNATURE-


Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function

2014-12-15 Thread Jari Fredriksson
On 15.12.2014 20:16, Herbert Eppel wrote:
>
> On 15.12.2014 18:03 UK Time, Joe Quinn wrote:
>> On 12/15/2014 12:34 PM, Herbert Eppel wrote:
>>> On 15.12.2014 17:27 UK Time, Joe Quinn wrote:
 On 12/15/2014 12:20 PM, Herbert Eppel wrote:
> I use QiQ.co.uk for web hosting and associated e-mail services.
> QiQ offer SpamAssassin as an integrated feature that is accessible
> via cPanel – see screenshot below.
>
> In view of the fact that some of my domains are increasingly
> inundated with spam, I would like to reduce the SpamAssassin score
> from the default value of 5 to a lower value, in order to make
> SpamAssassin more 'aggressive'. However, I don't really want to
> enable Spam Auto-Delete because I want to be able to check the
> spam folder for false positives, but apparently there is no way to
> change the setting without simultaneously enabling the "Spam
> Auto-Delete" function.
>
> Am I missing something?
>
> Thank you
>
> Herbert Eppel
> www.HETranslation.co.uk
>
 You'll need to ask QiQ. SA is only a classifier. It takes an email
 as input and outputs score results, plus a modified email with spam
 headers.

 I would also caution against lowering the score threshold more than
 0.5 or so. There's a point where it goes from "catching more spam"
 to "catching more of everything".
>>>
>>> Thanks for your reply.
>>>
>>> I already asked QiQ support. They asked me to ask SA :-)
>>>
>>> Here is their reply:
>>> /I will take a look at the filter but would imagine if that is how
>>> Spam Assassin made the program that way, then there is nothing we
>>> can do to change it, though contacting Spam Assassin for advice may
>>> be the way forward, as we do not provide Spam Assassin, it is a part
>>> of cPanel - both third party programs./
>>>
>>> The question remains: How can I change the SA score without
>>> simultaneously enabling the "Spam Auto-Delete" function?
>>>
>>> Perhaps I need to ask cPanel support?
>>>
>>> Herbert Eppel
>>> www.HETranslation.co.uk
>> (bringing this back on list)
>>
>> Quite likely. I am not familiar enough with cPanel to know the level
>> of configuration it gives, but my educated guess would be that it's
>> up to QiQ to configure their install of cPanel. It shouldn't hurt to
>> ask cPanel people anyway, even if it's just for them to say exactly
>> what options QiQ should set that opens the option to classify without
>> discard.
>
> Ooops, I didn't realise I had replied privately. Thanks for your
> further reply.
>
> Is there another way to access the SA score setting, outside cPanel?
>
> Herbert Eppel
> www.HETranslation.co.uk
>

SpamAssassin has global settings in text files in the server, and also
*possibly* user definable settings also in a text file(s) in the disk of
the server. If you have a home directory the server (shell access) *and*
QiQ has configured SpamAsassin to allow user configured settings, then
yes. If neither of these options evaluate to "yes" then no.


-- 
jarif.bit




signature.asc
Description: OpenPGP digital signature


Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function

2014-12-15 Thread Reindl Harald



Am 15.12.2014 um 19:20 schrieb Herbert Eppel:

On 15.12.2014 18:02 UK Time, Reindl Harald wrote:

besides that using RBL scoring and wise filters for dynamic PTRs and
invalid HELO names *before* SA on the MTA level should reject most spam
without false positives

3 months:

* 25 delivered ham messages
* 85 MTA level rejects
*  32000 SA hits


Thanks for your reply, but I'm afraid as an ordinary SA user with
limited knowledge of these matters I have, quite frankly, no idea what
you are talking about.

Don't hesitate to tell me to RTFM, but if you feel like elaborating a
little, ideally in an 'acronym-free environment', I would be grateful.


for postfix just Google for the parameters below and read 
http://www.postfix.org/POSTSCREEN_README.html which will kill 90% of all 
junk before it ever touchs the expensive content filter


since only the dialup-balcklists have the reject score of 8 and all 
others need at least confirmation based on trust-level of the RBL 
combined with some whitelists you achieve both:


* large amount of catches
* avoid false positives

this like "127.0.0.[4..7]" are the RBL response codes of aggregated 
lists which has the benefit postscreen needs only do a single dns lookup 
and weight the results (RTFM of the RBL's itself)


postscreen_dnsbl_ttl = 5m
postscreen_dnsbl_threshold = 8
postscreen_dnsbl_action = enforce
postscreen_greet_action = enforce
postscreen_dnsbl_sites =
 dnsbl.sorbs.net=127.0.0.10*8
 zen.spamhaus.org=127.0.0.[10;11]*8
 b.barracudacentral.org=127.0.0.2*7
 dnsbl.inps.de=127.0.0.2*7
 dnsbl.sorbs.net=127.0.0.5*7
 zen.spamhaus.org=127.0.0.[4..7]*7
 zen.spamhaus.org=127.0.0.3*5
 bl.mailspike.net=127.0.0.2*5
 bl.mailspike.net=127.0.0.[10;11;12]*4
 bl.spamcop.net=127.0.0.2*4
 bl.spameatingmonkey.net=127.0.0.[2;3]*4
 dnsrbl.swinog.ch=127.0.0.3*4
 zen.spamhaus.org=127.0.0.2*3
 dnsbl.sorbs.net=127.0.0.7*3
 dnsbl.sorbs.net=127.0.0.8*2
 dnsbl.sorbs.net=127.0.0.6*2
 dnsbl.sorbs.net=127.0.0.9*2
 wl.mailspike.net=127.0.0.[18;19;20]*-2
 list.dnswl.org=127.0.[0..255].0*-2
 list.dnswl.org=127.0.[0..255].1*-3
 list.dnswl.org=127.0.[0..255].2*-4
 list.dnswl.org=127.0.[0..255].3*-5





signature.asc
Description: OpenPGP digital signature


Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function

2014-12-15 Thread Herbert Eppel

On 15.12.2014 18:02 UK Time, Reindl Harald wrote:


Am 15.12.2014 um 18:27 schrieb Joe Quinn:

On 12/15/2014 12:20 PM, Herbert Eppel wrote:

I use QiQ.co.uk for web hosting and associated e-mail services. QiQ
offer SpamAssassin as an integrated feature that is accessible via
cPanel – see screenshot below.

In view of the fact that some of my domains are increasingly inundated
with spam, I would like to reduce the SpamAssassin score from the
default value of 5 to a lower value, in order to make SpamAssassin
more 'aggressive'. However, I don't really want to enable Spam
Auto-Delete because I want to be able to check the spam folder for
false positives, but apparently there is no way to change the setting
without simultaneously enabling the "Spam Auto-Delete" function.

Am I missing something?

Thank you

Herbert Eppel
www.HETranslation.co.uk


You'll need to ask QiQ. SA is only a classifier. It takes an email as
input and outputs score results, plus a modified email with spam headers.

I would also caution against lowering the score threshold more than 0.5
or so. There's a point where it goes from "catching more spam" to
"catching more of everything"


besides that using RBL scoring and wise filters for dynamic PTRs and
invalid HELO names *before* SA on the MTA level should reject most spam
without false positives

3 months:

* 25 delivered ham messages
* 85 MTA level rejects
*  32000 SA hits


Thanks for your reply, but I'm afraid as an ordinary SA user with 
limited knowledge of these matters I have, quite frankly, no idea what 
you are talking about.


Don't hesitate to tell me to RTFM, but if you feel like elaborating a 
little, ideally in an 'acronym-free environment', I would be grateful.


Herbert Eppel
www.HETranslation.co.uk


Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function

2014-12-15 Thread Herbert Eppel

  
  

On 15.12.2014 18:03 UK Time, Joe Quinn
  wrote:


  
  On 12/15/2014 12:34 PM, Herbert Eppel
wrote:
  
  

On 15.12.2014 17:27 UK Time, Joe Quinn wrote:

  
  On 12/15/2014 12:20 PM, Herbert
Eppel wrote:
  
  

I use QiQ.co.uk for web hosting and associated e-mail
services. QiQ offer SpamAssassin as an integrated feature
that is accessible via cPanel – see screenshot below.

In view of the fact that some of my domains are increasingly
inundated with spam, I would like to reduce the SpamAssassin
score from the default value of 5 to a lower value, in order
to make SpamAssassin more 'aggressive'. However, I don't
really want to enable Spam Auto-Delete because I want to be
able to check the spam folder for false positives, but
apparently there is no way to change the setting without
simultaneously enabling the "Spam Auto-Delete" function. 

Am I missing something?

Thank you

Herbert Eppel
www.HETranslation.co.uk

  
  You'll need to ask QiQ. SA is only a classifier. It takes an
  email as input and outputs score results, plus a modified
  email with spam headers.
  
  I would also caution against lowering the score threshold more
  than 0.5 or so. There's a point where it goes from "catching
  more spam" to "catching more of everything".


Thanks for your reply. 

I already asked QiQ support. They asked me to ask SA  :-) 

Here is their reply:
I will take a look at the filter but would imagine if that is
  how Spam Assassin made the program that way, then there is
  nothing we can do to change it, though contacting Spam
  Assassin for advice may be the way forward, as we do not
  provide Spam Assassin, it is a part of cPanel - both third
  party programs.

The question remains: How can I change the SA score without
simultaneously enabling the "Spam Auto-Delete" function?

Perhaps I need to ask cPanel support?

Herbert Eppel
www.HETranslation.co.uk
  
  (bringing this back on list)
  
  Quite likely. I am not familiar enough with cPanel to know the
  level of configuration it gives, but my educated guess would be
  that it's up to QiQ to configure their install of cPanel. It
  shouldn't hurt to ask cPanel people anyway, even if it's just for
  them to say exactly what options QiQ should set that opens the
  option to classify without discard.


Ooops, I didn't realise I had replied privately. Thanks for your
further reply.

Is there another way to access the SA score setting, outside cPanel?

Herbert Eppel
www.HETranslation.co.uk

  



Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function

2014-12-15 Thread Reindl Harald


Am 15.12.2014 um 18:27 schrieb Joe Quinn:

On 12/15/2014 12:20 PM, Herbert Eppel wrote:

I use QiQ.co.uk for web hosting and associated e-mail services. QiQ
offer SpamAssassin as an integrated feature that is accessible via
cPanel – see screenshot below.

In view of the fact that some of my domains are increasingly inundated
with spam, I would like to reduce the SpamAssassin score from the
default value of 5 to a lower value, in order to make SpamAssassin
more 'aggressive'. However, I don't really want to enable Spam
Auto-Delete because I want to be able to check the spam folder for
false positives, but apparently there is no way to change the setting
without simultaneously enabling the "Spam Auto-Delete" function.

Am I missing something?

Thank you

Herbert Eppel
www.HETranslation.co.uk


You'll need to ask QiQ. SA is only a classifier. It takes an email as
input and outputs score results, plus a modified email with spam headers.

I would also caution against lowering the score threshold more than 0.5
or so. There's a point where it goes from "catching more spam" to
"catching more of everything"


besides that using RBL scoring and wise filters for dynamic PTRs and 
invalid HELO names *before* SA on the MTA level should reject most spam 
without false positives


3 months:

* 25 delivered ham messages
* 85 MTA level rejects
*  32000 SA hits




signature.asc
Description: OpenPGP digital signature


Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function

2014-12-15 Thread Joe Quinn

On 12/15/2014 12:34 PM, Herbert Eppel wrote:

On 15.12.2014 17:27 UK Time, Joe Quinn wrote:

On 12/15/2014 12:20 PM, Herbert Eppel wrote:
I use QiQ.co.uk for web hosting and associated e-mail services. QiQ 
offer SpamAssassin as an integrated feature that is accessible via 
cPanel -- see screenshot below.


In view of the fact that some of my domains are increasingly 
inundated with spam, I would like to reduce the SpamAssassin score 
from the default value of 5 to a lower value, in order to make 
SpamAssassin more 'aggressive'. However, I don't really want to 
enable Spam Auto-Delete because I want to be able to check the spam 
folder for false positives, but apparently there is no way to change 
the setting without simultaneously enabling the "Spam Auto-Delete" 
function.


Am I missing something?

Thank you

Herbert Eppel
www.HETranslation.co.uk

You'll need to ask QiQ. SA is only a classifier. It takes an email as 
input and outputs score results, plus a modified email with spam headers.


I would also caution against lowering the score threshold more than 
0.5 or so. There's a point where it goes from "catching more spam" to 
"catching more of everything".


Thanks for your reply.

I already asked QiQ support. They asked me to ask SA :-)

Here is their reply:
/I will take a look at the filter but would imagine if that is how 
Spam Assassin made the program that way, then there is nothing we can 
do to change it, though contacting Spam Assassin for advice may be the 
way forward, as we do not provide Spam Assassin, it is a part of 
cPanel - both third party programs./


The question remains: How can I change the SA score without 
simultaneously enabling the "Spam Auto-Delete" function?


Perhaps I need to ask cPanel support?

Herbert Eppel
www.HETranslation.co.uk

(bringing this back on list)

Quite likely. I am not familiar enough with cPanel to know the level of 
configuration it gives, but my educated guess would be that it's up to 
QiQ to configure their install of cPanel. It shouldn't hurt to ask 
cPanel people anyway, even if it's just for them to say exactly what 
options QiQ should set that opens the option to classify without discard.


Re: Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function

2014-12-15 Thread Joe Quinn

On 12/15/2014 12:20 PM, Herbert Eppel wrote:
I use QiQ.co.uk for web hosting and associated e-mail services. QiQ 
offer SpamAssassin as an integrated feature that is accessible via 
cPanel -- see screenshot below.


In view of the fact that some of my domains are increasingly inundated 
with spam, I would like to reduce the SpamAssassin score from the 
default value of 5 to a lower value, in order to make SpamAssassin 
more 'aggressive'. However, I don't really want to enable Spam 
Auto-Delete because I want to be able to check the spam folder for 
false positives, but apparently there is no way to change the setting 
without simultaneously enabling the "Spam Auto-Delete" function.


Am I missing something?

Thank you

Herbert Eppel
www.HETranslation.co.uk

You'll need to ask QiQ. SA is only a classifier. It takes an email as 
input and outputs score results, plus a modified email with spam headers.


I would also caution against lowering the score threshold more than 0.5 
or so. There's a point where it goes from "catching more spam" to 
"catching more of everything".


Can't change SpamAssassin score without enabling the "Spam Auto-Delete" function

2014-12-15 Thread Herbert Eppel

  
  
I use QiQ.co.uk for web hosting and associated e-mail services. QiQ
offer SpamAssassin as an integrated feature that is accessible via
cPanel – see screenshot below.

In view of the fact that some of my domains are increasingly
inundated with spam, I would like to reduce the SpamAssassin score
from the default value of 5 to a lower value, in order to make
SpamAssassin more 'aggressive'. However, I don't really want to
enable Spam Auto-Delete because I want to be able to check the spam
folder for false positives, but apparently there is no way to change
the setting without simultaneously enabling the "Spam Auto-Delete"
function. 

Am I missing something?

Thank you

Herbert Eppel
www.HETranslation.co.uk