On Wed, 13 Jan 2010, tonjg wrote: : thanks for your response Ned. : your last line describes exactly what I want to do - reject mail, do it at : the smtp stage in sendmail - but I don't know how to achieve this.
Welcome! Permit me to state what may be considered 'obvious' to many, but which may not have yet come to the attention of someone 'new': One person's spam is another person's legitimate mail. No matter how hard we try, SpamAssassin will *always* classify some spam as 'wanted' mail (ham) and classify some wanted mail as spam. This happens because the criteria, and individual mail differ for everyone. It is for this reason that SpamAssassin operates to *flag* e-mail, but otherwise does not do anything with it. It does not 'delete' nor move it to a special folder. Those are YOUR decisions. They are left to you because they cannot be made until YOU test your own filter settings, and perhaps adjust scores for individual rules that are appropriate only for your specific circumstance. You may even create some of your own custom rules for special cases unique to your system. With a bit of experimentation, you will discover that all (or most) of your 'ham' arrives with a score lower than a certain level, and adjust the score leve in your SA to match. You then get to decide what to DO with mail flagged as spam..... You can 'quarantine' it, putting it into a special folder. This is a 'safe' option, provided you remember to check that folder occasionally and empty it out. This option allows you to score more aggressively, with a higher risk of 'false postitives' (legitimate mail flagged as spam). You can opt to delete the mail marked as spam, in which case you will probably want to choose a more conservative score level for your filter ( higher number), so that the risk of false positives is minimized. If you are able to scan the mail *during* the SMTP (sendmail) process, you can issue an 'exit code' to sendmail that will cause sendmail to 'reject' the mail, at which point the sending system must figure out what to do with it. This allows a legit sender to know their mail didn't make it. IMPORTANT: Note the use of the word 'reject' and that it is in the context of an SMTP mail connection. This is different from a BOUNCE which is mail created by your server and SENT to whoever it THINKS sent the mail. Very often the sending address of spam is FORGED and so you are sending what is known as 'backscatter' if you try to stop the mail after it has been 'accepted' by sendmail. The importance of this cannot be stressed enough. If you cannot REJECT mail by running SA within the context of the sendmail filtering/miltering, then please just quarantine or delete it. Here on my system, I split the first and third option. I run SA during my SMTP session, so I REJECT anything that scores higher than 10 points. It is extremely unlikely that legitimate mail will score that high, and if it does, this usually indicates that the sender has BIG problems with their mail setup. A legitimate sender will see an error message explaining what they did wrong. Mail that scores below 10 is then compared to a user-selected score value, and based on that user's choice, either delivered normally, or placed into that user's 'spamtrap' quarantine file. This two-level approach keeps the spamtrap folder relatively small, which helps when encouraging users to review it occasionally. :) THE EASY WAY: If you opt for the quarantine or delete options, you don't have to try and perform the messy task of integrating SA into your sendmail. You can run it from your procmailrc file. Just be sure that procmail always considers the mail 'delivered', so that you don't generate 'bounces'. Hope this helps! - Charles
