11 messages in net.sourceforge.lists.courier-maildrop[maildropl] Re: filtering using body ...
FromSent OnAttachments
PollywogDec 19, 2004 8:20 am 
PollywogDec 19, 2004 1:50 pm 
Thorsten HaudeDec 19, 2004 2:30 pm 
Thorsten HaudeDec 19, 2004 2:35 pm 
PollywogDec 19, 2004 2:47 pm 
Tony EarnshawDec 20, 2004 4:11 am 
PollywogDec 20, 2004 9:51 am 
Paul L. AllenDec 20, 2004 12:24 pm 
PollywogDec 20, 2004 12:31 pm 
Thorsten HaudeDec 21, 2004 4:33 pm 
PollywogDec 21, 2004 4:50 pm 
Actions with this message:
Paste this link in email or IM:
Paste this link in email or IM:
Atom feed for this thread
Paste this URL into your reader:
Subject:[maildropl] Re: filtering using body checksActions...
From:Paul L. Allen (pl@softflare.com)
Date:Dec 20, 2004 12:24:44 pm
List:net.sourceforge.lists.courier-maildrop

Pollywog writes:

I have looked at dspam

I hadn't heard of it until Tony mentioned it. Going by the claims it makes, it does a better job than spamassassin and doesn't need constant rule-tweaking to trap mutating words.

but it seemed difficult to set up

The big question for me is can it be dropped into our existing qmail/vpopmail/maildrop/divert to .Spam/learn from Spam and (most non-Spam folders) setup without users noticing or having to be taught to do things differently. That is something I'll have to look into, one day.

However, if you dspam remains too difficult for you, then three things:

1) Spamcop-URI (this functionality is included in SA 3.0) will catch bad URLs in the mail. It takes some hours for a new URL to be added, so spammers get new URLs every day or two, but it catches a lot of spam.

2) Use an RBL (at MTA or Spamassassin level) that blocks dynamic IPs. Almost nobody on dynamic IP runs a legitimate mail server (Softflare has a few customers that do) and most spam comes from zombie home computers that are on dial-up or adsl/cable with long dhcp leases and are classed by RBLs as dynamic (technically there is no reason why these shouldn't be static but ISPs can charge more for a fixed IP if the standard product uses dhcp).

3) Spamassassin rule (in local.cfg or any other .cfg file):

describe YOUR_RULE_NAME No Subject header YOUR_RULE_NAME Subject !~ /\S/ score YOUR_RULE_NAME 6.0

Adjust the score according to whether you want to definitely block all of these or want it to come close to your trigger level so that any other rules triggering will take it over.