Spam weirdness

[dwmtractor]

This is for all you SpamAssassin gurus out there. I have a specific low-volume commercial emailer--low enough not to get on all the blacklists because he targets construction dealers such as us--for whom the only real key (short of blacklisting a domain) that would really catch all his junk is the fact that he's in Singapore, so all his emails come to me as future-dated. Here's a header that shows that in fact, the future dating is being recognized by SpamAssassin:

No, score=3.896 tagged_above=-10 required=4 tests=[BAYES_50=0.001, DATE_IN_FUTURE_12_24=2.189, DEAR_SOMETHING=1.605, HTML_MESSAGE=0.001, RDNS_NONE=0.1]

That's not enough to get him tagged as spam in my system, and I'm a little reluctant to lower my threshold even further than I already have overall. However, if I could raise that DATE_IN_FUTURE_12_24 to a higher score, say an even 3 points, it would solve my problem.

I tried to do this by adding the following lines to my /opt/zimbra/conf/spamassassin/local.cf:

# Increase future date score to control Asian spam
score DATE_IN_FUTURE_24_48 3.599 3.599 3.599 3.599

I have a variety of other settings in local.cf that appear to be working, including enhanced Bayes scoring and commercial whitelist penalties. However this particular line seems to refuse to work at all. I've tried it both with the single score and all four scores, neither way works.

Can anyone point me in the direction of why this line, among all the others, is being ignored?

In case there is an issue with conflicting rules or orders, here is my entire local.cf:

#My tweaks to the Bayes scoring system - DWM
score BAYES_00 0.0001 0.0001 -2.312 -2.599
score BAYES_05 0.0001 0.0001 -1.110 -1.110
score BAYES_20 0.0001 0.0001 -0.740 -0.740
score BAYES_40 0.0001 0.0001 -0.185 -0.185
score BAYES_50 0.0001 0.0001 0.001 0.001
score BAYES_60 0.0001 0.0001 1.0 1.0
score BAYES_80 0.0001 0.0001 2.5 2.5
score BAYES_95 0.0001 0.0001 5.5 5.5
score BAYES_99 0.0001 0.0001 6.5 6.5

# Score to penalize Bonded Sender Program (BSP) whitelisting
score RCVD_IN_BSP_TRUSTED 2
score RCVD_IN_BSP_OTHER 2
score RCVD_IN_BONDEDSENDER 2

# Score to penalize Habeas whitelisting
score HABEAS_ACCREDITED_COI 2
score HABEAS_ACCREDITED_SOI 2
score HABEAS_CHECKED 2

# Score to penalize ISIPP/IADB SuretyMail whitelisting
score RCVD_IN_IADB_VOUCHED 2
score RCVD_IN_IADB_DOPTIN 2
score RCVD_IN_IADB_ML_DOPTIN 2

# Score to penalize DNSWL whitelisting
score RCVD_IN_DNSWL_LOW 2
score RCVD_IN_DNSWL_MED 2
score RCVD_IN_DNSWL_HI 2

# Turn off 'Auto-Whitelist'
use_auto_whitelist 0

# Increase future date score to control Asian spam
score DATE_IN_FUTURE_24_48 3.599 3.599 3.599 3.599

Thanks, folks!

Dan

[linch]

May be it would say if there is a conflict...

[dwmtractor]

The spamassassin utilities are not loaded with Zimbra, so no, I have not. I may have to download them and cobble them in but like to avoid messing with the install if I can help it. . .

[linch]

Add a new rule with the same catch condition as the original one... New name with the added score...
This way the message would trigger one additional rule and that's it...

Hope it helps.

[dwmtractor]

Well Mike almost hit it yesterday in an offline chat, but I just noticed what is probably the problem this morning. The header shows a hit in DATE_IN_FUTURE_12_24 and I was changing the scores for _24_48. I have now revised the CORRECT rule in local.cf and will post back success or failure based on the next emails that come in.

Don'cha just hate how these damn computers can't read our minds?

[mmorse]

Told him to edit as they stood in the regular scores file - then bug me if they didn't apply when he stuck them in local.cf

Possibilities include:
DATE_IN_FUTURE_03_06
DATE_IN_FUTURE_06_12
DATE_IN_FUTURE_12_24
DATE_IN_FUTURE_24_48
DATE_IN_FUTURE_48_96
DATE_IN_FUTURE_96_XX
From the other side:
DATE_IN_PAST_03_06
DATE_IN_PAST_06_12
DATE_IN_PAST_12_24
DATE_IN_PAST_24_48
DATE_IN_PAST_96_XX

[dwmtractor]

Told him to edit as they stood in the regular scores file - then bug me if they didn't apply when he stuck them in local.cf

Trouble is, I edited the 24_48 file in the regular section too, so it didn't work last night either. . .

[mmorse]

oh that's classic - heck, I just now forgot the passphrase for one of my private keys...