Antispam for Russian users

[PoltoS]

Hello.

How to check if my antispam filter is learning?

I'm using ZCS 5.0.12. All my users receives mails in russian. We always send spam to the Junk and false positive we mark as not spam. But I guess the filter is not learning. Every day i receive the same spam mails and mark them as Junk, but the next day I found new one in my Inbox (with the same message body).

Spamassasin is turned on, there are a lot of mails marked as spam every day. The ratio of true positive (spam marked as spam) to true negative (spam not marked as spam) is about 6:1 which is not good IHMO.

How do I improve the filter? We have spam and ham accounts, so it should be learning. May this be because of russian text in messages? May be SA can not analyse russian messages, just their headers?

[phoenix]

Check the details in this thread: [SOLVED] Spam Backscatter I would suggest you try and determine why you appear to be receiving the same spam before making any modifications to the ant-spam system. Does the email have any spam scores? What are your kill & tag percentages? What do the headers look like for some of the email? Do you have DSPAM enabled?

[PoltoS]

I've read the thread you suggested and I'm not sure it is relevant to me. The spam I receive is not a reply of the some server to a message that is supposed to be from me. I don't have this type of spam. I've simple messages comming from different non-existing mailboxes.

My kill/tag percentages are 75/33 (as by default). I'm not sure I've DSPAM enabled. How to know it?

# mysql dspam
ERROR 1049 (42000): Unknown database 'dspam'

Does this mean that DSPAM is not installed?

Which of these do you recomend to enable (here is my config)?
reject_invalid_hostname (enabled)
reject_non_fqdn_hostname (off)
reject_non_fqdn_sender (enabled)
reject_unknown_client (off)
reject_unknown_hostname (off)
reject_unknown_sender_domain (off)

[phoenix]

Originally Posted by PoltoS

I've read the thread you suggested and I'm not sure it is relevant to me. The spam I receive is not a reply of the some server to a message that is supposed to be from me. I don't have this type of spam. I've simple messages comming from different non-existing mailboxes.

There are details in that thread on how to reject 'foreign language' spam.

Originally Posted by PoltoS

My kill/tag percentages are 75/33 (as by default).

Try reducing the to 66/25 and see if that improves anything.

Originally Posted by PoltoS

I'm not sure I've DSPAM enabled. How to know it?

Run the following command or look in the log files at startup to see if dspam is enabled:

zmlocalconfig | grep dspam

Originally Posted by PoltoS

# mysql dspam
ERROR 1049 (42000): Unknown database 'dspam'

Does this mean that DSPAM is not installed?

No, it doesn't.

Originally Posted by PoltoS

Which of these do you recomend to enable (here is my config)?
reject_invalid_hostname (enabled)
reject_non_fqdn_hostname (off)
reject_non_fqdn_sender (enabled)
reject_unknown_client (off)
reject_unknown_hostname (off)
reject_unknown_sender_domain (off)

I only use reject_invalid_hostname and some additional RBLs, what RBLs have you got set?

zmprov gacf | grep zimbraMtaRestriction

Are you discarding emails sent to invalid addresses?

Do you actually have the ham/spam accounts set-up correctly?

zmprov gacf | grep SpamAccount

See if they match the names in your Admin UI accounts list, if not set them with:

zmprov mcf zimbraSpamIsSpamAccount spam@domain.com
zmprov mcf zimbraSpamIsNotSpamAccount ham@domain.com

obviously put the correct account and domain name in there.