Configuring and using DSPAM

[Splat]

Not sure if that will work as procmail is needed. Im sure there has to be a way to dump the spam flagged into a quarantine mailbox.

[Splat]

Aparently the spam flag option isnt working either. Not sure if I have something set up wrong in dspam.conf
#############################
# Preferences: Specify any preferences to set by default, unless otherwise
# overridden by the user (see next section) or a default.prefs file.
# If user or default.prefs are found, the user's preferences will override any
# defaults.
#
#Preference "spamAction=quarantine"
Preference "signatureLocation=message" # 'message' or 'headers'
Preference "showFactors=on"
Preference "spamAction=tag"
Preference "spamSubject=SPAM"

###########################

Pretty sure there isnt a default.prefs file setup anywhere. W/ that config it should add a SPAM tag at the begining of the subject right? Not sure why thats not working.

[marcmac]

Remember, dspam is being called by amavisd - so you'll want to modify the amavisd config, not the dspam config.

For header tagging - that's controlled by the zimbraSpamSubjectTag attribute, which you can set in the admin UI.

[Splat]

Where in the admin UI?

[marcmac]

Global settings->Anti-spam->SPam subject prefix.

[Splat]

would adding the line.

$spam_quarantine_to="spam\@domain.com";

move the messages flagged as spam to the spam mailbox w/ dspam or does that just work with spam assassin?

[marcmac]

I'm not 100% sure - amavisd documentation is always an adventure, and I usually end up in the code to figure this stuff out.

Here's what the code sez:

# where to send quarantined malware
# Specify undef to disable, or e-mail address containing '@',
# or just a local part, which will be mapped by %local_delivery_aliases
# into local mailbox name or directory. The lookup key is a recipient address
$virus_quarantine_to = 'virus-quarantine'; # %local_delivery_aliases mapped
$banned_quarantine_to = 'banned-quarantine'; # %local_delivery_aliases mapped
$bad_header_quarantine_to = 'bad-header-quarantine'; # %local_delivery_aliases
$spam_quarantine_to = 'spam-quarantine'; # %local_delivery_aliases mapped

So - If amavis recognizes it as spam, that should work - though I'm not clear on how to get amavis to listen to what DSPAM says (if dspam and SA disagree, it tends to go with SA (or, perhaps, it goes with "not spam" to be safe. That makes more sense)).

[Splat]

I added the Spam tag for the subject but I dont think its working.

Subject: University Administration
Date: Fri, 20 Jan 2006 10:27:43 -0700
Mime-Version: 1.0
Content-Type: text/plain
X-DSPAM-Result: Spam
X-DSPAM-Processed: Fri Jan 20 13:14:22 2006
X-DSPAM-Confidence: 0.8465
X-DSPAM-Improbability: 1 in 552 chance of being ham
X-DSPAM-Probability: 1.0000
X-DSPAM-Signature: 43d1287e280161696382214
X-DSPAM-Factors: 15,
X-Virus-Scanned: amavisd-new at
X-Spam-Status: No, score=3.7 tagged_above=-10 required=6.6 autolearn=no
tests=[BAYES_99=3.5, DNS_FROM_RFC_ABUSE=0.2, MSGID_FROM_MTA_HEADER=0]
X-Spam-Score: 3.7
X-Spam-Level: ***


Is it possible that because Spam assassin is flagging it Ham. If thats the case is it possible to not run it through spam assassin if it is marked spam by dspam.

[marcmac]

As I said earlier, I'm not sure how amavis decides which AS system to listen to - best bet is to check the amavis documentation, or see if you can disable SA in the config file.

[Splat]

Read this on another page. Going to try changing the /opt/zimbra/conf/salocal.cf with the changes below to see what happens.

http://wiki.seds.org/index.php/Spam/Virus

DSPAM & SpamAssassin

Finally, in order for Amavis/SpamAssassin to make use of the DSPAM result, the following needs to be in the SpamAssassin configuration file (/etc/mail/spamassassin/local.cf):

### Place more weight on DSPAM's opinion
header DSPAM_SPAM X-DSPAM-Result =~ /^Spam$/
describe DSPAM_SPAM DSPAM claims it is spam
score DSPAM_SPAM 4.0

header DSPAM_HAM X-DSPAM-Result =~ /^Innocent$/
describe DSPAM_HAM DSPAM claims it is ham
score DSPAM_HAM -0.25