Spam attack

[Matt]

Great, you should see a considerable improvement.

Go into cPanel > mail > Spam Assassin > and click on the button right under "Enable Spam Assassin" it says:

"Configure Spam Assassin (required to rewrite subjects)"

Once you are in there, you will see "required_score" and that should default to 5. You can lower this number for more filtering or raise it for less filtering. Once you have done that, you can keep the default subject line next to "rewrite_header subject" as **SPAM** or you can get creative.

I used this one: Spam Hits _HITS_ / of _REQD_

The above would rewrite mail flagged as spam to have a subject like:
Spam Hits 6 / of 5 {the original subject here}

This told me that the email scored a 6 of 5 allowed, and would have been automatically trashed if i set the filter up for it. if it were a 4 of 5, it would not have been rewritten (or trashed should you configure it like that) it would have been delivered as normal.

I suggest using subject rewrites for a few days until you have a good threshold (required_score) that you like, then go apply the filter when you are comfortable with the way you have configured Spam Assassin.

Just make sure you keep the Spam box disabled unless you plan on checking and cleaning it periodically because all it does is collect junk. I am cosidering removing it as an option as 99% of the users never check it and it wastes their disk space.

[charlesh]

Matt,

Thanks for the info on tweaking spamassasin. One question, when we put the number of hits out of X allowed into our subject rewrites, do we have to further configure anything else in the options, such as redoing the scores, etc or is that all we have to really tweak?

And, when we are comfortable in the level of filter, how do we stop those messages from being delivered? Do I click the link on cPanel -> Mail -> SpamAssasin that says to "To simply have the server DELETE and NOT deliver emails that are tagged as spam by SpamAssassin click here now"?

Thanks,
Charles H.

[Matt]

Charles

Thanks for the info on tweaking spamassasin. One question, when we put the number of hits out of X allowed into our subject rewrites, do we have to further configure anything else in the options, such as redoing the scores, etc or is that all we have to really tweak?

The only reason I suggest doing that is because its quick and easy to see how an email was scored by spam assassin while you are getting used to how it scores junkmail.

You do not have to do this, you can just look at the email headers and Spam Assassin writes the score in there as well. I just think it saves a few clicks if you rewrite the subject lines and it is right there in front of you for speedy reference.

Once you are comfortable with how it scored you and adjust X up our down to the point where spam assassin with actually do something useful with emails flagged as spam.

When you like the numbers go into cPanel > mail > filters and there is a spam assassin hint which works well to discard email tagged as spam so you never see it, or, you can forward it to another email box instead of "Discard" if you want to manually process / check forwarded emails marked as spam for false positives.

And, when we are comfortable in the level of filter, how do we stop those messages from being delivered? Do I click the link on cPanel -> Mail -> SpamAssasin that says to "To simply have the server DELETE and NOT deliver emails that are tagged as spam by SpamAssassin click here now"?

I have had better luck with the filter previously described versus using the one you are talking about, either SHOULD work, I know the filter I discussed DOES work. haven't tried the one on the Spam Assassin page in a while though, at one point I know it was not properly discarding email.

[charlesh]

Matt,

I did try the link referred to above to stop the spam from getting through and it hasn't worked, so that is why I was asking. I will try the filter method, since that has better results. Thanks for the reply to the post. I will also try to delete the default E-mail address for the account to help things along as it not being the catch-all. Then, maybe I'll quit getting calls. The thing is, he is pulling the pop directly from his blackberry. I finally got my client to quit forwarding through Comcast, so this was the option and he told me that the level of spams he was getting on his handheld was totally irratating him (can't say that I blame him).

I'll update everyone who has read this topic on how the results come out.

CharlesH.