Don't use Bayes if the mail was already rewritten by spamassassin / multiple spamassassin servers in the delivery chain

[Stefan Walk <em...@fuer-et.de>]

Hi,

i have a mail server that I manage, using SpamAssassin 3.1.7. 
Unfortunately some mail (for example mail going to my university 
account) gets filtered by other SpamAssassin instances. If they detected 
spam, the mail gets rewritten and the original mail is inside the 
attachment. Now many of them get BAYES_00-scores because of the text 
inserted by SpamAssassin, sometimes dropping them below 5.0 points. What 
has not happened (yet) is that they have been autolearned by the 
bayesian filter as ham, luckily. I see some ways to solve this problem:
- trust the other servers and learn those mails as spam, but i wouldn't 
like to do that (they had quite a few false positives in the past)
- rewrite the mail before processing, purging the traces from previous 
spamassassin instances (i'm using procmail, so this would not be too 
hard, is there a premade solution to this by chance?)
- prevent Bayes from running (and learning) when a mail comes in that 
has been rewritten. Is there a way to do that?

Thanks in advance,
Stefan

Re: Don't use Bayes if the mail was already rewritten by spamassassin / multiple spamassassin servers in the delivery chain

[Matus UHLAR - fantomas <uh...@fantomas.sk>]

On 08.09.07 15:24, Stefan Walk wrote:
> i have a mail server that I manage, using SpamAssassin 3.1.7.
> Unfortunately some mail (for example mail going to my university account)
> gets filtered by other SpamAssassin instances.

going to, or from (through) yout university account?

> If they detected spam, the mail gets rewritten and the original mail is
> inside the attachment. Now many of them get BAYES_00-scores because of the
> text inserted by SpamAssassin, sometimes dropping them below 5.0 points.

the downside of setting report_safe to anything else than 0 - if you can do
it, do it, or ask the admins to do it. I'm not sure if they will accept your
request but it's worth trying.

However, if the mail is going through one or more accounts, such relaying
blurs the spam score, e.g. you would need to have all mailservers in
trusted_networks and internal_networks for good checking of blacklists, SPF
etc. luckily BAYES can usually fix that...
 
> I see some ways to solve this problem:
> - trust the other servers and learn those mails as spam, but i wouldn't 
> like to do that (they had quite a few false positives in the past)

imho it's best to filter before forwarding, if possible.

> - rewrite the mail before processing, purging the traces from previous 
> spamassassin instances (i'm using procmail, so this would not be too 
> hard, is there a premade solution to this by chance?)

I believe it's possible, but I don't know of any solution which does that.
However I think this is the best in your situation.

> - prevent Bayes from running (and learning) when a mail comes in that 
> has been rewritten. Is there a way to do that?

using different user preferences file, when run from procmail.

-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Depression is merely anger without enthusiasm.