I'll expand on what I was thinking of doing originally. My environment consists of two Linux boxes with sendmail and spamassassin that send and receive e-mail for several internal mail servers. All these boxes do are acts as smarthosts and relay mail into the internal servers.
I was thinking of writing a script to extract all the to=<address> phrases in the maillog file. Dump all the ones that are local domains (incoming mail) and put the rest in a file. Then have a spamassassin that checks the from on incoming mail, and if there's a match assign it some negative value. Of course to make this non-MTA specific SpamAssassin could pull the "to" address itself and store it in a file/database. The trick is if you have several smarthosts you would want to consolidate all the address. This hasn't been thought through all the way so I may be way out in left field with this one. By the way I would think it would be better site wide, than user-specific. The larger the list of address that people are actually sending to the better. Of course you could have a user e-mail a spammer who latter uses that same address to send spam which could allow real spam through, but the point isn't to be perfect here. Just get the highest majority possible. Steve Evans SDSU Foundation (619) 594-0653 -----Original Message----- From: Steve Evans Sent: Sunday, November 24, 2002 8:29 PM To: SpamAssasin Mailing List Subject: [SAtalk] Suggestion to Reduce False Positive Keep a database with every address that e-mail is sent to. Have a rule with a negative value that checks that database on incoming mail. I find it quite unlikely that any address that someone would send a message to would ever be sending my server spam. Any thoughts? Steve Evans SDSU Foundation (619) 594-0653 ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
