J Thomas Hancock wrote: > Part 1: > > My boss is convinced that SpamAssassin can delete an email if it > crosses a certain hit threshold. Everything I have read states that > SpamAssassin can only add a flag to the message (be it a subject > rewrite, something in the header, ect) and that the MTA, postfix in > our case, rejects the message based on that flag. So am I correct in > stating that SpamAssassin can not delete a message?
You are exactly correct, good job doing the research before hand. The program you use to integrate SA into your mail system will have the end control of the outcome of a message. In your case, with Procmail, you could simply delete the message (not recommended) or you could bounce the message (even worse than the previous idea of deleting) or you could filter it into a seperate folder / inbox to be reviewed. The last idea is the best idea. It's never a good idea to just delete or bounce a message. > Part 2: > > My last question to this list was how to able to flag the message for > deleting if the required_hits exceeds 15, for argument sake, and > rewrite the subject header if the required_hits exceeds 10. I was > told SpamAssassin could not do that. I looked into using > MailScanner, but the PHB did not like that solution since it took too > much customization to read the users preferences from a MySQL table. > We came up with 2 ugly solutions. I bounce messages which score over 6.6, it's been a long road of whitelisting specific senders and closely watching this sytem to make it work for us like this. We use MIMEDefang to accomplish this, it's fairly easy if you know some perl, but for Procmail, I will leave that to someone who knows more. > > > > The first solution is to run two instances of SpamAssassin. Instance > one runs the required_hits for deleting the message and the second > instance runs the scan for rewriting the subject. Each instance of > SpamAssassin can run on a different port/IP address. Does anyone > here have any experience with such a configuration? Never needed to do anything like this, You could have both configs combined into one instance. Rewrite the subject and delete / move the message if it reaches your threshold.
