Hello FH, Thursday, February 10, 2005, 11:48:37 AM, you wrote:
F> Hopefully this isn't a FAQ, I looked over the list on the website and F> while there is some useful info there I didn't see answers to all my F> questions (or maybe I just didn't realize they were answered as this is F> all new to me ;)) The major problems/questions as I read your email are FAQs, though possibly not listed yet as FAQ on the wiki. F> THE QUESTIONS: F> - Is the recent degrade in performance just a matter of the spammers F> changing their tactics and SA having to learn the new spam? As I said F> I've only been doing this about a month so I'm not sure if this is part of F> a normal cyclical thing. Yes, spam changes, and SpamAssassin systems need to adapt. Bayes does well at this when correctly trained (see below). Adding custom rules also helps. I haven't seen any valentine's spam here -- I suspect the custom rules are blocking them, and Bayes catches on quickly. Check out http://wiki.apache.org/spamassassin/CustomRulesets F> - Is the forwarding of email to that address potentially causing a problem F> w/ the learning process? I mean for the email I set aside I know it is F> unmodified, but when users forward a spam to the email alias all the F> forwarding information is attached, is that potentially causing a problem? F> I did find something about forwarding mail and vanity domains in the FAQ F> but I'm not sure that is directly applicable to what I'm doing. You've hit the nail on the head. If I understand what you're doing, you're teaching SpamAssassin that emails forwarded from your users to your "this is spam" mailbox is spam. Unfortunatley, the spam going to your users is not from your users, and it's not to the "this is spam" mailbox. The emails you're teaching SA about is not the spam your users are receiving. If your users are forwarding their spam as attachments, you need to extract those attachments and learn the original spam, without modification. If your users are forwarding their spam inline, then you need to do something like found in http://wiki.apache.org/spamassassin/SiteWideBayesFeedback Bob Menschel
