Chavdar Videff wrote:
Dear List,
I know these are subject of the FAQ and the documentation, yet after I read
all of it I didn't get an answer to the following questions:
1. At our site we get approx. 1000 spam a week. Most of it is rated below 2.0
points and gets through (even if we set required hits to 3 and 2 for certain
mailboxes).
2. Mail composed as HTML is rated as spam for the above reason.
What can we do to improve the situation and boost the performance of SA.
I assume that if we set required hits below 5.0, ham messages composed as HTML
will be rated as spam. However, the overwhelming number of spam rated below
4, 3, 2 and even 1 points that we receive renders spamassassin useless for
our mail-server.
We sort ham and spam and run sa-learn daily in order to train SA, we feed the
low-rated spam and ham that is not rated correctly to sa-learn without any
success: most messages (that are repeated) continue to go through.
Please help.
Why doesn't sa-learn help. We thought that if we submit to sa-learn a messages
that was mistaken, the next time a message that is the same or from the same
address will be sorted correctly.
We had the same problem. We did a quick study of the spam and determined
that most of it is from hardcore spammers and the rest is from
"spammers" that users signed up for (or nearly signed up for). The
hardcore spam is knocked out 95% by greylisting. The signed-up spam is
all HTML and can be identified pretty easily with few false positives by
increasing the html test scores a bit, adding a few tests related to
disclaimers and unsubscribing and best deals, and adding some SA white
list entries. Now 99% of our spam is gone and it requires very little
work. This after I have disabled AWL and Bayes in SA. We use Spamcop (in
Exim) but I disable all of the DNS tests in SA. I think those SA DNS are
actually very good and may try them. Until now I have been concerned
with Network traffic.
Good luck,
Craig Jackson
