RE: How to avoid spamassassin checks in Subject header?

[Leon Kolchinsky]

Title: RE: How to avoid spamassassin checks in Subject header?

Thanks Chris,   I should read more about score rules J   Another thing:   There is a legitimate e-mail with empty body message but with .doc attachment (filename is in hebrew) that marked as a spam -   X-Spam-Status: Yes, hits=5.4 tag1=-999.0 tag2=5.0 kill=5.0 tests=BAYES_44,  FROM_ENDS_IN_NUMS, HTML_MESSAGE, RAZOR2_CF_RANGE_51_100, RAZOR2_CHECK,  ROUND_THE_WORLD X-Spam-Level: *****   What would you suggest to eliminate or minimize ‘false positives’ in these cases?     P.S.: I’ve seen that some howto’s suggest putting scores in local.cf file and some into user_prefs. What is the right way to do it?       Best Regards, Leon Kolchinsky       From: Chris Santerre [mailto:[EMAIL PROTECTED] Sent: Thursday, October 26, 2006 3:29 PM To: לאון קולצ'ינסקי; users@spamassassin.apache.org Subject: RE: How to avoid spamassassin checks in Subject header?     > -----Original Message----- > From: Leon Kolchinsky [mailto:[EMAIL PROTECTED]] > Sent: Thursday, October 26, 2006 9:09 AM > To: users@spamassassin.apache.org > Subject: How to avoid spamassassin checks in Subject header? > > > > Hello All, > > I've a mail system running > Cyrus+Postfix+Amavisd-new+ClamAV+Spamassassin on SuSE Linux > Ent. Server 9. > > The problem is that non-encoded 8bit data is not allowed in > message headers and Cyrus-IMAPd prevents from any problem by > replacing those chars with X (mail program should do encoding > according to RFC 2047 on all headers. Unencoded 8-bit > characters aren't allowed in headers). > > In SuSE's distribution there is no munge8bit option for Cyrus > (which would leave the problematic subject as is but damage > the search function) so all Subjects in Hebrew/Russian/Etc. > sent form Hotmail,Yahoo,... clients arriving to users > mailboxes changed to XXX. > > I have BAYES and RAZOR filters installed. > > Here are some headers from one of such mails: > Subject: FW: XXX XXXXX XXXXXXX XXXXX > X-Spam-Status: Yes, hits=6.8 tag1=-999.0 tag2=5.0 kill=5.0 >  tests=FROM_ENDS_IN_NUMS, HTML_MESSAGE, MIME_BOUND_NEXTPART, >  MIME_HTML_NO_CHARSET, MSGID_FROM_MTA_HEADER, SUBJ_ILLEGAL_CHARS > X-Spam-Level: ****** > > So it seems to me that this high score is due to XXX (or > unencoded subjects) in the Subject header. > > Is there any way to tell Spamassassin to not check in > 'Subject' header? Since this is also scaned by body rules... No. However you could just rescore the rule score SUBJ_ILLEGAL_CHARS 0.10 HTH, Chris Santerre SysAdmin and Spamfighter www.rulesemporium.com www.uribl.com