By far, our most common technical support question involves how to control SPAM.
The core of MDaemon’s spam filter is the well known SpamAssassin. SpamAssassin uses a rule set when filtering emails and each rule is set to add ‘X’ number of points to the message’s spam score. Changing the scoring of certain SpamAssassin rules is a very easy task but you may be asking, why would I want to?
- Non-spam has different attributes for different people. Medical organizations will need to score medical and drug-related rules lower than the general population, while mortgage brokers will need to lower the scores of mortgage and debt-related rules.
- user(s) are reporting that some spam is making it through. Is there a common SpamAssassin rule that is getting triggered that we can raise the score on to account for this?
Ok, so SPAM is making it through to the users inbox, first we need to find out what SpamAssassin rule was triggered on an email. There are two places we can look for this information.
- MDaemon’s logs. MDaemon-all.log, SMTP-(In).log, or AntiSpam.log file. MDaemon stores its logging in the \MDaemon\Logs\ folder. MDaemon installs on the root of C drive by default.
- In the headers of the email. MDaemon will insert an X-Spam-Report header which shows what rules got triggered and how many points each rule added.
How To View Email Headers
Outlook 2007: right click the message you want to view the headers for and select “Message Options”.
Outlook 2010/2013: double click the email you want to view the headers for so that it opens in a new window. Select the File tab at the top and then click the Properties button.
WorldClient: highlight the email you want to view the headers for, right click on the email, and select “View Source”.
Below is an example taken from MDaemon’s AntiSpam.log file.
Wed 2014-01-15 12:28:41: Spam Filter processing d:\mdaemon\queues\local\md50000598558.msg…
Wed 2014-01-15 12:28:41: * Message return-path: ahjueer.50802@domain
Wed 2014-01-15 12:28:41: * Message from: spammer@domain
Wed 2014-01-15 12:28:41: * Message to: user@localdomain
Wed 2014-01-15 12:28:41: * Message subject: Best deal$ found any where!
Wed 2014-01-15 12:28:41: * Message ID: <0.0.EE.559.1CF12173F6B3CF6.0@domain.com>
Wed 2014-01-15 12:28:42: Start SpamAssassin results
Wed 2014-01-15 12:28:42: 3.10 points, 5.0 required
Wed 2014-01-15 12:28:42: * 1.5 LOW_PRICE BODY: Lowest Price
Wed 2014-01-15 12:28:42: * 0.0 HTML_MESSAGE BODY: HTML included in message
Wed 2014-01-15 12:28:42: * 1.6 BAYES_50 BODY: Bayes spam probability is 40 to 60%
Wed 2014-01-15 12:28:42: * [score: 0.5000]
Wed 2014-01-15 12:28:42: * 0.0 LOTS_OF_MONEY Huge… sums of money
Wed 2014-01-15 12:28:42: * 0.0 T_MONEY_PERCENT X% of a lot of money for you
Wed 2014-01-15 12:28:42: End SpamAssassin results
What we can see from this logging is that the email received a final score of 3.10 points. Messages that receive 5.0 points or higher are flagged as spam. This spam message didn’t get enough points to be flagged as spam.
Using the above spam scoring we could tweak the scores we see here to give this message enough points to be caught as spam. Gradual changes are recommended to prevent false positives. As an example, by looking at the headers you notice that the spam being let through is always triggering the “LOTS_OF_MONEY” and “T_MONEY_PERCENT” rules, but these rules are not set to add any points. I’ll show you how to change the scoring so that each rule will add 1.0 points to the spam score when triggered. With the addition to 2.0 spam filter points the final spam score would reach 5.1 points and the message would be dealt with as spam.
When changing the scores on SpamAssassin rules we don’t want to modify the rule files themselves. SpamAssassin rules get frequent updates and these updates would override any changes we made. Instead we want to make our changes in the \MDaemon\SpamAssassin\rules\local.cf file. Open this file using Notepad. Remember I said it was easy to change the scoring of a rule? Here’s how simple it is. Find the SpamAssassin rule you want to change and then highlight and copy only the capitalized portion of the rule name up to, but not including, the first space. Now in the local.cf file on a line by itself enter score <rule_name> 1.0. Changing the two noted rules above to add 1.0 points each would look like below.
score LOTS_OF_MONEY 1.0
score T_MONEY_PERCENT 1.0
All that is left to be done is to save the change and restart the spam filter in MDaemon so that the change comes into effect immediately. To restart the spam filter click Security | Spam Filter | Restart Spam Filter button.
Hope this helps you to control the SPAM entering your inbox.
If you have any questions please send an email to support@ccsoftware.ca. We’re happy to help!
