SpamAssasin score for special "spam" email

[McDuff]

SpamAssassin is enabled on all but one of our emails with the standard score of 5.1. If triggered, SA redirects the spam email to our spam@... email specially for spam. Of course this email gets flooded with spam, which gets checked occasionally.

To reduce checking time, I am thinking about enabling SA also on the spam@ email, but with a much higher score, so the change on false-positives gets further reduced but I do not have to go through all that blatantly spam stuff.

- any experience out there on what is a good level for this, like a trigger score of 10 or 15?

- I assume that FQ has its own line of defense filtering out the really bad stuff. Any max level for SA that makes sense? Meaning that if FQ is already using a limit score of 10, it makes no sense to have a score 15 active.

Probably, there is a tread about this, but quick search did not gave me the relevant information.

Thanks, and a Merry Christmas to all of you:QTsanta:
ps. It was the only Santa smilies I could find, but he does not look too happy to me. :yeah:
McDuff

[Bob]

To reduce checking time, I am thinking about enabling SA also on the spam@ email, but with a much higher score, so the change on false-positives gets further reduced but I do not have to go through all that blatantly spam stuff.

McDuff

Once SpamAssassin scans an incoming message it will bypass any further scanning so you cannot employ a second scan to further reduce, at this time.

However keep an eye out for those additional goodies hinted at in this post...

:
Hmmm, there is also a Christmas card in the stocking that says there are some exciting presents still in the elf factory being perfected for release in the first quarter of 2008. I guess we will all have to wait and see what they could be. Knowing Santa, they’ll be worth the wait! :rasberry:

:gift: Happy Holidays Everyone! :gift:

-Bob

[Bob]

McDuff,

Also just for clarification when scoring with SA if you set the score higher, ie... 7 or 10, then you will get lots more spam. To increase the effectiveness of SA then you would lower the score to 4.5 or 3.9 for instance.

For the record we use standard SpamAssassin set at 4.5 and manually review all tagged messages each day for false positives which average about 3 to 6 a month generally.

-Bob

[Tom E.]

o reduce checking time, I am thinking about enabling SA also on the spam@ email, but with a much higher score, so the change on false-positives gets further reduced but I do not have to go through all that blatantly spam stuff.You can accomplish this by setting SA to include the score in the message subject, then use the CNC email manager to set up a custom filter on the spam account that deletes messages with a score greater than whatever.

[johnfl68]

You may want to take a look at this thread as well (in the meantime):

http://www.aota.net/forums/showthread.php?t=22895

John

[CamFraser]

any experience out there on what is a good level for this, like a trigger score of 10 or 15?


Based on the 2007 data from the IpNation Team (http://IpNation.org), I'd recommend a cut off of 13.

The highest SA score any of us had was 10.8, so 13 gives you a nice comfort zone.

FQ uses SA's RDJ, which do increase the FP potential, while also significantly increasing the spam killrate (please whisper with me: die spam, DIE!). :P

If you know for certain that you will never receive email from an Outlook user, you may be safe going lower. Unfortunately, I can only make that assumption on one of my domains. :sigh:

[Juan G]

Hmmm, there is also a Christmas card in the stocking that says there are some exciting presents still in the elf factory being perfected for release in the first quarter of 2008.

While waiting for this (a built-in filter or new setting related to SpamAssassin?), we can use custom filters for multiple SpamAssassin thresholds (http://www.aota.net/forums/showthread.php?postid=161888#post161888) (delete/redirect), which are working well.