[MlMt] Adding rule based on spam headers

[Bill Cole]

On 11 Nov 2020, at 9:45, Charlie Clark wrote:

> Hiya,
>
> much as I like MailMate, I find its support for spam detection 
> sub-par. I understand that there is a preference for SpamSieve but 
> many mail servers already have spam filters like Spam Assassin, so why 
> not make more us of them? Even Apple Mail does a good job with them. 
> As a result, I'm currently running Apple Mail on accounts where I'm 
> seeing a lot of spam and let it the filtering. I checked the rules 
> that are used and they don't look bad:
>
> * sender in contacts

I don't believe that is possible.

> * sender in exisiting recipients

<From><is in><Sent Messages><Recipient>"

> * to contains full name

I haven't tried it, but I would expect this to work:

<To><contains><Charlie Clark >

> * trust spam headers

<X-Spam-Status><contains><Yes,>

> Has anyone figured out conditions for rules like this?

See above.


> I've got headers like this:
>
> X-Spam-Status: No, score=4.8 required=5.0 
> tests=HTML_FONT_LOW_CONTRAST,
> 	HTML_MESSAGE,NORDNS_LOW_CONTRAST,RDNS_NONE,SUBJ_ALL_CAPS,
> 	URIBL_ABUSE_SURBL,URIBL_BLOCKED autolearn=no autolearn_force=no
> 	version=3.4.2

<Putting on "Apache SpamAssassin Project Committer" hat>

Job 0: get your mail provider to fix that URIBL_BLOCKED problem. It 
indicates that they are trying to use a free-for-most DNS-based URI 
blocking list (uribl.com) in a way that makes them seem like a large 
commercial email provider, for whom usage is NOT free. It may be as 
simple as a DNS config change on the machine running SA, if they are 
currently using a shared forwarder and don't actually have large volume.

MM SHOULD parse that X-Spam-Status and put it in the "Spam Score" 
pseudo-header for display and in X-Spam-Status->Score for conditions. 
Unfortunately, it does not recognize the value as a number for 
conditions, so you don't get 'greater than' and 'less than' operators.

> Where I'd like to be able to set the threshold a bit lower but I can't 
> think of an easy way of doing this at the moment with the score not 
> being available as a separate header.
>
> What are you all doing?

Filtering on the server side and seeing so little spam that it's not 
worth dealing with in MM. (Yes, I know that's not a broadly useful 
strategy.)

-- 
Bill Cole
bill at scconsult.com or billcole at apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not Currently Available For Hire