Spam Filters Broke?


#1

I’m getting a steady stream of spam into my inbox now. These are the kind that would have been filtered into the Junk Mail box. Anyone experiencing this?


ultramookie


#2

Nope. Have you checked your full message headers for the X-Spam lines that are inserted by the spam filter?

-Scott


#3

I’m having the same problem.

Example:

Subject: top quality brand watches

X-Spam-Status: No, hits=1.4 tagged_above=-999.0 required=2.0
tests=MSGID_FROM_MTA_ID
X-Spam-Level: *

To me, it seems like that should have been tagged way higher (the body of the message is obvious spam) and thrown into the spam folder. But it came straight to my inbox.
My SpamAssassin is configured to levels Tag 2 and Quarantine 2 - pretty tight, I thought.
??
It’s doing the same kind of thing with every address on my domain.


#4

DH is running an older version of SpamAssassin, which isn’t as smart as the new version. A SpamAssassin update is in the suggestion box for voting and I’m not sure why it’s so hard for them to update it. It could be the Control Panel to SA connection that’ll take some tweaking.

-Scott


#5

At the risk of being slightly OT, does anybody know whether there is a simple way to get SA (or any other DH filter) to use regex§ to search the message header fields or body? I’d like to devise my own expressions, but don’t see a way to do this, short of installing my own local version of SA, as was advised in an earlier thread.


#6

my configuration is tag -1 and quarantine -1 which is even tighter and i still get a few spam coming through. before this month all was well and then all of the sudden spam started finding it’s way through


#7

I’ve noticed the same problem as well. A huge influx of spam in the last week or so.

bryan | website


#8

I haven’t seen any difference lately, but I don’t receive too much mail through my DH accounts.

Check out Gordaen’s Knowledge, the blog, and the MR2 page.


#9

You can use procmail rules to search headers and the body. From the DH panel, look at the Mail > Keyword Filter page to see if you can do what you want there.