Beta Junk Filter missed a few.

The beta email area shows that 80+ junk emails were caught today. I think I get about 100 junk emails a day, so this is a great improvement. But quite a few are still finding their way into my inbox.... my Apple Mail software put most of these straight into the junk folder. Here are the titles from a few of the emails that got through. Any email with Viagra in the subject line or email body needs to be filtered into junk.

Re[01]:For you.
Does this work for student loans, Yes.
Become a Lord or Lady today
Increase Your Earnings. Get an Online Degree Alex
Doctor Approved And Recommended
Get competing quotes from local lenders
Want to lose up to 19% weight. Try Adipren!
you are GOOD to her
Banned and Shocking alex 1.jpg 2.jpg
We sell regalis for an affordable price

The dreamhost guys have stated this won't catch everything... for what its worth.

For cases like this, I've pondered running another bayes spam filter.. (probably just spamassassin, since I already have it installed), to catch those things that the dreamhost filter doesn't catch.

'Only thing I'm not sure of, is if bayes will have enough of a filter set to be useful with dreamhost precatching 95+ percent of the spam.

btf

If too much spam is still getting through, try lowering your filter values (threshold). If your "quarantine" value is currently 10, then try 5. If you value is 4, then try 2. This will make the filter more aggressive and block more of the spam.

If you use low values (less than 4 or 5) then I recommend that you log into the beta webmail to check that nothing good gets filtered by mistake. If anything good is filtered, either whitelist the sender or raise the values a little.

My quarantine value was set to 2, but still too much spam was getting through. I've reduced it to 1 (no idea how that's going to work yet), but I was wondering what would happen if I reduced it to 0. Would that mean that every single email not whitelisted would be marked as "spam," or... what?

Also, some notation of what the numbers mean would be really helpful once this is out of beta. It's rather user-unfriendly the way it is set up now, unless I'm missing something.

Hopefully we can add some sort of option to mark uncaught spam that will send uncaught messages somwhere so that we can possibly tweak our filters a bit.

> what would happen if I reduced it to 0

The spam rating can also be a negative number, meaning it's certainly not spam. If you set your spam filter to zero, then you will get more mails filtered, but most or all of your real mail will still pass the filter like you're used to. I do this sometimes myself, but please note that if you set your filter values that low, then you MUST check your quarantine folder regularly in order to make sure that no messages are lost.

Advanced users (who are using IMAP or webmail) may want to do something like this...

Quarantine messages with a spam level of higher than 8 or 9; tag the rest.
Then create a procmail rule to send anything with a score of 5 (or 4, or whatever works for you) to a "probably spam" folder.

I've said it before, and I'll say it again... for /most/ people, setting the spam score to anything below 4 or 5 is pretty insane... you don't want one "spam indicator" to cause a mail to get junked. There are some tests which are scored at 2.5-3... one reason 5 is recommended as a good score is because it would take two tests with high scores to mark a message as spam.

Also, if / when we get the bayes stuff working properly, SA "learns" based on the outcome of tests, so if you have a lot of nonspam that gets marked as spam, the filter will become less accurate over time.

I have the threshold set at the default, and the filter has caught 99% of the spam. (I think only a couple of spams have slipped through.)

If you want to see what would happen if you set your threshold to 0, you can look at the full headers of your non-spam messages. (How you view the full headers depends on your mail client.) It looks like the spam filters put the message's score in the X-Spam-Status header, so any messages with scores >=0 would be caught.

The same header might help you figure out why the spams are getting through. Maybe some sort of whitelist got turned on by mistake.

What would I have to set it at to mark *everything* as spam except for the stuff that's whitelisted? I get maybe 150 messages a day to the address in question, and perhaps only 5 emails per *year* of those are legitimate. I can whitelist those, and if there are legitimate emails amongst the rest -- I don't care about losing them.

The filter can't mark everything as spam, as you wish.

The filter assigns ratings based on the mail content, and you can put a threshold value -- but only zero or positive. If you get mail with negative ratings (check the headers to see the actual values), and this is objectively spam, then notify DreamHost so they can adjust the filter accordingly.

Aha, I get it now. Thank you; will do!

My threshold is set at 0 (all my legit addresses are whitelisted) and I'm still getting spam (meaning it has a value less than zero?). Is there somewhere I should forward it to or something?

What does the spam score in the headers show?

I don't really understand the headers, honestly. I think here is the relevant part, though:

X-DH-Virus-Scanned: by amavisd-new-20030616-p7 (Debian) at enforcer
X-Spam-Status: No, hits=- tagged_above=-999.0 required=0.0 WHITELISTED
X-Spam-Level:

----33321102408964740434

Not sure if you mean the "X-Spam-Level" or the "hits" for the spam score.

Six spam messages have gotten through to me in the past few days, despite the level being set on 0.

Well the WHITELISTED bit seems to imply that you have the sender whitelisted.

::is an idiot:: Not sure how I missed that one. Amazing how many times I read those headers and never, ever saw "whitelisted."

I apologize for the inconvenience of answering me! I un-whitelisted my own address (/my isp's address) so it should work now. Duuh. Thanks.

ok, my turn to be an idiot

i cant seem to set any value other than 6-9. I desire to entirely block one sender who i collect 500+ spams from over a few days

I posted a topic called total blackout that no one replied to about this issue.

how does one set a value of anything less than 6? all of the custom windows below in the predefined policy only alow a 6 as the lowest threshold. this is very puzzling. please can someone clearly explain this?