SpamAssassin Filtering of Junk Mail

SpamAssassin is a tool for identifying junk email, what is commonly referred to as "spam". SpamAssassin does not block junk mail. It checks incoming messages for spamlike characteristics and computes a score. The higher the score, the greater the probability that the message is junk mail. This score is added to the message with the inclusion of an additional header.

On the Sociology system, messages with a score of 7 or higher will be marked as spam by prefixing the subject line of the message with the string *****SPAM*****. This serves as a visual cue to you that the message is most likely spam.

The score assigned is probablistic and the threshold choosen for spam designation is an arbitrary decision rule. So some junk mail which does not score high enough will avoid flagging and occasionally legitimate mail will be classified as spam. For these reasons, the final disposition is always left to the recipient.

SpamAssassin only works on mail delivered to a Sociology INBOX. So if you forward mail from your Sociology address elsewhere, it will not be subject to spam filtering by the Sociology mail server.

Modifying Your SpamAssassin Preferences

Several aspects of the way SpamAssassin handles your mail may be customized. These customizations are stored in a user preferences configuration file under your Sociology UNIX account. Modification of this file is as follows:

1. Open an SSH terminal session on angst.soc.duke.edu
2. Change to the .spamassassin directory: cd .spamassassin
3. Open for editing the user_prefs file
4. Add one or more of the specifications described below
5. Save your changes

When first opened, this file contains only comment lines (prefixed with "#") that explain typical modifications. Add your preferences to the end of this file, entering each one on a separate line without leading # symbols. The features you most likely will want to add are:

• A sensitivity specification, if you want to increase or decrease the threshold value for applying the spam flag. This is done with the required_hits parameter. For example, a specification of

  required_hits 9

  decreases the likelihood of messages being flagged, while

  required_hits 5

  increases the likelihood.

• A whitelist specification, if there are certain email addresses that are being flagged which you want to ensure are not. This is controlled with the whitelist_from parameter, which supports both specific address specifications and what are termed "file-glob-style" patterns. The examples below illustrate both types.

  whitelist_from friend@aol.com *@isp.com
  whitelist_from *@duke.edu *@*.duke.edu

  The first line ensures that mail from friend@aol.com and any mail originating from isp.com gets through unscathed. The leading asterisk (*) is a globbing or wildcard character meaning any userid from isp.com is allowed. The second example illustrates the use of globbing to allow all mail of Duke origin to get through without spam checking.

• A blacklist specification ensures certain mail is flagged as spam. The blacklist is the flipside of a whitelist. The blacklist_from parameter supports specific and glob-style email address specifications. For example,

  blacklist_from badguy@evilplace.com *@prizepatrol.com

  flags mail from badguy@evilplace.com and anything coming from prizepatrol.com. Blacklisting is useful for recurrent junk mail from specific sites that is carefully crafted to slip under the radar of spam filtering programs.

Filtering Spam to a Folder

For some it may be preferrable to have spam-flagged mail redirected to a special spam folder that can be reviewed periodically. Those wishing to do this should contact Bob Jackson who will set this up for you.