How do I use SpamAssassin with procmail to forward mail and to mistake-based Bayes training?

This procmail script is designed for people who have their mail forwarded through a server (e.g, example.com) but then read their mail on a non-publicized account on a different server (e.g., privateaddress@example.net). This is quite common for folks who have a vanity domain name but then read their mail through an office Exchange server, home DSL email account, etc.

...

The trick for Bayes training is to add some extra procmail rules to specify special processing for training messages. The following is based on having a catchall address for all mail sent to example.com, so I can trigger the bayes training by sending mail to spam@example.com and ham@example.com. It is left as an exercise for the reader to create an alternative script that triggers based on a passphrase added to the subject, and uses formail to remove that passphrase before passing the message to sa-learn.

Note that this setup still only works passably with Outlook and Exchange, because even resending the message causes a new Message-ID header to be created and the old Received headers to be lost. Other headers are still carried over. To trigger Bayes learning from Outlook on false negatives, choose Action: Resend this Message (you have to remove any From and CC headings and change the To field to spam@example.com). Note that nearly every other mailer (except for AOL) supports real redirects; see \[http://www.stearns.org/doc/spamassassin-setup.current.html#redirect\].

false negatives (i.e., spam that SpamAssassin didn't catch).

This script uses mistake-based training for false negatives. That is, it assumes that SpamAssassin can correctly autolearn on enough ham and spam to seed the Bayes database. Then, when Bayes incorrectly sees a spam message as not spam (or not spammy enough), the user can train the database by redirecting the message to be learned as spam. Although the same redirection scheme could be used to train on false positives (i.e., legimate mail incorrectly seen as spam), it's likely more effective to just ManualWhitelist mail from that sender.

The following is based on having at least two addresses (publicaddress@example.com and spam@example.com) trigger the same procmail script. In most vanity domain setups, all addresses are processed by the same procmail. The script needs to be edited to include your real addresses and domain. You also need to confirm the path for spamassassin and sa-learn, which you can find, after logging into the server, Note that after logging into the server, you can find the path for spamassassin by typing which spamassassin.

#Uncomment the following lines and use tail -f procmail.log to debug
#LOGFILE=$HOME/procmail.log
#VERBOSE=yes
#LOGABSTRACT=all

# Feed redirected spam to sa-learn

:0
* ^To:.*spam@example.com
* < 256000

   {
   :0c: spamassassin.spamlock
   | sa-learn --spam

   :0
   mail/spam
   }

# Send all other mail through SpamAssassin

:0fw: spamassassin.lock
* < 256000
| /usr/bin/spamassassin


# Mail that is very likely spam (>10) can be saved on the server
# (not forwarded), ofor by moving the # down one line, even dropped
# on the floor.  Note that dropping mail on the floor is a *bad*
# idea unless you really, really believe no false positives will
# have a score great than 10.  If you want all mail forwarded,
# just add #'s in front of each of these lines:

:0
* ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*
#/dev/null
mail/tenplusspam


:0 # All spam with a score less than 10
! privateaddress@example.net # Forward mail to my non-publicized address

On your client, you'd then likely want to filter mail with "X-Spam-Level: *****" into a Likely Spam folder. The advantage of leaving mail with a score of 10 or higher on the server is that it makes it easier to find false positives, since they generally score between 5 and 10.

For the mistake-based training, it's critical to redirect (or bounce) the message, rather than forwarding. Forwarding loses all of the critical header information, which is much of what Bayes trains off of. Here are directions for redirecting from different clients. Note that for all redirections, you'll want to clear away all To: and Cc: entries and then add spam@example.com to the To:, in order to avoid resending the spam to another victim.

...

Thanks to William Stearns <wstearns@pobox.com> for this redirection \[http://www.stearns.org/doc/spamassassin-setup.current.html<ac:structured-macro ac:name="redirect" ac:schema-version="1" ac:macro-id="ec4eb261b3fd96f3-81f00715-470549db-b9a487d9-af679108b53f39a8a758617a"><ac:parameter ac:name=""><ac:link><ri:page ri:content-title="info]." /></ac:link></ac:parameter><ac:parameter ac:name="location"><ac:link><ri:page ri:content-title="info]." /></ac:link></ac:parameter></ac:structured-macro>

= Contributors
\[http://www.dankohn.com Dan Kohn\] dan@dankohn.com