Using the RelayCountry plugin
The \[http://spamassassin.apache.org/full/3.0.x/dist/doc/Mail_SpamAssassin_Plugin_RelayCountry.html RelayCountry\] plugin exposes the countries that a mail was relayed from -- – turn it on by reading that documentation page, installing the required CPAN module {{IP::Country::Fast}}, and uncommenting the module (see below), and uncommenting the 'loadplugin' line in the {{ Wiki Markup /etc/mail/spamassassin/init.pre
}} file for {{Mail::SpamAssassin::Plugin::RelayCountry
}}.
Wiki Markup |
---|
The \[http://spamassassin.apache.org/full/3.0.x/dist/doc/Mail_SpamAssassin_Plugin_RelayCountry.html RelayCountry\] plugin will add metadata to the Bayesian filtering process, allowing the Bayesian filters to learn information based on countries. |
Required CPAN module dependencies, choose one:
GeoIP2::Reader::Database | Supported since SpamAssassin 3.4.2, install MaxMind::DB::Reader::XS for best performance |
IP::Country::DB_File | Supported since SpamAssassin 3.4.2 |
Geo::IP | Supported since SpamAssassin 3.4.0 |
IP::Country::Fast | Not recommended, outdated |
Country metadata will also be added to the Bayesian filtering process, allowing it to learn information based on countries.
You When using SA 3.1.0, you can also write rules that match specific countries , e.g.and add them to your /etc/mail/spamassassin/local.cf
file. For example:
No Format |
---|
header RELAYCOUNTRY_CNBAD X-Relay-Countries =~ /CN/ describe RELAYCOUNTRY_CNBAD Relayed through China at some point score RELAYCOUNTRY_CNBAD 3.0 header RELAYCOUNTRY_RUGOOD X-Relay-Countries =~ /RU^(FI|SE)/ describe RELAYCOUNTRY_RU Relayed through Russian FederationGOOD First untrusted relay is Finland or Sweden :-) score RELAYCOUNTRY_RUGOOD -0.2.0 |
Wiki Markup |
---|
You can get a list of IANA country codes from \[http://www.iana.org/cctld/cctld-whois.htm\]. You can get a list of countries that statistically relay most of the spam by looking at the source file for \[http://svn.apache.org/repos/asf/spamassassin/branches/3.1/lib/Mail/SpamAssassin/EvalTests.pm SpamAssassin::EvalTests.pm\] and reading the comments surrounding {{$CCTLDS_WITH_LOTS_OF_OPEN_RELAYS}}. |
Wiki Markup |
---|
Also for 3.1.0, you can apply a patch \[http://bugzilla.spamassassin.org/show_bug.cgi?id=3815\] which will allow you to add a separate MIME header that shows all the message's relay countries, independent of the rules. |
A list of 2-letter ISO 3166 country codes can be found from https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2. Note that the plugin itself adds few special types: private IPs are marked with '**' (two asterisks) and IPs not found in database are marked with 'XX'.
You can find a list of countries that statistically relay most spam for example from http://www.spamhaus.org/statistics/countries.lasso. Be careful not to score too much or too many, email is global by nature.
It's also possible to add a separate MIME header that shows all the message's relay countries, independent of the rules:
No Format |
---|
No Format |
add_header all Relay-Country _RELAYCOUNTRY_ |
and this This will show up in your MIME headers as:
No Format |
---|
X-Spam-Relay-Country: US CN RU |
Note about GeoIP2::Reader::Database and Geo::IP
Perhaps the easiest to install, since most distributions package these.
Note that Geo::IP updates are discontinued since April 2018, so you should use the new GeoIP2 (MMDB) databases. Free and commercial versions can be found from several vendors:
https://dev.maxmind.com/geoip/geoip2/geolite2/
UPDATE: Maintained legacy Geo::IP databases can be downloaded from several 3rd party sites:
Note about IP::Country::DB_File
This module does not come with a database or update mechanism, but it is quite easy and fast to create yourself (it does need a bit of hacking, mentioned urls are outdated).
Here you can download occasionally updated files:
The gunzipped file can be placed anywhere, just let SpamAssassin know where it is (country_db_path setting).
Note about IP::Country::Fast
As of writing, the latest included database is from 2013. There is no internal update mechanism.
The database consists of files named cc.gif and ip.gif. You can find the path with this command:
No Format |
---|
$ perl -MIP::Country::Fast -e '$_=$INC{"IP/Country/Fast.pm"};s/\.pm/\n/;print';
|
Updating the database files requires entering dbmScripts directory in IP::Country::Fast sources and running whois_filenames, ipcc_loader.pl and ipcc_maker.pl scripts in that order. Note that the build can use up to 2GB of system memory. The files must be put in directory mentioned above, it is not configurable.
Here you can download occasionally updated files: