Skip to content. | Skip to navigation

Sections
Personal tools
What is this?
Hi, my name is Tom Lazar and I'm a Plone and Zope developer based in Berlin, Germany and this is my personal and professional (no big difference, really...) website.
 

Spamfiltering using Spamassassin and sieve

Filed Under:

One of the great advantages of IMAP is, that the server can do all of the sorting and filtering instead of the client. One of the greatest disadvantages of IMAP is, that the server can do all of the sorting and filtering instead of the client. (Yes, that was a copy & paste job).

In practice this means, that while it's great to use sieve to let the server sort all incoming mail into (IMAP-)folders (i.e. for mailing-lists) it also means, that it's (currently!) still pretty tedious to maintain these settings. And nowadays one can plain forget about trying to tame spam using regex.

For me, this meant, that my mail client's spam filter only eliminated spam in my inbox, but none of them in my many subfolders (because sieve had already delivered them there, the sneaky bastard!). This, essentially, rendered some lists (i.e. ds@ccc.de) unusable. However, deactivating the sieve filter wasn't an option, either. My inbox would simply be swamped with list mails if I would have to read them via webmail for a while.

The solution to this dilemma, was rather easy in the end and one of those things that I had been procrastinating for months and then just took a mere minutes. The idea is to let Spamassassin tag each message with a Spam-Score header and then let sieve filter out messages according to that score. The problem was, though, that for some unfathomable reason sieves numerical comparator cannot deal with negative values, so lots of list traffic with highly negative spam scores would falsely be locked away without trial. Outrage!

Well, all you really got to do is check for the occurrence of the '-' character in advance and then use the 'discard' action, if appropriate. So here's the beginning of my personal sieve script that's now keeping my inbox nice and clean. Whereas previously I would have to deal with ca. 200+ spam mails per day in my junk box and mailinglists (plus ca. 10 to 20 that actually ended up in my inbox) I now get about 10 to 15 in the junkbox and just a couple in the inbox and lists. Hooray! I feel like I've rediscovered email again. It's become really useable now!

if not header :contains "X-Spam-Score" "-" {

	if header :value "ge" :comparator "i;ascii-numeric" \
			["X-Spam-Score"] ["10"]
	        {
	                discard;
	                stop;
	        }
	if header :value "ge" :comparator "i;ascii-numeric" \
			["X-Spam-Score"] ["6"]
	        {
	                fileinto "INBOX.Junk";
	                stop;
	        }
}

Re: Spamfiltering using Spamassassin and sieve

Posted by Matthias Leisi at Dec 16, 2004 10:33 AM

Instead of filtering numerically, you can also (ab) use the "*" produced in the "X-Spam-Level" header (I guess that's the default name).

I check in two levels: if the mail has eight or more stars, move it into a "spam-eight" folder; then, if it has four or more stars, move it into a "spam-four" folder.

Of course, you would usually delete the "high score" spam - I just keep it as a reference for research purposes.

-- Matthias

Re: Spamfiltering using Spamassassin and sieve

Posted by Tom Lazar at Dec 16, 2004 10:48 AM

yeah, I used to do that too. I had collected several 10.000 spams in order to feed them as such to spamassassin. but meanwhile i don't even want to keep that stuff. writing that discard action for the first statement was really satisfying and probably at some subtle level emotionally healing, too ;-)

A couple details

Posted by Scott Lamb at Jan 13, 2007 03:50 AM

Thanks for the sieve fragment. It's nice because you can use decimal values, unlike with "X-Spam-Score:". I had to do a couple things to make it work:

(1) I added this header to my SpamAssassin config (/etc/mail/spamassassin/local.cf):

add_header all Score SCORE

(2) I added this require line to the top of the Sieve script:

require ["relational", "comparator-i;ascii-numeric", "fileinto"];

I also collapsed the ifs using "allof" (personal preference):

if allof (not header :contains "X-Spam-Score" "-", header :value "ge" :comparator "i;ascii-numeric" "X-Spam-Score" "4.5") { fileinto "INBOX.undesirable"; }

Couple details

Posted by Scott Lamb at Jan 13, 2007 03:53 AM

Hmm, your comment form says "plain text formatting", but apparently that's wrong. I'll try putting in HTML pre tags and see what happens.

Thanks for the sieve fragment. It's nice because you can use decimal values, unlike with "X-Spam-Score:". I had to do a couple things to make it work:

  1. I added this header to my SpamAssassin config (/etc/mail/spamassassin/local.cf):

    add_header all Score SCORE

  1. I added this require line to the top of the Sieve script:

    require ["relational", "comparator-i;ascii-numeric", "fileinto"];

I also collapsed the ifs using "allof" (personal preference):

if allof (not header :contains "X-Spam-Score" "-",
          header :value "ge" :comparator "i;ascii-numeric"
                        "X-Spam-Score" "4.5") {
    fileinto "INBOX.undesirable";
}