» IT tipps and howto's

Custom SpamAssassin Rules

Last Update: December 10 2010

SpamAssassin can be or is a very good way to fight spam. But there is one problem: The rules are sometimes old, not updated anymore or they don't help you at all (depending what kind of company you work for).

So when I first saw that SpamAssassin still lets through a lot of spam mails, I went on the SARE Rules Website. This site has some additional rules to download, but unfortunately I read on the website that the "SARE Ninjas" are currently too busy with their lives to update the website and the rules. I still use these rules, I am not saying they're bad, but every serveradmin should consider writing your own SpamAssassin rules -> and that's what I did.

I will update this cf file regularly, so you may want to redownload it or start a wget from time to time. The filename will stay the same.You may either download the file and store it with your other SpamAssassin cf files (usually in /usr/share/spamassassin) or copy/paste the content of it into ~/.spamassassin/user_prefs.

-> Download 75_ckrules.cf <-

Please note, the spam scorings are pretty high. I used huge scorings for certain words/expressions where I was sure that they're spam, at least the mails I observed on my mailserver were like this. You may want to adjust that, depending on the types of e-mails you receive.

Here are some notes for some of the rules (not necessarily updated, check out the description rows in the 75_ckrules.cf file instead):

Rule Name	Description
CK_VIAGRA_MENTIONED	Checks the body of the e-mail for the word "Viagra"
CK_LOTTERY_WINNING	Checks the body for typical winning notification words
CK_CASINO_LOTTO	Checks the body for typical Casino and/or Lotto words
CK_VIAGRA_SUBJECT	Checks the subject for the word Viagra
CK_CIALIS_SUBJECT	Checks the subject for the word Cialis
CK_DIVERS_SUBJECT	Checks the subject for a whole bunch of words
CK_DIVERS_BODY	Checks the body for a whole bunch of words
CK_ERECT_SUBJECT	Checks the subject for words like erection
CK_SEX_SUBJECT	Checks the subject for the word sex
CK_SUBJECT_COCK	Checks the subject for the word cock
CK_SUBJECT_DICK	Checks the subject for the word dick; this scoring is lower because Dick could also be a name
CK_MEDICAL_SUBJECT	Checks the subject for typical medical words
CK_MEDICAL_BODY	Checks the body for typical medical words
CK_RAMADAN_SPAMS	Checks the subject for Ramadan Greetings - there were tons of spams like this in August 2009
CK_STRONG_MENTIONED	Checks the body for a combination of strong followed by another word (e.g. health = strong health)
CK_BEST_MENTIONED	Checks the body for a combination of best followed by another word (e.g. health = best health)
CK_ONLINE_MENTIONED	Checks the body for a combination of online followed by another word (e.g. casino = online casino)
CK_FREE_MENTIONED	Checks the body for a combination of free followed by another word (e.g. casino = free casino)
CK_PHISHING_BEGGING	Checks the body for typical phishing/begging words (my husband died and I want you to transfer money...)
CK_INTERNET_CONNECT	Checks the body for "You need to be connected to the Internet to view and follow link". There are currently lots of spams going around with this content (September 2009).
CK_DOMAIN_LISTING	Checks the subject for "This is your Final Notice of Domain Listing". A company which wants to charge you to list your domain - unnecessary list and half-illegal method.
CK_SPAM_ADDRESS	Checks the sender e-mail address - if it matches add scoring.