» IT tipps and howto's
Custom SpamAssassin Rules
Last Update: December 10 2010
SpamAssassin can be or is a very good way to fight spam. But there is one problem:
The rules are sometimes old, not updated anymore or they don't help you at all
(depending what kind of company you work for).
So when I first saw that SpamAssassin still lets through a lot of spam mails,
I went on the SARE Rules
Website. This site has some additional rules to download, but unfortunately
I read on the website that the "SARE Ninjas" are currently too busy
with their lives to update the website and the rules. I still use these rules,
I am not saying they're bad, but every serveradmin should consider writing your
own SpamAssassin rules -> and that's what I did.
I will update this cf file regularly, so you may want to redownload it or start
a wget from time to time. The filename will stay the same.You may either download
the file and store it with your other SpamAssassin cf files (usually in /usr/share/spamassassin)
or copy/paste the content of it into ~/.spamassassin/user_prefs.
-> Download 75_ckrules.cf <-
Please note, the spam scorings are pretty high. I used huge scorings for certain
words/expressions where I was sure that they're spam, at least the mails I observed
on my mailserver were like this. You may want to adjust that, depending on the
types of e-mails you receive.
Here are some notes for some of the rules (not necessarily updated, check
out the description rows in the 75_ckrules.cf file instead):
||Checks the body of the e-mail for the word "Viagra"
||Checks the body for typical winning notification words
||Checks the body for typical Casino and/or Lotto words
||Checks the subject for the word Viagra
||Checks the subject for the word Cialis
||Checks the subject for a whole bunch of words
||Checks the body for a whole bunch of words
||Checks the subject for words like erection
||Checks the subject for the word sex
||Checks the subject for the word cock
||Checks the subject for the word dick; this scoring is lower because Dick
could also be a name
||Checks the subject for typical medical words
||Checks the body for typical medical words
||Checks the subject for Ramadan Greetings - there were tons of spams like
this in August 2009
||Checks the body for a combination of strong followed by another word (e.g.
health = strong health)
||Checks the body for a combination of best followed by another word (e.g.
health = best health)
||Checks the body for a combination of online followed by another word (e.g.
casino = online casino)
||Checks the body for a combination of free followed by another word (e.g.
casino = free casino)
||Checks the body for typical phishing/begging words (my husband died and
I want you to transfer money...)
||Checks the body for "You need to be connected to the Internet to
view and follow link". There are currently lots of spams going around
with this content (September 2009).
||Checks the subject for "This is your Final Notice of Domain Listing".
A company which wants to charge you to list your domain - unnecessary list and half-illegal method.
||Checks the sender e-mail address - if it matches add scoring.