Re: A question about spam?

In email, the Messag-Id: field is supposed to be a fingerprint for 
email.  Perhaps a couple procmail recipes might be useful in this case. 
The first recipe would treat any email missing a Message-Id: field as 
junk.  The second recipe would have to be maintained with a data base 
holding Message-Id: entries from email known to be spam.  Anything found 
in that data base would also properly be considered junk and treated 
accordingly.  I'm not that good with procmail yet so haven't tried this 
yet.  One important thing is to guard that data base by backing it up to 
local storeage and be prepared to also get its sha512sum and compare it 
with local edition.  If the two don't match, remote version got 
tampered.

On Sun, 18 Dec 2016, Tim Chase wrote:

> Date: Sun, 18 Dec 2016 23:33:24
> From: Tim Chase <[email protected]>
> Reply-To: Linux for blind general discussion <[email protected]>
> To: [email protected]
> Subject: Re: A question about spam?
> 
> On December 18, 2016, Karen Lewellen wrote:
>> We have Spam assassin here, and I do run sa-learn.
>> However, I do not run this on addresses that use real names, even
>> if I know the material is spam.
>> At what level do programs like spam assassin do the filtering?  Are
>> there other steps I can take to curb the flow?
>
> SpamAssassin (SA) takes the content into consideration, so even if
> you're receiving spam from known-good addresses, feed it to SA.  It
> will learn from the content, not just the sender.
>
> Depending on how your mail-server is configured, you can also set up
> catch-all accounts and then direct various sources to custom email
> addresses.  Because I own our domain, I can have all mail to this
> list come to blinux.list@<mydomain> which lets me set up filters to
> the effect "if anything comes to blinux.list@ and isn't also either
> to the mailing-list or in my personal address-book of people with
> whom I've previously sent messages, treat it as junk"
>
> You can do something similar with GMail which allows you to take your
> [email protected] and append a plus-sign and a tag for filtering
> such as "[email protected]".
>
> Not knowing the peculiars of your particular mail configuration, it's
> hard to offer better suggestions, but at least you now know enough to
> train SA with the junk mails even if they come from known-good
> addresses.
>
> -tim
>
>
> _______________________________________________
> Blinux-list mailing list
> [email protected]
> https://www.redhat.com/mailman/listinfo/blinux-list
>

--