Re: Dspam marks 'Innocent' spam that comes in forwarded email

Tom Hendrikx <[email protected]> Mon, 19 May 2014 09:54:44 +0200
Newsgroups	gmane.mail.spam.dspam.user
Message-ID	<[email protected]>
On 05/19/2014 04:00 AM, Boyandin Konstantin wrote:
> Hello Tom,
> 
> 15.05.2014, 15:07, "Tom Hendrikx" <[email protected]>:
>> On 05/15/2014 03:47 AM, Boyandin Konstantin wrote:
>> 
>>> Hello,
>>> 
>>> I receive quite a lot of email from another mailbox. Recently
>>> the phishing spam (typically with an attachment containing
>>> dangerous content in .zip form) is being marked as "Innocent" by
>>> Dspam and thus requires much manual work to remove.
>>> 
>>> is it possible to force Dspam to treat forwarded message (i.e.,
>>> with 'To:'/'Cc:' addresses not containing email address of my
>>> email box) regularly and analyze its content as required?
>>> 
>>> The original recipient mailbox (from which the messages are 
>>> forwarded) is whitelisted (messages from it are not considered 
>>> spam).
>>> 
>>> I would appreciate pieces of advice.
>> 
>> It depends on how your mail system is setup, but preferable you'd
>> have the MTA passing the envelope sender (after alias expansion
>> etc) to dspam. In that way, DSPAM doesn't care about the message
>> headers.
> 
> I use the Exim setup when Dspam is used as filter.
> 
> transport_filter = "/usr/bin/dspam --stdout --mode=teft
> --feature=noise,whitelist --client --deliver=innocent,spam --user
> ${lc:$local_part}"
> 
> The whole message is passed, including Envelope-to: header. How
> should I make Dspam to care about message headers?
> 

If you pipe to dspam like you dom dspam should be able to use the --user
<foo>. That should be enough for dspam, so no header parsing should be
used. Did you enable 'ParseToHeaders'? It should not be needed.

Tom

------------------------------------------------------------------------------
"Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE
Instantly run your Selenium tests across 300+ browser/OS combos.
Get unparalleled scalability from the best Selenium testing platform available
Simple to use. Nothing to install. Get started now for free."
http://p.sf.net/sfu/SauceLabs

_______________________________________________
Dspam-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/dspam-user
signature.asc (application/pgp-signature, 884 B)