DSPAM Not Working Very Effectively
Jerry Gardner <[email protected]> Fri, 2 Sep 2016 12:44:14 -0700
| Newsgroups | gmane.mail.spam.dspam.user |
|---|---|
| Message-ID | <CABi7XyrQ72=HQgB4=GUgQexJABg2EYt5D3CajOPtZwk_3vCNSg@mail.gmail.com> |
--===============9127622846156426149==
Content-Type: multipart/alternative; boundary=001a11401bfe254500053b8b8e53
--001a11401bfe254500053b8b8e53
Content-Type: text/plain; charset=UTF-8
I set up a new mail server about four months ago with DSPAM as the spam
filter. While it is filtering out some spam, it completely misses most of
it. I trained it for the first 2500 emails, but it doesn't seem to be
getting any better at filtering after that. I regularly retrain any false
negatives and false positives it finds. For example, I get a few dozen
spams a day advertising vacations in Belize. They're all almost identical,
and I've been getting them consistently for months, yet DSPAM is still not
filtering them out and is marking them as
*X-DSPAM-Confidence:* 0.9803
*X-DSPAM-Probability:* 0.0000
Here's the output of dspam_stats: TP: 19302 TN: 17498 FP: 45 FN: 1337
SC: 0 NC: 0
Here's the output of dspam_stats -H :
FP False Positives: 45
FN False Negatives: 1337
SC Spam Corpusfed: 0
NC Nonspam Corpusfed: 0
TL Training Left: 0
SHR Spam Hit Rate 93.52%
HSR Ham Strike Rate: 0.26%
PPV Positive predictive value: 99.77%
OCA Overall Accuracy: 96.38%
One thing I don't understand is TN--according to dspam_stats its 17498, yet
I have only received a total of around 1900 non-spams since I set up this
server.
What can I do to help DSPAM learn faster so I can cut down all of the spam
I have to manually deal with each day?
Here's my dspam.conf:
## $Id: dspam.conf.in,v 1.103 2011/11/10 00:27:34 tomhendr Exp $
## dspam.conf -- DSPAM configuration file
##
#
# DSPAM Home: Specifies the base directory to be used for DSPAM storage
#
Home /var/spool/dspam
#
# StorageDriver: Specifies the storage driver backend (library) to use.
# You'll only need to set this if you are using dynamic storage driver
plugins
# from a binary distribution. The default build statically links the storage
# driver (when only one is specified at configure time), overriding this
# setting, which only comes into play if multiple storage drivers are
specified
# at configure time. When using dynamic linking, be sure to include the path
# to the library if necessary, and some systems may use an extension other
# than .so (e.g. OSX uses .dylib).
#
# Options include:
#
# libmysql_drv.so libpgsql_drv.so
# libsqlite3_drv.so libhash_drv.so
#
# IMPORTANT: Switching storage drivers requires more than merely changing
# this option. If you do not wish to lose all of your data, you will need to
# migrate it to the new backend before making this change.
#
StorageDriver /usr/lib/x86_64-linux-gnu/dspam/libhash_drv.so
#StorageDriver /usr/lib/dspam/libmysql_drv.so
#
# Trusted Delivery Agent: Specifies the local delivery agent DSPAM should
call
# when delivering mail as a trusted user. Use %u to specify the user DSPAM
is
# processing mail for. It is generally a good idea to allow the MTA to
specify
# the pass-through arguments at run-time, but they may also be specified
here.
#
# Most operating system defaults:
#TrustedDeliveryAgent "/usr/bin/procmail" # Linux
#TrustedDeliveryAgent "/usr/bin/mail" # Solaris
#TrustedDeliveryAgent "/usr/libexec/mail.local" # FreeBSD
#TrustedDeliveryAgent "/usr/bin/procmail" # Cygwin
#
# Other popular configurations:
#TrustedDeliveryAgent "/usr/cyrus/bin/deliver" # Cyrus
#TrustedDeliveryAgent "/bin/maildrop" # Maildrop
#TrustedDeliveryAgent "/usr/local/sbin/exim -oMr spam-scanned -oi" # Exim
#
TrustedDeliveryAgent "/usr/bin/procmail"
#
# Untrusted Delivery Agent: Specifies the local delivery agent and arguments
# DSPAM should use when delivering mail and running in untrusted user mode.
# Because DSPAM will not allow pass-through arguments to be specified to
# untrusted users, all arguments should be specified here. Use %u to specify
# the user DSPAM is processing mail for. This configuration parameter is
only
# necessary if you plan on allowing untrusted processing.
#
#UntrustedDeliveryAgent "/usr/bin/procmail -d %u"
#
# SMTP or LMTP Delivery: Alternatively, you may wish to use SMTP or LMTP
# delivery to deliver your message to the mail server instead of using a
# delivery agent. You will need to configure with --enable-daemon to use
host
# delivery, however you do not need to operate in daemon mode. Specify an IP
# address or UNIX path to a domain socket below as a host.
#
# If you would like to set up DeliveryHost's on a per-domain basis, use
# the syntax: DeliveryHost.example.org 1.2.3.4
#
DeliveryHost 127.0.0.1
#DeliveryPort 2424
DeliveryPort 10026
DeliveryIdent localhost
#DeliveryProto LMTP
DeliveryProto SMTP
#
# FallbackDomains: If you want to specify certain domains as fallback
domains,
# enable this option. For example, you could create a user @example.org, and
# if [email protected] does not resolve to a known user on the system, the
user
# could default to your @example.org user. NOTE: This also requires
designating
# fallbackDomain for the domain name;
# e.g. dspam_admin ch pref example.org fallbackDomain on
#
FallbackDomains on
FallbackDomain xm23.net
#
# Quarantine Agent: DSPAM's default behavior is to quarantine all mail it
# thinks is spam. If you wish to override this behavior, you may specify
# a quarantine agent which will be called with all messages DSPAM thinks is
# spam. Use %u to specify the user DSPAM is processing mail for.
#
#QuarantineAgent "/usr/bin/procmail -d spam"
#
# DSPAM can optionally process "plused users" (addresses in the user+detail
# form) by truncating the username just before the "+", so all internal
# processing occurs for "user", but delivery will be performed for
# "user+detail". This is only useful if the LDA can handle "plused users"
# (for example Cyrus IMAP) and when configured for LMTP delivery above
#
#EnablePlusedDetail on
#
# Character to use as seperator between user names and address extensions.
# If you change this value then please adjust QuarantineMailbox to use the
# new specified character. The default is '+'.
#
#PlusedCharacter +
#
# Turn this feature on if you want to force DSPAM to lowercase the "plused
# users" username.
#
#PlusedUserLowercase on
#
# Quarantine Mailbox: DSPAM's LMTP code can send spam mail using LMTP to a
# "plused" mailbox (such as user+quarantine) leaving quarantine processing
# for retraining or deletion to be performed by the LDA and the mail client.
# "plused" mailboxes are supported by Cyrus IMAP and possibly other LDAs. If
# you don't set/change PlusedCharacter then the mailbox name must have the +
# since the + is the default used character.
#
#QuarantineMailbox +quarantine
#
# OnFail: What to do if local delivery or quarantine should fail. If set
# to "unlearn", DSPAM will unlearn the message prior to exiting with an
# un successful return code. The default option, "error" will not unlearn
# the message but return the appropriate error code. The unlearn option
# is use-ful on some systems where local delivery failures will cause the
# message to be requeued for delivery, and could result in the message
# being processed multiple times. During a very large failure, however,
# this could cause a significant load increase.
#
OnFail error
#
# Trusted Users: Only the users specified below will be allowed to perform
# administrative functions in DSPAM such as setting the active user and
# accessing tools. All other users attempting to run DSPAM will be
restricted;
# their uids will be forced to match the active username and they will not
be
# able to specify delivery agent privileges or use tools.
#
Trust root
Trust dspam
Trust www-data
Trust mail
Trust daemon
Trust amavis
#Trust nobody
#Trust majordomo
#
# Debugging: Enables debugging for some or all users. IMPORTANT: DSPAM must
# be compiled with debug support in order to use this option. DSPAM should
# never be running in production with debug active unless you are
# troubleshooting problems.
#
# DebugOpt: One or more of: process, classify, spam, fp, inoculation, corpus
# process standard message processing
# classify message classification using --classify
# spam error correction of missed spam
# fp error correction of false positives
# inoculation message inoculations (source=inoculation)
# corpus corpusfed messages (source=corpus)
#
Debug process
#Debug bob bill
#
#DebugOpt process spam fp
#
# ClassAlias: Alias a particular class to spam/nonspam. This is useful if
# classifying things other than spam.
#
#ClassAliasSpam badstuff
#ClassAliasNonspam goodstuff
#
# Training Mode: The default training mode to use for all operations, when
# one has not been specified on the commandline or in the user's
preferences.
# Acceptable values are:
# toe Train on Error (Only)
# teft Train Everything (Trains on every message)
# tum Train Until Mature (Train only tokens without enough data)
# notrain Do not train or store signatures (large ISP systems,
post-train)
#
TrainingMode teft
#
# TestConditionalTraining: By default, dspam will retrain certain errors
# until the condition is no longer met. This usually accelerates learning.
# Some people argue that this can increase the risk of errors, however.
#
TestConditionalTraining on
#
# Features: Specify features to activate by default; can also be specified
# on the commandline. See the documentation for a list of available
features.
# If _any_ features are specified on the commandline, these are ignored.
#
Feature noise
Feature whitelist
# Training Buffer: The training buffer waters down statistics during
training.
# It is designed to prevent false positives, but can also dramatically
reduce
# dspam's catch rate during initial training. This can be a number from 0
# (no buffering) to 10 (maximum buffering). If you are paranoid about false
# positives, you should probably enable this option.
#
#Feature tb=5
#
# Algorithms: Specify the statistical algorithms to use, overriding any
# defaults configured in the build. The options are:
# naive Naive-Bayesian (All Tokens)
# graham Graham-Bayesian ("A Plan for Spam")
# burton Burton-Bayesian (SpamProbe)
# robinson Robinson's Geometric Mean Test (Obsolete)
# chi-square Fisher-Robinson's Chi-Square Algorithm
#
# You may have multiple algorithms active simultaneously, but it is strongly
# recommended that you group Bayesian algorithms with other Bayesian
# algorithms, and any use of Chi-Square remain exclusive.
#
# NOTE: For standard "CRM114" Markovian weighting, use 'naive', or consider
# using 'burton' for slightly better accuracy
#
# Don't mess with this unless you know what you're doing
#
#Algorithm chi-square
#Algorithm naive
Algorithm graham burton
#
# Tokenizer: Specify the tokenizer to use. The tokenizer is the piece
# responsible for parsing the message into individual tokens. Depending on
# how many resources you are willing to trade off vs. accuracy, you may
# choose to use a less or more detailed tokenizer:
# word uniGram (single word) tokenizer
# Tokenizes message into single individual words/tokens
# example: "free" and "viagra"
# chain biGram (chained tokens) tokenizer (default)
# Single words + chains adjacent tokens together
# example: "free" and "viagra" and "free viagra"
# sbph Sparse Binary Polynomial Hashing tokenizer
# Creates sparse token patterns across sliding window of 5-tokens
# example: "the quick * fox jumped" and "the * * fox jumped"
# osb Orthogonal Sparse biGram tokenizer
# Similar to SBPH, but only uses the biGrams
# example: "the * * fox" and "the * * * jumped"
#
# In general the reccomendation is to use 'osb' for new installations.
# The default value of 'chain' remains here as not to surprise anyone
upgrading
# that has not changed from the default value.
#
Tokenizer chain
#
# PValue: Specify the technique used for calculating Probability Values,
# overriding any defaults configured in the build. These options are:
# bcr Bayesian Chain Rule (Graham's Technique - "A Plan for
Spam")
# robinson Robinson's Technique (used in Chi-Square)
# markov Markovian Weighted Technique (for Markovian discrimination)
#
# Unlike the "Algorithms" property, you may only have one of these defined.
# Use of the chi-square algorithm automatically changes this to robinson.
#
# Don't mess with this unless you know what you're doing.
#
#PValue robinson
#PValue markov
PValue bcr
#
# WebStats: Enable this if you are using the CGI, which writes .stats files
WebStats on
#
# ImprobabilityDrive: Calculate odds-ratios for ham/spam, and add to
# X-DSPAM-Improbability headers
#
#ImprobabilityDrive on
#
# Preferences: Specify any preferences to set by default, unless otherwise
# overridden by the user (see next section) or a default.prefs file.
# If user or default.prefs are found, the user's preferences will override
any
# defaults.
#
Preference "trainingMode=TEFT" # { TOE | TUM | TEFT | NOTRAIN } ->
default:teft
Preference "spamAction=tag" # { quarantine | tag | deliver } ->
default:quarantine
Preference "spamSubject=[SPAM]" # { string } -> default:[SPAM]
Preference "statisticalSedation=5" # { 0 - 10 } -> default:0
Preference "enableBNR=on" # { on | off } -> default:off
Preference "enableWhitelist=on" # { on | off } -> default:on
Preference "signatureLocation=message" # { message | headers } ->
default:message
Preference "tagSpam=off" # { on | off }
Preference "tagNonspam=off" # { on | off }
Preference "showFactors=off" # { on | off } -> default:off
Preference "optIn=off" # { on | off }
Preference "optOut=off" # { on | off }
Preference "whitelistThreshold=10" # { Integer } -> default:10
Preference "makeCorpus=off" # { on | off } -> default:off
Preference "storeFragments=off" # { on | off } -> default:off
Preference "localStore=" # { on | off } -> default:username
Preference "processorBias=on" # { on | off } -> default:on
Preference "fallbackDomain=off" # { on | off } -> default:off
Preference "trainPristine=off" # { on | off } -> default:off
Preference "optOutClamAV=off" # { on | off } -> default:off
Preference "ignoreRBLLookups=off" # { on | off } -> default:off
Preference "RBLInoculate=off" # { on | off } -> default:off
Preference "notifications=off" # { on | off } -> default:off
#
# Overrides: Specifies the user preferences which may override configuration
# and commandline defaults. Any other preferences supplied by an untrusted
user
# will be ignored.
#
AllowOverride enableBNR
AllowOverride enableWhitelist
AllowOverride fallbackDomain
AllowOverride ignoreGroups
AllowOverride ignoreRBLLookups
AllowOverride localStore
AllowOverride makeCorpus
AllowOverride optIn
AllowOverride optOut
AllowOverride optOutClamAV
AllowOverride processorBias
AllowOverride RBLInoculate
AllowOverride showFactors
AllowOverride signatureLocation
AllowOverride spamAction
AllowOverride spamSubject
AllowOverride statisticalSedation
AllowOverride storeFragments
AllowOverride tagNonspam
AllowOverride tagSpam
AllowOverride trainPristine
AllowOverride trainingMode
AllowOverride whitelistThreshold
AllowOverride dailyQuarantineSummary
AllowOverride notifications
# --- Profiles ---
#
# You can specify multiple storage profiles, and specify the server to
# use on the commandline with --profile. For example:
#
#Profile DECAlpha
#MySQLServer.DECAlpha 10.0.0.1
#MySQLPort.DECAlpha 3306
#MySQLUser.DECAlpha dspam
#MySQLPass.DECAlpha changeme
#MySQLDb.DECAlpha dspam
#MySQLCompress.DECAlpha true
#MySQLReconnect.DECAlpha true
#
#Profile Sun420R
#MySQLServer.Sun420R 10.0.0.2
#MySQLPort.Sun420R 3306
#MySQLUser.Sun420R dspam
#MySQLPass.Sun420R changeme
#MySQLDb.Sun420R dspam
#MySQLCompress.Sun420R false
#MySQLReconnect.Sun420R true
#
#DefaultProfile DECAlpha
#
# If you're using storage profiles, you can set failovers for each profile.
# Of course, if you'll be failing over to another database, that database
# must have the same information as the first. If you're using a global
# database with no training, this should be relatively simple. If you're
# configuring per-user data, however, you'll need to set up some type of
# replication between databases.
#
#Failover.DECAlpha SUN420R
#Failover.Sun420R DECAlpha
# If the storage fails, the agent will follow each profile's failover up to
# a maximum number of failover attempts. This should be set to a maximum of
# the number of profiles you have, otherwise the agent could loop and try
# the same profile multiple times (unless this is your desired behavior).
#
#FailoverAttempts 1
#
# Ignored headers: If DSPAM is behind other tools which may add a header to
# incoming emails, it may be beneficial to ignore these headers - especially
# if they are coming from another spam filter. If you are _not_ using one of
# these tools, however, leaving the appropriate headers commented out will
# allow DSPAM to use them as telltale signs of forged email.
#
#IgnoreHeader X-Spam-Status
#IgnoreHeader X-Spam-Scanned
#IgnoreHeader X-Virus-Scanner-Result
#
# Lookup: Perform lookups on streamlined blackhole list servers (see
# http://www.nuclearelephant.com/projects/sbl/). The streamlined blacklist
# server is machine-automated, unsupervised blacklisting system designed to
# provide real-time and highly accurate blacklisting based on network
spread.
# When performing a lookup, DSPAM will automatically learn the inbound
message
# as spam if the source IP is listed. Until an official public RABL server
is
# available, this feature is only useful if you are running your own
# streamlined blackhole list server for internal reporting among multiple
mail
# servers. Provide the name of the lookup zone below to use.
#
# This function performs standard reverse-octet.domain lookups, and while it
# will function with many RBLs, it's strongly discouraged to use those
# maintained by humans as they're often inaccurate and could hurt filter
# learning and accuracy.
#
#Lookup "sbl.example.org"
#
# RBLInoculate: If you want to inoculate the user from RBL'd messages it
would
# have otherwise missed, set this to on.
#
#RBLInoculate off
#
# Notifications: Enable the sending of notification emails to users (first
# message, quarantine full, etc.)
#
Notifications off
# TxtDirectory: the directory that holds the templates for notification
# messages (see Notifications) and tagging (see tagSpam/tagNonspam).
#
#TxtDirectory /etc/dspam/txt
#
# QuarantineWarnSize: You may specify a size when DSPAM should send a
"Quarantine
# Full" message to each user. This is only working if you enable
notifications
# (see above). Value is in bytes. Default is 2097152 -> 2MB.
#
#QuarantineWarnSize 2097152
#
# Purge configuration: Set dspam_clean purge default options, if not
otherwise
# specified on the commandline
#
PurgeSignatures 14 # Stale signatures
PurgeNeutral 90 # Tokens with neutralish probabilities
PurgeUnused 90 # Unused tokens
PurgeHapaxes 30 # Tokens with less than 5 hits (hapaxes)
PurgeHits1S 15 # Tokens with only 1 spam hit
PurgeHits1I 15 # Tokens with only 1 innocent hit
#
# Purge configuration for SQL-based installations using purge.sql
#
#PurgeSignature off # Specified in purge.sql
#PurgeNeutral 90
#PurgeUnused off # Specified in purge.sql
#PurgeHapaxes off # Specified in purge.sql
#PurgeHits1S off # Specified in purge.sql
#PurgeHits1I off # Specified in purge.sql
#
# Local Mail Exchangers: Used for source address tracking, tells DSPAM which
# mail exchangers are local and therefore should be ignored in the Received:
# header when tracking the source of an email. Note: you should use the
address
# of the host as appears between brackets [ ] in the Received header.
# By default DSPAM is considering the following IPs always as LocalMX:
# 10.0.0.0/8 - Private IP addresses (RFC 1918)
# 127.0.0.0/8 - Localhost Loopback Address (RFC 1700)
# 169.254.0.0/16 - Zeroconf / APIPA (RFC 3330)
# 172.16.0.0/12 - Private IP addresses (RFC 1918)
# 192.168.0.0/16 - Private IP addresses (RFC 1918)
#
LocalMX 127.0.0.1
#
# Logging: Disabling logging for users will make usage graphs unavailable to
# them. Disabling system logging will make admin graphs unavailable.
#
SystemLog on
UserLog on
#
# TrainPristine: for systems where the original message remains server side
# and can therefore be presented in pristine format for retraining. This
option
# will cause DSPAM to cease all writing of signatures and DSPAM headers to
the
# message, and deliver the message in as pristine format as possible. This
mode
# REQUIRES that the original message in its pristine format (as of delivery)
# be presented for retraining, as in the case of webmail, imap, or other
# applications where the message is actually kept server-side during
reading,
# and is preserved. DO NOT use this switch unless the original message can
be
# presented for retraining with the ORIGINAL HEADERS and NO MODIFICATIONS.
#
# NOTE: You can't use this setting with dspam_trian; if you're going to use
it,
# wait until after you train any corpora.
#
#TrainPristine on
#
# Opt: in or out; determines DSPAM's default filtering behavior. If this
value
# is set to in, users must opt-in to filtering by dropping a .dspam file in
# /var/dspam/opt-in/user.dspam (or if you have homedirs configured, a .dspam
# folder in their home directory). The default is opt-out, which means all
# users will be filtered unless a .nodspam file is dropped in
# /var/dspam/opt-out/user.nodspam
#
Opt out
#
# TrackSources: specify which (if any) source addresses to track and report
# them to syslog (mail.info). This is useful if you're running a firewall or
# blacklist and would like to use this information. Spam reporting also
drops
# RABL blacklist files (see http://www.nuclearelephant.com/projects/rabl/).
#
#TrackSources spam nonspam virus
#
# ParseToHeaders: In lieu of setting up individual aliases for each user,
# DSPAM can be configured to automatically parse the To: address for spam
and
# false positive forwards. From there, it can be configured to either set
the
# DSPAM user based on the username specified in the header and/or change the
# training class and source accordingly. The options below can be used to
# customize most common types of header parsing behavior to avoid the need
for
# multiple aliases, or if using LMTP, aliases entirely..
#
# ParseToHeader: Parse the To: headers of an incoming message. This must be
# set to 'on' to use either of the following features.
#
# ChangeModeOnParse: Automatically change the class (to spam or innocent)
# depending on whether spam- or notspam- was specified, and change the
source
# to 'error'. This is convenient if you're not using aliases at all, but
# are delivering via LMTP.
#
# ChangeUserOnParse: Automatically change the username to match that
specified
# in the To: header. For example, [email protected] will set the
username
# to bob, ignoring any --user passed in. This may not always be desirable
if
# you are using virtual email addresses as usernames. Options:
# on or user take the portion before the @ sign only
# full take everything after the initial {spam,notspam}-.
#
ParseToHeaders on
ChangeModeOnParse on
#ChangeUserOnParse on
ChangeUserOnParse full
#
# Broken MTA Options: Some MTAs don't support the proper functionality
# necessary. In these cases you can activate certain features in DSPAM to
# compensate. 'returnCodes' causes DSPAM to return an exit code of 99 if
# the message is spam, 0 if not, or a negative code if an error has occured.
# Specifying 'case' causes DSPAM to force the input usernames to lowercase.
# Specifying 'lineStripping' causes DSPAM to strip ^M's from messages passed
# in.
#
#Broken returnCodes
#Broken case
#Broken lineStripping
#
# MaxMessageSize: You may specify a maximum message size for DSPAM to
process.
# If the message is larger than the maximum size, it will be delivered
# without processing. Value is in bytes.
#
#MaxMessageSize 4194304
# --- ClamAV ---
#
# Virus Checking: If you are running clamd, DSPAM can perform stream-based
# virus checking using TCP. Uncomment the values below to enable virus
# checking.
#
# ClamAVResponse: reject (reject or drop the message with a permanent
failure)
# accept (accept the message and quietly drop the message)
# spam (treat as spam and quarantine/tag/whatever)
#
#ClamAVPort 3310
#ClamAVHost 127.0.0.1
#ClamAVResponse accept
# --- CLIENT / SERVER ---
#
# Daemonized Server: If you are running DSPAM as a daemonized server using
# --daemon, the following parameters will override the default. Use the
# ServerPass option to set up accounts for each client machine. The DSPAM
# server will process and deliver the message based on the parameters
# specified. If you want the client machine to perform delivery, use
# the --stdout option in conjunction with a local setup.
#
# ServerHost: Not enabling ServerHost will bind DSPAM server to all
available
# interfaces.
#
# ServerPort: Default upstream configuration is to run dspam daemon on port
# 24. On Debian, dspam being run as a unprivileged user, default port is
# set to 2424.
#
#ServerHost 127.0.0.1
#ServerPort 2424
#ServerQueueSize 32
ServerPID /var/run/dspam/dspam.pid
#
# ServerMode specifies the type of LMTP server to start. This can be one of:
# dspam: DSPAM-proprietary DLMTP server, for communicating with dspamc
# standard: Standard LMTP server, for communicating with Postfix or other
MTA
# auto: Speak both DLMTP and LMTP; auto-detect by ServerPass.IDENT
#
#ServerMode dspam
ServerMode auto
# If supporting DLMTP (dspam) mode, dspam clients will require
authentication
# as they will be passing in parameters. The idents below will be used to
# determine which clients will be speaking DLMTP, so if you will be using
# both LMTP and DLMTP from the same host, be sure to use something other
# than the server's hostname below (which will be sent by the MTA during a
# standard LMTP LHLO).
#
#ServerPass.Relay1 "secret"
#ServerPass.Relay2 "password"
# If supporting standard LMTP mode, server parameters will need to be
specified
# here, as they will not be passed in by the mail server. The ServerIdent
# specifies the 250 response code ident sent back to connecting clients and
# should be set to the hostname of your server, or an alias.
#
# NOTE: If you specify --user in ServerParameters, the RCPT TO will be
# used only for delivery, and not set as the active user for
processing.
#
#ServerParameters "--deliver=innocent -d %u"
ServerParameters "--deliver=innocent"
#ServerIdent "localhost.localdomain"
ServerIdent "localhost.xm23.net"
# If you wish to use a local domain socket instead of a TCP socket,
uncomment
# the following. It is strongly recommended you use local domain sockets if
# you are running the client and server on the same machine, as it
eliminates
# much of the bandwidth overhead.
#
#ServerDomainSocketPath "/var/run/dspam/dspam.sock"
ServerDomainSocketPath "/var/spool/postfix/tmp/dspam.sock"
#
# Client Mode: If you are running DSPAM in client/server mode, uncomment and
# set these variables. A ClientHost beginning with a / will be treated as
# a domain socket.
#
#ClientHost /var/run/dspam/dspam.sock
#ClientIdent "secret@Relay1"
#
#ClientHost 127.0.0.1
#ClientPort 2424
#ClientIdent "secret@Relay1"
# --- RABL ---
# RABLQueue: Touch files in the RABL queue
# If you are a reporting streamlined blackhole list participant, you can
# touch ip addresses within the directory the rabl_client process is
watching.
#
#RABLQueue /var/spool/rabl
# --- ---
# DataSource: If you are using any type of data source that does not include
# email-like headers (such as documents), uncomment the line below. This
# will cause the entire input to be treated like a message "body"
#
#DataSource document
# ProcessorWordFrequency: By default, words are only counted once per
message.
# If you are classifying large documents, however, you may wish to count
once
# per occurrence instead.
#
#ProcessorWordFrequency occurrence
# ProcessorURLContext: By default, a URL context is generated for URLs,
which
# records their tokens as separate from words found in documents. To use
# URL tokens in the same context as words, turn this feature off.
#
ProcessorURLContext on
# ProcessorBias: Bias causes the filter to lean more toward 'innocent', and
# usually greatly reduces false positives. It is the default behavior of
# most Bayesian filters (including dspam).
#
# NOTE: You probably DONT want this if you're using Markovian Weighting,
unless
# you are paranoid about false positives.
#
ProcessorBias on
# StripRcptDomain: Cut the domain (including the at sign) from recipients.
# This is particularly useful if the recipient name is equal to real user
# accounts as recipients with domains tend to cause permission issues with
# dspam-web.
#
StripRcptDomain off
# GroupConfig: The configuration file for groups. See the README file
# for details on how to enable users to combine their training data to
# get better results.
GroupConfig /var/spool/dspam/group
# --- Split Configuration File Support ---
# Include a directory with configuration items.
Include /etc/dspam/dspam.d/
# --- ---
IgnoreHeader Accept-Language
IgnoreHeader Authentication-Results
IgnoreHeader Content-Type
IgnoreHeader DKIM-Signature
IgnoreHeader Date
IgnoreHeader DomainKey-Signature
IgnoreHeader Importance
IgnoreHeader In-Reply-To
IgnoreHeader List-Archive
IgnoreHeader List-Help
IgnoreHeader List-Id
IgnoreHeader List-Post
IgnoreHeader List-Subscribe
IgnoreHeader List-Unsubscribe
IgnoreHeader Message-ID
IgnoreHeader Message-Id
IgnoreHeader Organization
IgnoreHeader Received
IgnoreHeader Received-SPF
IgnoreHeader References
IgnoreHeader Reply-To
IgnoreHeader Resent-Date
IgnoreHeader Resent-From
IgnoreHeader Thread-Index
IgnoreHeader Thread-Topic
IgnoreHeader User-Agent
IgnoreHeader X-policyd-weight
IgnoreHeader thread-index
--001a11401bfe254500053b8b8e53
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr">I set up a new mail server about four months ago with DSPA=
M as the spam filter. While it is filtering out some spam, it completely mi=
sses most of it. I trained it for the first 2500 emails, but it doesn't=
seem to be getting any better at filtering after that. I regularly retrain=
any false negatives and false positives it finds. For example, I get a few=
dozen spams a day advertising vacations in Belize. They're all almost =
identical, and I've been getting them consistently for months, yet DSPA=
M is still not filtering them out and is marking them as<div><br></div><div=
><span style=3D"color:rgb(0,0,0);font-family:"times new roman";fo=
nt-size:medium"><tt><b>X-DSPAM-Confidence:</b>=C2=A00.9803<br></tt></span><=
span style=3D"color:rgb(0,0,0);font-family:"times new roman";font=
-size:medium"><tt><b>X-DSPAM-Probability:</b>=C2=A00.0000</tt></span><br></=
div><div><span style=3D"color:rgb(0,0,0);font-family:"times new roman&=
quot;;font-size:medium"><tt><br></tt></span></div><div><span style=3D"color=
:rgb(0,0,0);font-family:monospace;font-size:medium">Here's the output o=
f dspam_stats:=C2=A0</span><font color=3D"#000000" face=3D"monospace" size=
=3D"3">=C2=A0TP: 19302 TN: 17498 FP: =C2=A0 =C2=A045 FN: =C2=A01337 SC: =C2=
=A0 =C2=A0 0 NC: =C2=A0 =C2=A0 0<tt><br></tt></font></div><div><br></div><d=
iv><span style=3D"color:rgb(0,0,0);font-family:"times new roman";=
font-size:medium"><tt>Here's the output of dspam_stats -H :</tt></span>=
</div><div><span style=3D"color:rgb(0,0,0);font-family:"times new roma=
n";font-size:medium"><tt><br></tt></span></div><div><tt><div><font col=
or=3D"#000000" size=3D"3">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 FP False Positives: =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
=C2=A0 =C2=A0 45</font></div><div><font color=3D"#000000" size=3D"3">=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 FN False Negatives: =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 1337</font></div><d=
iv><font color=3D"#000000" size=3D"3">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 SC Spam Corpusfed: =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0</font></div><div><font color=3D"#00000=
0" size=3D"3">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 NC No=
nspam Corpusfed: =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A00</font></div><div><font color=3D"#000000" size=3D"3">=C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 TL Training Left: =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A00</font></div=
><div><font color=3D"#000000" size=3D"3">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
=C2=A0 =C2=A0 =C2=A0 SHR Spam Hit Rate =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 93.52%</font></div><div><font color=3D"#000000" size=
=3D"3">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 HSR Ham Stri=
ke Rate: =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 0.26%</font></div=
><div><font color=3D"#000000" size=3D"3">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
=C2=A0 =C2=A0 =C2=A0 PPV Positive predictive value: =C2=A0 =C2=A099.77%</f=
ont></div><div><font color=3D"#000000" size=3D"3">=C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 OCA Overall Accuracy: =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 96.38%</font></div><div style=3D"color:rgb(0,0,0);font=
-family:"times new roman";font-size:medium"><br></div></tt></div>=
<div><span style=3D"color:rgb(0,0,0);font-family:"times new roman"=
;;font-size:medium"><tt><br></tt></span></div><div><span style=3D"color:rgb=
(0,0,0);font-family:"times new roman";font-size:medium"><tt>One t=
hing I don't understand is TN--according to dspam_stats its 17498, yet =
I have only received a total of around 1900 non-spams since I set up this s=
erver.</tt></span></div><div><span style=3D"color:rgb(0,0,0);font-family:&q=
uot;times new roman";font-size:medium"><tt><br></tt></span></div><div>=
<span style=3D"color:rgb(0,0,0);font-family:"times new roman";fon=
t-size:medium"><tt>What can I do to help DSPAM learn faster so I can cut do=
wn all of the spam I have to manually deal with each day?</tt></span></div>=
<div><span style=3D"color:rgb(0,0,0);font-family:"times new roman"=
;;font-size:medium"><tt><br></tt></span></div><div><span style=3D"color:rgb=
(0,0,0);font-family:"times new roman";font-size:medium"><tt>Here&=
#39;s my dspam.conf:</tt></span></div><div><span style=3D"color:rgb(0,0,0);=
font-family:"times new roman";font-size:medium"><tt><br></tt></sp=
an></div><div><tt><div><font color=3D"#000000" size=3D"3">## $Id: <a href=
=3D"http://dspam.conf.in">dspam.conf.in</a>,v 1.103 2011/11/10 00:27:34 tom=
hendr Exp $</font></div><div><font color=3D"#000000" size=3D"3">## dspam.co=
nf -- DSPAM configuration file</font></div><div><font color=3D"#000000" siz=
e=3D"3">##</font></div><div><font color=3D"#000000" size=3D"3"><br></font><=
/div><div><font color=3D"#000000" size=3D"3">#</font></div><div><font color=
=3D"#000000" size=3D"3"># DSPAM Home: Specifies the base directory to be us=
ed for DSPAM storage</font></div><div><font color=3D"#000000" size=3D"3">#<=
/font></div><div><font color=3D"#000000" size=3D"3">Home /var/spool/dspam</=
font></div><div><font color=3D"#000000" size=3D"3"><br></font></div><div><f=
ont color=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000"=
size=3D"3"># StorageDriver: Specifies the storage driver backend (library)=
to use.</font></div><div><font color=3D"#000000" size=3D"3"># You'll o=
nly need to set this if you are using dynamic storage driver plugins</font>=
</div><div><font color=3D"#000000" size=3D"3"># from a binary distribution.=
The default build statically links the storage</font></div><div><font colo=
r=3D"#000000" size=3D"3"># driver (when only one is specified at configure =
time), overriding this</font></div><div><font color=3D"#000000" size=3D"3">=
# setting, which only comes into play if multiple storage drivers are speci=
fied</font></div><div><font color=3D"#000000" size=3D"3"># at configure tim=
e. When using dynamic linking, be sure to include the path</font></div><div=
><font color=3D"#000000" size=3D"3"># to the library if necessary, and some=
systems may use an extension other</font></div><div><font color=3D"#000000=
" size=3D"3"># than .so (e.g. OSX uses .dylib).</font></div><div><font colo=
r=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D=
"3"># Options include:</font></div><div><font color=3D"#000000" size=3D"3">=
#</font></div><div><font color=3D"#000000" size=3D"3"># =C2=A0 libmysql_drv=
.so =C2=A0 =C2=A0 libpgsql_drv.so</font></div><div><font color=3D"#000000" =
size=3D"3"># =C2=A0 libsqlite3_drv.so =C2=A0 libhash_drv.so</font></div><di=
v><font color=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000=
000" size=3D"3"># IMPORTANT: Switching storage drivers requires more than m=
erely changing</font></div><div><font color=3D"#000000" size=3D"3"># this o=
ption. If you do not wish to lose all of your data, you will need to</font>=
</div><div><font color=3D"#000000" size=3D"3"># migrate it to the new backe=
nd before making this change.</font></div><div><font color=3D"#000000" size=
=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3">StorageDriver =
/usr/lib/x86_64-linux-gnu/dspam/libhash_drv.so</font></div><div><font color=
=3D"#000000" size=3D"3">#StorageDriver /usr/lib/dspam/libmysql_drv.so</font=
></div><div><font color=3D"#000000" size=3D"3"><br></font></div><div><font =
color=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" siz=
e=3D"3"># Trusted Delivery Agent: Specifies the local delivery agent DSPAM =
should call</font></div><div><font color=3D"#000000" size=3D"3"># when deli=
vering mail as a trusted user. Use %u to specify the user DSPAM is</font></=
div><div><font color=3D"#000000" size=3D"3"># processing mail for. It is ge=
nerally a good idea to allow the MTA to specify</font></div><div><font colo=
r=3D"#000000" size=3D"3"># the pass-through arguments at run-time, but they=
may also be specified here.</font></div><div><font color=3D"#000000" size=
=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3"># Most operati=
ng system defaults:</font></div><div><font color=3D"#000000" size=3D"3">#Tr=
ustedDeliveryAgent "/usr/bin/procmail" =C2=A0 =C2=A0 =C2=A0 # Lin=
ux</font></div><div><font color=3D"#000000" size=3D"3">#TrustedDeliveryAgen=
t "/usr/bin/mail" =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 # Solaris</f=
ont></div><div><font color=3D"#000000" size=3D"3">#TrustedDeliveryAgent &qu=
ot;/usr/libexec/mail.local" # FreeBSD</font></div><div><font color=3D"=
#000000" size=3D"3">#TrustedDeliveryAgent "/usr/bin/procmail" =C2=
=A0 =C2=A0 =C2=A0 # Cygwin</font></div><div><font color=3D"#000000" size=3D=
"3">#</font></div><div><font color=3D"#000000" size=3D"3"># Other popular c=
onfigurations:</font></div><div><font color=3D"#000000" size=3D"3">#Trusted=
DeliveryAgent "/usr/cyrus/bin/deliver" =C2=A0# Cyrus</font></div>=
<div><font color=3D"#000000" size=3D"3">#TrustedDeliveryAgent "/bin/ma=
ildrop" =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 # Maildrop</font></div><div=
><font color=3D"#000000" size=3D"3">#TrustedDeliveryAgent "/usr/local/=
sbin/exim -oMr spam-scanned -oi" # Exim</font></div><div><font color=
=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"=
3">TrustedDeliveryAgent "/usr/bin/procmail"</font></div><div><fon=
t color=3D"#000000" size=3D"3"><br></font></div><div><font color=3D"#000000=
" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3"># Untrus=
ted Delivery Agent: Specifies the local delivery agent and arguments</font>=
</div><div><font color=3D"#000000" size=3D"3"># DSPAM should use when deliv=
ering mail and running in untrusted user mode.</font></div><div><font color=
=3D"#000000" size=3D"3"># Because DSPAM will not allow pass-through argumen=
ts to be specified to</font></div><div><font color=3D"#000000" size=3D"3">#=
untrusted users, all arguments should be specified here. Use %u to specify=
</font></div><div><font color=3D"#000000" size=3D"3"># the user DSPAM is pr=
ocessing mail for. This configuration parameter is only</font></div><div><f=
ont color=3D"#000000" size=3D"3"># necessary if you plan on allowing untrus=
ted processing.</font></div><div><font color=3D"#000000" size=3D"3">#</font=
></div><div><font color=3D"#000000" size=3D"3">#UntrustedDeliveryAgent &quo=
t;/usr/bin/procmail -d %u"</font></div><div><font color=3D"#000000" si=
ze=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3">#</font><=
/div><div><font color=3D"#000000" size=3D"3"># SMTP or LMTP Delivery: Alter=
natively, you may wish to use SMTP or LMTP</font></div><div><font color=3D"=
#000000" size=3D"3"># delivery to deliver your message to the mail server i=
nstead of using a</font></div><div><font color=3D"#000000" size=3D"3"># del=
ivery agent. You will need to configure with --enable-daemon to use host</f=
ont></div><div><font color=3D"#000000" size=3D"3"># delivery, however you d=
o not need to operate in daemon mode. Specify an IP</font></div><div><font =
color=3D"#000000" size=3D"3"># address or UNIX path to a domain socket belo=
w as a host.</font></div><div><font color=3D"#000000" size=3D"3">#</font></=
div><div><font color=3D"#000000" size=3D"3"># If you would like to set up D=
eliveryHost's on a per-domain basis, use</font></div><div><font color=
=3D"#000000" size=3D"3"># the syntax: <a href=3D"http://DeliveryHost.exampl=
e.org">DeliveryHost.example.org</a> 1.2.3.4</font></div><div><font color=3D=
"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3">=
DeliveryHost =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0127.0.0.1</font></div=
><div><font color=3D"#000000" size=3D"3">#DeliveryPort =C2=A0 =C2=A0 =C2=A0=
=C2=A0 =C2=A0 2424</font></div><div><font color=3D"#000000" size=3D"3">Del=
iveryPort =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A010026</font></div><div><=
font color=3D"#000000" size=3D"3">DeliveryIdent =C2=A0 =C2=A0 =C2=A0 =C2=A0=
=C2=A0 localhost</font></div><div><font color=3D"#000000" size=3D"3">#Deli=
veryProto =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0LMTP</font></div><div><font col=
or=3D"#000000" size=3D"3">DeliveryProto =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
SMTP</font></div><div><font color=3D"#000000" size=3D"3"><br></font></div><=
div><font color=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#0=
00000" size=3D"3"># FallbackDomains: If you want to specify certain domains=
as fallback domains,</font></div><div><font color=3D"#000000" size=3D"3">#=
enable this option. For example, you could create a user @<a href=3D"http:=
//example.org">example.org</a>, and</font></div><div><font color=3D"#000000=
" size=3D"3"># if <a href=3D"mailto:[email protected]">[email protected]</a> do=
es not resolve to a known user on the system, the user</font></div><div><fo=
nt color=3D"#000000" size=3D"3"># could default to your @<a href=3D"http://=
example.org">example.org</a> user. NOTE: This also requires designating</fo=
nt></div><div><font color=3D"#000000" size=3D"3"># fallbackDomain for the d=
omain name;</font></div><div><font color=3D"#000000" size=3D"3"># e.g. dspa=
m_admin ch pref <a href=3D"http://example.org">example.org</a> fallbackDoma=
in on</font></div><div><font color=3D"#000000" size=3D"3">#</font></div><di=
v><font color=3D"#000000" size=3D"3">FallbackDomains on</font></div><div><f=
ont color=3D"#000000" size=3D"3">FallbackDomain <a href=3D"http://xm23.net"=
>xm23.net</a></font></div><div><font color=3D"#000000" size=3D"3"><br></fon=
t></div><div><font color=3D"#000000" size=3D"3">#</font></div><div><font co=
lor=3D"#000000" size=3D"3"># Quarantine Agent: DSPAM's default behavior=
is to quarantine all mail it</font></div><div><font color=3D"#000000" size=
=3D"3"># thinks is spam. If you wish to override this behavior, you may spe=
cify</font></div><div><font color=3D"#000000" size=3D"3"># a quarantine age=
nt which will be called with all messages DSPAM thinks is</font></div><div>=
<font color=3D"#000000" size=3D"3"># spam. Use %u to specify the user DSPAM=
is processing mail for.</font></div><div><font color=3D"#000000" size=3D"3=
">#</font></div><div><font color=3D"#000000" size=3D"3">#QuarantineAgent =
=C2=A0 =C2=A0 =C2=A0 =C2=A0"/usr/bin/procmail -d spam"</font></di=
v><div><font color=3D"#000000" size=3D"3"><br></font></div><div><font color=
=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"=
3"># DSPAM can optionally process "plused users" (addresses in th=
e user+detail</font></div><div><font color=3D"#000000" size=3D"3"># form) b=
y truncating the username just before the "+", so all internal</f=
ont></div><div><font color=3D"#000000" size=3D"3"># processing occurs for &=
quot;user", but delivery will be performed for</font></div><div><font =
color=3D"#000000" size=3D"3"># "user+detail". This is only useful=
if the LDA can handle "plused users"</font></div><div><font colo=
r=3D"#000000" size=3D"3"># (for example Cyrus IMAP) and when configured for=
LMTP delivery above</font></div><div><font color=3D"#000000" size=3D"3">#<=
/font></div><div><font color=3D"#000000" size=3D"3">#EnablePlusedDetail =C2=
=A0 =C2=A0 on</font></div><div><font color=3D"#000000" size=3D"3"><br></fon=
t></div><div><font color=3D"#000000" size=3D"3">#</font></div><div><font co=
lor=3D"#000000" size=3D"3"># Character to use as seperator between user nam=
es and address extensions.</font></div><div><font color=3D"#000000" size=3D=
"3"># If you change this value then please adjust QuarantineMailbox to use =
the</font></div><div><font color=3D"#000000" size=3D"3"># new specified cha=
racter. The default is '+'.</font></div><div><font color=3D"#000000=
" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3">#PlusedC=
haracter =C2=A0 =C2=A0 =C2=A0 =C2=A0+</font></div><div><font color=3D"#0000=
00" size=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3">#</=
font></div><div><font color=3D"#000000" size=3D"3"># Turn this feature on i=
f you want to force DSPAM to lowercase the "plused</font></div><div><f=
ont color=3D"#000000" size=3D"3"># users" username.</font></div><div><=
font color=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000=
" size=3D"3">#PlusedUserLowercase =C2=A0 =C2=A0on</font></div><div><font co=
lor=3D"#000000" size=3D"3"><br></font></div><div><font color=3D"#000000" si=
ze=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3"># Quarantine=
Mailbox: DSPAM's LMTP code can send spam mail using LMTP to a</font></=
div><div><font color=3D"#000000" size=3D"3"># "plused" mailbox (s=
uch as user+quarantine) leaving quarantine processing</font></div><div><fon=
t color=3D"#000000" size=3D"3"># for retraining or deletion to be performed=
by the LDA and the mail client.</font></div><div><font color=3D"#000000" s=
ize=3D"3"># "plused" mailboxes are supported by Cyrus IMAP and po=
ssibly other LDAs. If</font></div><div><font color=3D"#000000" size=3D"3">#=
you don't set/change PlusedCharacter then the mailbox name must have t=
he +</font></div><div><font color=3D"#000000" size=3D"3"># since the + is t=
he default used character.</font></div><div><font color=3D"#000000" size=3D=
"3">#</font></div><div><font color=3D"#000000" size=3D"3">#QuarantineMailbo=
x =C2=A0 =C2=A0 =C2=A0+quarantine</font></div><div><font color=3D"#000000" =
size=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3">#</font=
></div><div><font color=3D"#000000" size=3D"3"># OnFail: What to do if loca=
l delivery or quarantine should fail. If set</font></div><div><font color=
=3D"#000000" size=3D"3"># to "unlearn", DSPAM will unlearn the me=
ssage prior to exiting with an</font></div><div><font color=3D"#000000" siz=
e=3D"3"># un successful return code. The default option, "error" =
will not unlearn</font></div><div><font color=3D"#000000" size=3D"3"># the =
message but return the appropriate error code. The unlearn option</font></d=
iv><div><font color=3D"#000000" size=3D"3"># is use-ful on some systems whe=
re local delivery failures will cause the</font></div><div><font color=3D"#=
000000" size=3D"3"># message to be requeued for delivery, and could result =
in the message</font></div><div><font color=3D"#000000" size=3D"3"># being =
processed multiple times. During a very large failure, however,</font></div=
><div><font color=3D"#000000" size=3D"3"># this could cause a significant l=
oad increase.</font></div><div><font color=3D"#000000" size=3D"3">#</font><=
/div><div><font color=3D"#000000" size=3D"3">OnFail error</font></div><div>=
<font color=3D"#000000" size=3D"3"><br></font></div><div><font color=3D"#00=
0000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3"># Tr=
usted Users: Only the users specified below will be allowed to perform</fon=
t></div><div><font color=3D"#000000" size=3D"3"># administrative functions =
in DSPAM such as setting the active user and</font></div><div><font color=
=3D"#000000" size=3D"3"># accessing tools. All other users attempting to ru=
n DSPAM will be restricted;</font></div><div><font color=3D"#000000" size=
=3D"3"># their uids will be forced to match the active username and they wi=
ll not be</font></div><div><font color=3D"#000000" size=3D"3"># able to spe=
cify delivery agent privileges or use tools.</font></div><div><font color=
=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"=
3">Trust root</font></div><div><font color=3D"#000000" size=3D"3">Trust dsp=
am</font></div><div><font color=3D"#000000" size=3D"3">Trust www-data</font=
></div><div><font color=3D"#000000" size=3D"3">Trust mail</font></div><div>=
<font color=3D"#000000" size=3D"3">Trust daemon</font></div><div><font colo=
r=3D"#000000" size=3D"3">Trust amavis</font></div><div><font color=3D"#0000=
00" size=3D"3">#Trust nobody</font></div><div><font color=3D"#000000" size=
=3D"3">#Trust majordomo</font></div><div><font color=3D"#000000" size=3D"3"=
><br></font></div><div><font color=3D"#000000" size=3D"3">#</font></div><di=
v><font color=3D"#000000" size=3D"3"># Debugging: Enables debugging for som=
e or all users. IMPORTANT: DSPAM must</font></div><div><font color=3D"#0000=
00" size=3D"3"># be compiled with debug support in order to use this option=
. DSPAM should</font></div><div><font color=3D"#000000" size=3D"3"># never =
be running in production with debug active unless you are</font></div><div>=
<font color=3D"#000000" size=3D"3"># troubleshooting problems.</font></div>=
<div><font color=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#=
000000" size=3D"3"># DebugOpt: One or more of: process, classify, spam, fp,=
inoculation, corpus</font></div><div><font color=3D"#000000" size=3D"3"># =
=C2=A0 process =C2=A0 =C2=A0 standard message processing</font></div><div><=
font color=3D"#000000" size=3D"3"># =C2=A0 classify =C2=A0 =C2=A0message cl=
assification using --classify</font></div><div><font color=3D"#000000" size=
=3D"3"># =C2=A0 spam =C2=A0 =C2=A0 =C2=A0 =C2=A0error correction of missed =
spam</font></div><div><font color=3D"#000000" size=3D"3"># =C2=A0 fp =C2=A0=
=C2=A0 =C2=A0 =C2=A0 =C2=A0error correction of false positives</font></div=
><div><font color=3D"#000000" size=3D"3"># =C2=A0 inoculation message inocu=
lations (source=3Dinoculation)</font></div><div><font color=3D"#000000" siz=
e=3D"3"># =C2=A0 corpus =C2=A0 =C2=A0 =C2=A0corpusfed messages (source=3Dco=
rpus)</font></div><div><font color=3D"#000000" size=3D"3">#</font></div><di=
v><font color=3D"#000000" size=3D"3">Debug process</font></div><div><font c=
olor=3D"#000000" size=3D"3">#Debug bob bill</font></div><div><font color=3D=
"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3">=
#DebugOpt process spam fp</font></div><div><font color=3D"#000000" size=3D"=
3"><br></font></div><div><font color=3D"#000000" size=3D"3">#</font></div><=
div><font color=3D"#000000" size=3D"3"># ClassAlias: Alias a particular cla=
ss to spam/nonspam. This is useful if</font></div><div><font color=3D"#0000=
00" size=3D"3"># classifying things other than spam.</font></div><div><font=
color=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" si=
ze=3D"3">#ClassAliasSpam badstuff</font></div><div><font color=3D"#000000" =
size=3D"3">#ClassAliasNonspam goodstuff</font></div><div><font color=3D"#00=
0000" size=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3">#=
</font></div><div><font color=3D"#000000" size=3D"3"># Training Mode: The d=
efault training mode to use for all operations, when</font></div><div><font=
color=3D"#000000" size=3D"3"># one has not been specified on the commandli=
ne or in the user's preferences.</font></div><div><font color=3D"#00000=
0" size=3D"3"># Acceptable values are:</font></div><div><font color=3D"#000=
000" size=3D"3"># =C2=A0 =C2=A0 toe =C2=A0 =C2=A0 Train on Error (Only)</fo=
nt></div><div><font color=3D"#000000" size=3D"3"># =C2=A0 =C2=A0 teft =C2=
=A0 =C2=A0Train Everything (Trains on every message)</font></div><div><font=
color=3D"#000000" size=3D"3"># =C2=A0 =C2=A0 tum =C2=A0 =C2=A0 Train Until=
Mature (Train only tokens without enough data)</font></div><div><font colo=
r=3D"#000000" size=3D"3"># =C2=A0 =C2=A0 notrain Do not train or store sign=
atures (large ISP systems, post-train)</font></div><div><font color=3D"#000=
000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3">Train=
ingMode teft</font></div><div><font color=3D"#000000" size=3D"3"><br></font=
></div><div><font color=3D"#000000" size=3D"3">#</font></div><div><font col=
or=3D"#000000" size=3D"3"># TestConditionalTraining: By default, dspam will=
retrain certain errors</font></div><div><font color=3D"#000000" size=3D"3"=
># until the condition is no longer met. This usually accelerates learning.=
</font></div><div><font color=3D"#000000" size=3D"3"># Some people argue th=
at this can increase the risk of errors, however.</font></div><div><font co=
lor=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" size=
=3D"3">TestConditionalTraining on</font></div><div><font color=3D"#000000" =
size=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3">#</font=
></div><div><font color=3D"#000000" size=3D"3"># Features: Specify features=
to activate by default; can also be specified</font></div><div><font color=
=3D"#000000" size=3D"3"># on the commandline. See the documentation for a l=
ist of available features.</font></div><div><font color=3D"#000000" size=3D=
"3"># If _any_ features are specified on the commandline, these are ignored=
.</font></div><div><font color=3D"#000000" size=3D"3">#</font></div><div><f=
ont color=3D"#000000" size=3D"3">Feature noise</font></div><div><font color=
=3D"#000000" size=3D"3">Feature whitelist</font></div><div><font color=3D"#=
000000" size=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3"=
># Training Buffer: The training buffer waters down statistics during train=
ing.</font></div><div><font color=3D"#000000" size=3D"3"># It is designed t=
o prevent false positives, but can also dramatically reduce</font></div><di=
v><font color=3D"#000000" size=3D"3"># dspam's catch rate during initia=
l training. This can be a number from 0</font></div><div><font color=3D"#00=
0000" size=3D"3"># (no buffering) to 10 (maximum buffering). If you are par=
anoid about false</font></div><div><font color=3D"#000000" size=3D"3"># pos=
itives, you should probably enable this option.</font></div><div><font colo=
r=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D=
"3">#Feature tb=3D5</font></div><div><font color=3D"#000000" size=3D"3"><br=
></font></div><div><font color=3D"#000000" size=3D"3">#</font></div><div><f=
ont color=3D"#000000" size=3D"3"># Algorithms: Specify the statistical algo=
rithms to use, overriding any</font></div><div><font color=3D"#000000" size=
=3D"3"># defaults configured in the build. The options are:</font></div><di=
v><font color=3D"#000000" size=3D"3"># =C2=A0 =C2=A0naive =C2=A0 =C2=A0 =C2=
=A0 Naive-Bayesian (All Tokens)</font></div><div><font color=3D"#000000" si=
ze=3D"3"># =C2=A0 =C2=A0graham =C2=A0 =C2=A0 =C2=A0Graham-Bayesian ("A=
Plan for Spam")</font></div><div><font color=3D"#000000" size=3D"3">#=
=C2=A0 =C2=A0burton =C2=A0 =C2=A0 =C2=A0Burton-Bayesian (SpamProbe)</font>=
</div><div><font color=3D"#000000" size=3D"3"># =C2=A0 =C2=A0robinson =C2=
=A0 =C2=A0Robinson's Geometric Mean Test (Obsolete)</font></div><div><f=
ont color=3D"#000000" size=3D"3"># =C2=A0 =C2=A0chi-square =C2=A0Fisher-Rob=
inson's Chi-Square Algorithm</font></div><div><font color=3D"#000000" s=
ize=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3"># You may h=
ave multiple algorithms active simultaneously, but it is strongly</font></d=
iv><div><font color=3D"#000000" size=3D"3"># recommended that you group Bay=
esian algorithms with other Bayesian</font></div><div><font color=3D"#00000=
0" size=3D"3"># algorithms, and any use of Chi-Square remain exclusive.</fo=
nt></div><div><font color=3D"#000000" size=3D"3">#</font></div><div><font c=
olor=3D"#000000" size=3D"3"># NOTE: For standard "CRM114" Markovi=
an weighting, use 'naive', or consider</font></div><div><font color=
=3D"#000000" size=3D"3"># =C2=A0 =C2=A0 =C2=A0 using 'burton' for s=
lightly better accuracy</font></div><div><font color=3D"#000000" size=3D"3"=
>#</font></div><div><font color=3D"#000000" size=3D"3"># Don't mess wit=
h this unless you know what you're doing</font></div><div><font color=
=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"=
3">#Algorithm chi-square</font></div><div><font color=3D"#000000" size=3D"3=
">#Algorithm naive</font></div><div><font color=3D"#000000" size=3D"3">Algo=
rithm graham burton</font></div><div><font color=3D"#000000" size=3D"3"><br=
></font></div><div><font color=3D"#000000" size=3D"3">#</font></div><div><f=
ont color=3D"#000000" size=3D"3"># Tokenizer: Specify the tokenizer to use.=
The tokenizer is the piece</font></div><div><font color=3D"#000000" size=
=3D"3"># responsible for parsing the message into individual tokens. Depend=
ing on</font></div><div><font color=3D"#000000" size=3D"3"># how many resou=
rces you are willing to trade off vs. accuracy, you may</font></div><div><f=
ont color=3D"#000000" size=3D"3"># choose to use a less or more detailed to=
kenizer:</font></div><div><font color=3D"#000000" size=3D"3"># =C2=A0 word =
=C2=A0 =C2=A0uniGram (single word) tokenizer</font></div><div><font color=
=3D"#000000" size=3D"3"># =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Tokenizes mess=
age into single individual words/tokens</font></div><div><font color=3D"#00=
0000" size=3D"3"># =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 example: "free&q=
uot; and "viagra"</font></div><div><font color=3D"#000000" size=
=3D"3"># =C2=A0 chain =C2=A0 biGram (chained tokens) tokenizer (default)</f=
ont></div><div><font color=3D"#000000" size=3D"3"># =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 Single words + chains adjacent tokens together</font></div><d=
iv><font color=3D"#000000" size=3D"3"># =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
example: "free" and "viagra" and "free viagra"=
;</font></div><div><font color=3D"#000000" size=3D"3"># =C2=A0 sbph =C2=A0 =
=C2=A0Sparse Binary Polynomial Hashing tokenizer</font></div><div><font col=
or=3D"#000000" size=3D"3"># =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Creates spar=
se token patterns across sliding window of 5-tokens</font></div><div><font =
color=3D"#000000" size=3D"3"># =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 example: =
"the quick * fox jumped" and "the * * fox jumped"</font=
></div><div><font color=3D"#000000" size=3D"3"># =C2=A0 osb =C2=A0 =C2=A0 O=
rthogonal Sparse biGram tokenizer</font></div><div><font color=3D"#000000" =
size=3D"3"># =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Similar to SBPH, but only u=
ses the biGrams</font></div><div><font color=3D"#000000" size=3D"3"># =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 example: "the * * fox" and "=
the * * * jumped"</font></div><div><font color=3D"#000000" size=3D"3">=
#</font></div><div><font color=3D"#000000" size=3D"3"># In general the recc=
omendation is to use 'osb' for new installations.</font></div><div>=
<font color=3D"#000000" size=3D"3"># The default value of 'chain' r=
emains here as not to surprise anyone upgrading</font></div><div><font colo=
r=3D"#000000" size=3D"3"># that has not changed from the default value.</fo=
nt></div><div><font color=3D"#000000" size=3D"3">#</font></div><div><font c=
olor=3D"#000000" size=3D"3">Tokenizer chain</font></div><div><font color=3D=
"#000000" size=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"=
3">#</font></div><div><font color=3D"#000000" size=3D"3"># PValue: Specify =
the technique used for calculating Probability Values,</font></div><div><fo=
nt color=3D"#000000" size=3D"3"># overriding any defaults configured in the=
build. These options are:</font></div><div><font color=3D"#000000" size=3D=
"3"># =C2=A0 =C2=A0bcr =C2=A0 =C2=A0 =C2=A0 =C2=A0 Bayesian Chain Rule (Gra=
ham's Technique - "A Plan for Spam")</font></div><div><font c=
olor=3D"#000000" size=3D"3"># =C2=A0 =C2=A0robinson =C2=A0 =C2=A0Robinson&#=
39;s Technique (used in Chi-Square)</font></div><div><font color=3D"#000000=
" size=3D"3"># =C2=A0 =C2=A0markov =C2=A0 =C2=A0 =C2=A0Markovian Weighted T=
echnique (for Markovian discrimination)</font></div><div><font color=3D"#00=
0000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3"># Un=
like the "Algorithms" property, you may only have one of these de=
fined.</font></div><div><font color=3D"#000000" size=3D"3"># Use of the chi=
-square algorithm automatically changes this to robinson.</font></div><div>=
<font color=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#00000=
0" size=3D"3"># Don't mess with this unless you know what you're do=
ing.</font></div><div><font color=3D"#000000" size=3D"3">#</font></div><div=
><font color=3D"#000000" size=3D"3">#PValue robinson</font></div><div><font=
color=3D"#000000" size=3D"3">#PValue markov</font></div><div><font color=
=3D"#000000" size=3D"3">PValue bcr</font></div><div><font color=3D"#000000"=
size=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3">#</fon=
t></div><div><font color=3D"#000000" size=3D"3"># WebStats: Enable this if =
you are using the CGI, which writes .stats files</font></div><div><font col=
or=3D"#000000" size=3D"3">WebStats on</font></div><div><font color=3D"#0000=
00" size=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3">#</=
font></div><div><font color=3D"#000000" size=3D"3"># ImprobabilityDrive: Ca=
lculate odds-ratios for ham/spam, and add to</font></div><div><font color=
=3D"#000000" size=3D"3"># X-DSPAM-Improbability headers</font></div><div><f=
ont color=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000"=
size=3D"3">#ImprobabilityDrive on</font></div><div><font color=3D"#000000"=
size=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3">#</fon=
t></div><div><font color=3D"#000000" size=3D"3"># Preferences: Specify any =
preferences to set by default, unless otherwise</font></div><div><font colo=
r=3D"#000000" size=3D"3"># overridden by the user (see next section) or a d=
efault.prefs file.</font></div><div><font color=3D"#000000" size=3D"3"># If=
user or default.prefs are found, the user's preferences will override =
any</font></div><div><font color=3D"#000000" size=3D"3"># defaults.</font><=
/div><div><font color=3D"#000000" size=3D"3">#</font></div><div><font color=
=3D"#000000" size=3D"3">Preference "trainingMode=3DTEFT" =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0# { TOE | TUM | TEFT | NOTRAIN } -> default:t=
eft</font></div><div><font color=3D"#000000" size=3D"3">Preference "sp=
amAction=3Dtag" =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 # { quaranti=
ne | tag | deliver } -> default:quarantine</font></div><div><font color=
=3D"#000000" size=3D"3">Preference "spamSubject=3D[SPAM]" =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 # { string } -> default:[SPAM]</font></div><div><fo=
nt color=3D"#000000" size=3D"3">Preference "statisticalSedation=3D5&qu=
ot; =C2=A0 =C2=A0 =C2=A0# { 0 - 10 } -> default:0</font></div><div><font=
color=3D"#000000" size=3D"3">Preference "enableBNR=3Don" =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 # { on | off } -> default:off<=
/font></div><div><font color=3D"#000000" size=3D"3">Preference "enable=
Whitelist=3Don" =C2=A0 =C2=A0 =C2=A0 =C2=A0 # { on | off } -> defau=
lt:on</font></div><div><font color=3D"#000000" size=3D"3">Preference "=
signatureLocation=3Dmessage" =C2=A0# { message | headers } -> defau=
lt:message</font></div><div><font color=3D"#000000" size=3D"3">Preference &=
quot;tagSpam=3Doff" =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0# { on | off }</font></div><div><font color=3D"#000000" size=3D"3">Pr=
eference "tagNonspam=3Doff" =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 # { on | off }</font></div><div><font color=3D"#000000" size=3D"3">P=
reference "showFactors=3Doff" =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0# { on | off } -> default:off</font></div><div><font color=3D"#000=
000" size=3D"3">Preference "optIn=3Doff" =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0# { on | off }</font></div><div><font=
color=3D"#000000" size=3D"3">Preference "optOut=3Doff" =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 # { on | off }</font></div=
><div><font color=3D"#000000" size=3D"3">Preference "whitelistThreshol=
d=3D10" =C2=A0 =C2=A0 =C2=A0# { Integer } -> default:10</font></div=
><div><font color=3D"#000000" size=3D"3">Preference "makeCorpus=3Doff&=
quot; =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 # { on | off } -> defaul=
t:off</font></div><div><font color=3D"#000000" size=3D"3">Preference "=
storeFragments=3Doff" =C2=A0 =C2=A0 =C2=A0 =C2=A0 # { on | off } ->=
default:off</font></div><div><font color=3D"#000000" size=3D"3">Preference=
"localStore=3D" =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
=C2=A0# { on | off } -> default:username</font></div><div><font color=
=3D"#000000" size=3D"3">Preference "processorBias=3Don" =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 # { on | off } -> default:on</font></div><di=
v><font color=3D"#000000" size=3D"3">Preference "fallbackDomain=3Doff&=
quot; =C2=A0 =C2=A0 =C2=A0 =C2=A0 # { on | off } -> default:off</font></=
div><div><font color=3D"#000000" size=3D"3">Preference "trainPristine=
=3Doff" =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0# { on | off } -> default=
:off</font></div><div><font color=3D"#000000" size=3D"3">Preference "o=
ptOutClamAV=3Doff" =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 # { on | off } -=
> default:off</font></div><div><font color=3D"#000000" size=3D"3">Prefer=
ence "ignoreRBLLookups=3Doff" =C2=A0 =C2=A0 =C2=A0 # { on | off }=
-> default:off</font></div><div><font color=3D"#000000" size=3D"3">Pref=
erence "RBLInoculate=3Doff" =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 # =
{ on | off } -> default:off</font></div><div><font color=3D"#000000" siz=
e=3D"3">Preference "notifications=3Doff" =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0# { on | off } -> default:off</font></div><div><font color=3D"=
#000000" size=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3=
">#</font></div><div><font color=3D"#000000" size=3D"3"># Overrides: Specif=
ies the user preferences which may override configuration</font></div><div>=
<font color=3D"#000000" size=3D"3"># and commandline defaults. Any other pr=
eferences supplied by an untrusted user</font></div><div><font color=3D"#00=
0000" size=3D"3"># will be ignored.</font></div><div><font color=3D"#000000=
" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3">AllowOve=
rride enableBNR</font></div><div><font color=3D"#000000" size=3D"3">AllowOv=
erride enableWhitelist</font></div><div><font color=3D"#000000" size=3D"3">=
AllowOverride fallbackDomain</font></div><div><font color=3D"#000000" size=
=3D"3">AllowOverride ignoreGroups</font></div><div><font color=3D"#000000" =
size=3D"3">AllowOverride ignoreRBLLookups</font></div><div><font color=3D"#=
000000" size=3D"3">AllowOverride localStore</font></div><div><font color=3D=
"#000000" size=3D"3">AllowOverride makeCorpus</font></div><div><font color=
=3D"#000000" size=3D"3">AllowOverride optIn</font></div><div><font color=3D=
"#000000" size=3D"3">AllowOverride optOut</font></div><div><font color=3D"#=
000000" size=3D"3">AllowOverride optOutClamAV</font></div><div><font color=
=3D"#000000" size=3D"3">AllowOverride processorBias</font></div><div><font =
color=3D"#000000" size=3D"3">AllowOverride RBLInoculate</font></div><div><f=
ont color=3D"#000000" size=3D"3">AllowOverride showFactors</font></div><div=
><font color=3D"#000000" size=3D"3">AllowOverride signatureLocation</font><=
/div><div><font color=3D"#000000" size=3D"3">AllowOverride spamAction</font=
></div><div><font color=3D"#000000" size=3D"3">AllowOverride spamSubject</f=
ont></div><div><font color=3D"#000000" size=3D"3">AllowOverride statistical=
Sedation</font></div><div><font color=3D"#000000" size=3D"3">AllowOverride =
storeFragments</font></div><div><font color=3D"#000000" size=3D"3">AllowOve=
rride tagNonspam</font></div><div><font color=3D"#000000" size=3D"3">AllowO=
verride tagSpam</font></div><div><font color=3D"#000000" size=3D"3">AllowOv=
erride trainPristine</font></div><div><font color=3D"#000000" size=3D"3">Al=
lowOverride trainingMode</font></div><div><font color=3D"#000000" size=3D"3=
">AllowOverride whitelistThreshold</font></div><div><font color=3D"#000000"=
size=3D"3">AllowOverride dailyQuarantineSummary</font></div><div><font col=
or=3D"#000000" size=3D"3">AllowOverride notifications</font></div><div><fon=
t color=3D"#000000" size=3D"3"><br></font></div><div><font color=3D"#000000=
" size=3D"3"># --- Profiles ---</font></div><div><font color=3D"#000000" si=
ze=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3">#</font><=
/div><div><font color=3D"#000000" size=3D"3"># You can specify multiple sto=
rage profiles, and specify the server to</font></div><div><font color=3D"#0=
00000" size=3D"3"># use on the commandline with --profile. For example:</fo=
nt></div><div><font color=3D"#000000" size=3D"3">#</font></div><div><font c=
olor=3D"#000000" size=3D"3">#Profile DECAlpha</font></div><div><font color=
=3D"#000000" size=3D"3">#MySQLServer.DECAlpha =C2=A0 10.0.0.1</font></div><=
div><font color=3D"#000000" size=3D"3">#MySQLPort.DECAlpha =C2=A0 =C2=A0 33=
06</font></div><div><font color=3D"#000000" size=3D"3">#MySQLUser.DECAlpha =
=C2=A0 =C2=A0 dspam</font></div><div><font color=3D"#000000" size=3D"3">#My=
SQLPass.DECAlpha =C2=A0 =C2=A0 changeme</font></div><div><font color=3D"#00=
0000" size=3D"3">#MySQLDb.DECAlpha =C2=A0 =C2=A0 =C2=A0 dspam</font></div><=
div><font color=3D"#000000" size=3D"3">#MySQLCompress.DECAlpha true</font><=
/div><div><font color=3D"#000000" size=3D"3">#MySQLReconnect.DECAlpha =C2=
=A0 =C2=A0 =C2=A0 =C2=A0true</font></div><div><font color=3D"#000000" size=
=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3">#Profile Sun42=
0R</font></div><div><font color=3D"#000000" size=3D"3">#MySQLServer.Sun420R=
=C2=A0 =C2=A010.0.0.2</font></div><div><font color=3D"#000000" size=3D"3">=
#MySQLPort.Sun420R =C2=A0 =C2=A0 =C2=A03306</font></div><div><font color=3D=
"#000000" size=3D"3">#MySQLUser.Sun420R =C2=A0 =C2=A0 =C2=A0dspam</font></d=
iv><div><font color=3D"#000000" size=3D"3">#MySQLPass.Sun420R =C2=A0 =C2=A0=
=C2=A0changeme</font></div><div><font color=3D"#000000" size=3D"3">#MySQLD=
b.Sun420R =C2=A0 =C2=A0 =C2=A0 =C2=A0dspam</font></div><div><font color=3D"=
#000000" size=3D"3">#MySQLCompress.Sun420R =C2=A0false</font></div><div><fo=
nt color=3D"#000000" size=3D"3">#MySQLReconnect.Sun420R true</font></div><d=
iv><font color=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#00=
0000" size=3D"3">#DefaultProfile DECAlpha</font></div><div><font color=3D"#=
000000" size=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3"=
>#</font></div><div><font color=3D"#000000" size=3D"3"># If you're usin=
g storage profiles, you can set failovers for each profile.</font></div><di=
v><font color=3D"#000000" size=3D"3"># Of course, if you'll be failing =
over to another database, that database</font></div><div><font color=3D"#00=
0000" size=3D"3"># must have the same information as the first. If you'=
re using a global</font></div><div><font color=3D"#000000" size=3D"3"># dat=
abase with no training, this should be relatively simple. If you're</fo=
nt></div><div><font color=3D"#000000" size=3D"3"># configuring per-user dat=
a, however, you'll need to set up some type of</font></div><div><font c=
olor=3D"#000000" size=3D"3"># replication between databases.</font></div><d=
iv><font color=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#00=
0000" size=3D"3">#Failover.DECAlpha =C2=A0 =C2=A0 =C2=A0SUN420R</font></div=
><div><font color=3D"#000000" size=3D"3">#Failover.Sun420R =C2=A0 =C2=A0 =
=C2=A0 DECAlpha</font></div><div><font color=3D"#000000" size=3D"3"><br></f=
ont></div><div><font color=3D"#000000" size=3D"3"># If the storage fails, t=
he agent will follow each profile's failover up to</font></div><div><fo=
nt color=3D"#000000" size=3D"3"># a maximum number of failover attempts. Th=
is should be set to a maximum of</font></div><div><font color=3D"#000000" s=
ize=3D"3"># the number of profiles you have, otherwise the agent could loop=
and try</font></div><div><font color=3D"#000000" size=3D"3"># the same pro=
file multiple times (unless this is your desired behavior).</font></div><di=
v><font color=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000=
000" size=3D"3">#FailoverAttempts =C2=A0 =C2=A0 =C2=A0 1</font></div><div><=
font color=3D"#000000" size=3D"3"><br></font></div><div><font color=3D"#000=
000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3"># Ign=
ored headers: If DSPAM is behind other tools which may add a header to</fon=
t></div><div><font color=3D"#000000" size=3D"3"># incoming emails, it may b=
e beneficial to ignore these headers - especially</font></div><div><font co=
lor=3D"#000000" size=3D"3"># if they are coming from another spam filter. I=
f you are _not_ using one of</font></div><div><font color=3D"#000000" size=
=3D"3"># these tools, however, leaving the appropriate headers commented ou=
t will</font></div><div><font color=3D"#000000" size=3D"3"># allow DSPAM to=
use them as telltale signs of forged email.</font></div><div><font color=
=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"=
3">#IgnoreHeader X-Spam-Status</font></div><div><font color=3D"#000000" siz=
e=3D"3">#IgnoreHeader X-Spam-Scanned</font></div><div><font color=3D"#00000=
0" size=3D"3">#IgnoreHeader X-Virus-Scanner-Result</font></div><div><font c=
olor=3D"#000000" size=3D"3"><br></font></div><div><font color=3D"#000000" s=
ize=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3"># Lookup: P=
erform lookups on streamlined blackhole list servers (see</font></div><div>=
<font color=3D"#000000" size=3D"3"># <a href=3D"http://www.nuclearelephant.=
com/projects/sbl/">http://www.nuclearelephant.com/projects/sbl/</a>). The s=
treamlined blacklist</font></div><div><font color=3D"#000000" size=3D"3"># =
server is machine-automated, unsupervised blacklisting system designed to</=
font></div><div><font color=3D"#000000" size=3D"3"># provide real-time and =
highly accurate blacklisting based on network spread.</font></div><div><fon=
t color=3D"#000000" size=3D"3"># When performing a lookup, DSPAM will autom=
atically learn the inbound message</font></div><div><font color=3D"#000000"=
size=3D"3"># as spam if the source IP is listed. Until an official public =
RABL server is</font></div><div><font color=3D"#000000" size=3D"3"># availa=
ble, this feature is only useful if you are running your own</font></div><d=
iv><font color=3D"#000000" size=3D"3"># streamlined blackhole list server f=
or internal reporting among multiple mail</font></div><div><font color=3D"#=
000000" size=3D"3"># servers. Provide the name of the lookup zone below to =
use.</font></div><div><font color=3D"#000000" size=3D"3">#</font></div><div=
><font color=3D"#000000" size=3D"3"># This function performs standard rever=
se-octet.domain lookups, and while it</font></div><div><font color=3D"#0000=
00" size=3D"3"># will function with many RBLs, it's strongly discourage=
d to use those</font></div><div><font color=3D"#000000" size=3D"3"># mainta=
ined by humans as they're often inaccurate and could hurt filter</font>=
</div><div><font color=3D"#000000" size=3D"3"># learning and accuracy.</fon=
t></div><div><font color=3D"#000000" size=3D"3">#</font></div><div><font co=
lor=3D"#000000" size=3D"3">#Lookup =C2=A0 =C2=A0 =C2=A0 =C2=A0 "<a hre=
f=3D"http://sbl.example.org">sbl.example.org</a>"</font></div><div><fo=
nt color=3D"#000000" size=3D"3"><br></font></div><div><font color=3D"#00000=
0" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3"># RBLIn=
oculate: If you want to inoculate the user from RBL'd messages it would=
</font></div><div><font color=3D"#000000" size=3D"3"># have otherwise misse=
d, set this to on.</font></div><div><font color=3D"#000000" size=3D"3">#</f=
ont></div><div><font color=3D"#000000" size=3D"3">#RBLInoculate =C2=A0 off<=
/font></div><div><font color=3D"#000000" size=3D"3"><br></font></div><div><=
font color=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000=
" size=3D"3"># Notifications: Enable the sending of notification emails to =
users (first</font></div><div><font color=3D"#000000" size=3D"3"># message,=
quarantine full, etc.)</font></div><div><font color=3D"#000000" size=3D"3"=
>#</font></div><div><font color=3D"#000000" size=3D"3">Notifications =C2=A0=
off</font></div><div><font color=3D"#000000" size=3D"3"><br></font></div><=
div><font color=3D"#000000" size=3D"3"># TxtDirectory: the directory that h=
olds the templates for notification</font></div><div><font color=3D"#000000=
" size=3D"3"># messages (see Notifications) and tagging (see tagSpam/tagNon=
spam).</font></div><div><font color=3D"#000000" size=3D"3">#</font></div><d=
iv><font color=3D"#000000" size=3D"3">#TxtDirectory /etc/dspam/txt</font></=
div><div><font color=3D"#000000" size=3D"3"><br></font></div><div><font col=
or=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" size=
=3D"3"># QuarantineWarnSize: You may specify a size when DSPAM should send =
a "Quarantine</font></div><div><font color=3D"#000000" size=3D"3"># Fu=
ll" message to each user. This is only working if you enable notificat=
ions</font></div><div><font color=3D"#000000" size=3D"3"># (see above). Val=
ue is in bytes. Default is 2097152 -> 2MB.</font></div><div><font color=
=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"=
3">#QuarantineWarnSize 2097152</font></div><div><font color=3D"#000000" siz=
e=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3">#</font></=
div><div><font color=3D"#000000" size=3D"3"># Purge configuration: Set dspa=
m_clean purge default options, if not otherwise</font></div><div><font colo=
r=3D"#000000" size=3D"3"># specified on the commandline</font></div><div><f=
ont color=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000"=
size=3D"3">PurgeSignatures 14 =C2=A0 =C2=A0 =C2=A0# Stale signatures</font=
></div><div><font color=3D"#000000" size=3D"3">PurgeNeutral =C2=A0 =C2=A090=
=C2=A0 =C2=A0 =C2=A0# Tokens with neutralish probabilities</font></div><di=
v><font color=3D"#000000" size=3D"3">PurgeUnused =C2=A0 =C2=A0 90 =C2=A0 =
=C2=A0 =C2=A0# Unused tokens</font></div><div><font color=3D"#000000" size=
=3D"3">PurgeHapaxes =C2=A0 =C2=A030 =C2=A0 =C2=A0 =C2=A0# Tokens with less =
than 5 hits (hapaxes)</font></div><div><font color=3D"#000000" size=3D"3">P=
urgeHits1S =C2=A0 =C2=A0 15 =C2=A0 =C2=A0 =C2=A0# Tokens with only 1 spam h=
it</font></div><div><font color=3D"#000000" size=3D"3">PurgeHits1I =C2=A0 =
=C2=A0 15 =C2=A0 =C2=A0 =C2=A0# Tokens with only 1 innocent hit</font></div=
><div><font color=3D"#000000" size=3D"3"><br></font></div><div><font color=
=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"=
3"># Purge configuration for SQL-based installations using purge.sql</font>=
</div><div><font color=3D"#000000" size=3D"3">#</font></div><div><font colo=
r=3D"#000000" size=3D"3">#PurgeSignature off =C2=A0 =C2=A0 # Specified in p=
urge.sql</font></div><div><font color=3D"#000000" size=3D"3">#PurgeNeutral =
=C2=A0 90</font></div><div><font color=3D"#000000" size=3D"3">#PurgeUnused =
=C2=A0 =C2=A0off =C2=A0 =C2=A0 # Specified in purge.sql</font></div><div><f=
ont color=3D"#000000" size=3D"3">#PurgeHapaxes =C2=A0 off =C2=A0 =C2=A0 # S=
pecified in purge.sql</font></div><div><font color=3D"#000000" size=3D"3">#=
PurgeHits1S =C2=A0 =C2=A0off =C2=A0 =C2=A0 # Specified in purge.sql</font><=
/div><div><font color=3D"#000000" size=3D"3">#PurgeHits1I =C2=A0 =C2=A0off =
=C2=A0 =C2=A0 # Specified in purge.sql</font></div><div><font color=3D"#000=
000" size=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3">#<=
/font></div><div><font color=3D"#000000" size=3D"3"># Local Mail Exchangers=
: Used for source address tracking, tells DSPAM which</font></div><div><fon=
t color=3D"#000000" size=3D"3"># mail exchangers are local and therefore sh=
ould be ignored in the Received:</font></div><div><font color=3D"#000000" s=
ize=3D"3"># header when tracking the source of an email. Note: you should u=
se the address</font></div><div><font color=3D"#000000" size=3D"3"># of the=
host as appears between brackets [ ] in the Received header.</font></div><=
div><font color=3D"#000000" size=3D"3"># By default DSPAM is considering th=
e following IPs always as LocalMX:</font></div><div><font color=3D"#000000"=
size=3D"3"># =C2=A0 =C2=A0 =C2=A0 <a href=3D"http://10.0.0.0/8">10.0.0.0/8=
</a> =C2=A0 =C2=A0 =C2=A0- Private IP addresses (RFC 1918)</font></div><div=
><font color=3D"#000000" size=3D"3"># =C2=A0 =C2=A0 =C2=A0 <a href=3D"http:=
//127.0.0.0/8">127.0.0.0/8</a> =C2=A0 =C2=A0 - Localhost Loopback Address (=
RFC 1700)</font></div><div><font color=3D"#000000" size=3D"3"># =C2=A0 =C2=
=A0 =C2=A0 <a href=3D"http://169.254.0.0/16">169.254.0.0/16</a> =C2=A0- Zer=
oconf / APIPA (RFC 3330)</font></div><div><font color=3D"#000000" size=3D"3=
"># =C2=A0 =C2=A0 =C2=A0 <a href=3D"http://172.16.0.0/12">172.16.0.0/12</a>=
=C2=A0 - Private IP addresses (RFC 1918)</font></div><div><font color=3D"#=
000000" size=3D"3"># =C2=A0 =C2=A0 =C2=A0 <a href=3D"http://192.168.0.0/16"=
>192.168.0.0/16</a> =C2=A0- Private IP addresses (RFC 1918)</font></div><di=
v><font color=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000=
000" size=3D"3">LocalMX 127.0.0.1</font></div><div><font color=3D"#000000" =
size=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3">#</font=
></div><div><font color=3D"#000000" size=3D"3"># Logging: Disabling logging=
for users will make usage graphs unavailable to</font></div><div><font col=
or=3D"#000000" size=3D"3"># them. Disabling system logging will make admin =
graphs unavailable.</font></div><div><font color=3D"#000000" size=3D"3">#</=
font></div><div><font color=3D"#000000" size=3D"3">SystemLog =C2=A0 =C2=A0 =
=C2=A0 on</font></div><div><font color=3D"#000000" size=3D"3">UserLog =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 on</font></div><div><font color=3D"#000000" size=
=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3">#</font></d=
iv><div><font color=3D"#000000" size=3D"3"># TrainPristine: for systems whe=
re the original message remains server side</font></div><div><font color=3D=
"#000000" size=3D"3"># and can therefore be presented in pristine format fo=
r retraining. This option</font></div><div><font color=3D"#000000" size=3D"=
3"># will cause DSPAM to cease all writing of signatures and DSPAM headers =
to the</font></div><div><font color=3D"#000000" size=3D"3"># message, and d=
eliver the message in as pristine format as possible. This mode</font></div=
><div><font color=3D"#000000" size=3D"3"># REQUIRES that the original messa=
ge in its pristine format (as of delivery)</font></div><div><font color=3D"=
#000000" size=3D"3"># be presented for retraining, as in the case of webmai=
l, imap, or other</font></div><div><font color=3D"#000000" size=3D"3"># app=
lications where the message is actually kept server-side during reading,</f=
ont></div><div><font color=3D"#000000" size=3D"3"># and is preserved. DO NO=
T use this switch unless the original message can be</font></div><div><font=
color=3D"#000000" size=3D"3"># presented for retraining with the ORIGINAL =
HEADERS and NO MODIFICATIONS.</font></div><div><font color=3D"#000000" size=
=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3"># NOTE: You ca=
n't use this setting with dspam_trian; if you're going to use it,</=
font></div><div><font color=3D"#000000" size=3D"3"># =C2=A0 =C2=A0 =C2=A0 w=
ait until after you train any corpora.</font></div><div><font color=3D"#000=
000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3">#Trai=
nPristine on</font></div><div><font color=3D"#000000" size=3D"3"><br></font=
></div><div><font color=3D"#000000" size=3D"3">#</font></div><div><font col=
or=3D"#000000" size=3D"3"># Opt: in or out; determines DSPAM's default =
filtering behavior. If this value</font></div><div><font color=3D"#000000" =
size=3D"3"># is set to in, users must opt-in to filtering by dropping a .ds=
pam file in</font></div><div><font color=3D"#000000" size=3D"3"># /var/dspa=
m/opt-in/user.dspam (or if you have homedirs configured, a .dspam</font></d=
iv><div><font color=3D"#000000" size=3D"3"># folder in their home directory=
).=C2=A0 The default is opt-out, which means all</font></div><div><font col=
or=3D"#000000" size=3D"3"># users will be filtered unless a .nodspam file i=
s dropped in</font></div><div><font color=3D"#000000" size=3D"3"># /var/dsp=
am/opt-out/user.nodspam</font></div><div><font color=3D"#000000" size=3D"3"=
>#</font></div><div><font color=3D"#000000" size=3D"3">Opt out</font></div>=
<div><font color=3D"#000000" size=3D"3"><br></font></div><div><font color=
=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"=
3"># TrackSources: specify which (if any) source addresses to track and rep=
ort</font></div><div><font color=3D"#000000" size=3D"3"># them to syslog (<=
a href=3D"http://mail.info">mail.info</a>). This is useful if you're ru=
nning a firewall or</font></div><div><font color=3D"#000000" size=3D"3"># b=
lacklist and would like to use this information. Spam reporting also drops<=
/font></div><div><font color=3D"#000000" size=3D"3"># RABL blacklist files =
(see <a href=3D"http://www.nuclearelephant.com/projects/rabl/">http://www.n=
uclearelephant.com/projects/rabl/</a>).</font></div><div><font color=3D"#00=
0000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3">#Tra=
ckSources spam nonspam virus</font></div><div><font color=3D"#000000" size=
=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3">#</font></d=
iv><div><font color=3D"#000000" size=3D"3"># ParseToHeaders: In lieu of set=
ting up individual aliases for each user,</font></div><div><font color=3D"#=
000000" size=3D"3"># DSPAM can be configured to automatically parse the To:=
address for spam and</font></div><div><font color=3D"#000000" size=3D"3">#=
false positive forwards. From there, it can be configured to either set th=
e</font></div><div><font color=3D"#000000" size=3D"3"># DSPAM user based on=
the username specified in the header and/or change the</font></div><div><f=
ont color=3D"#000000" size=3D"3"># training class and source accordingly. T=
he options below can be used to</font></div><div><font color=3D"#000000" si=
ze=3D"3"># customize most common types of header parsing behavior to avoid =
the need for</font></div><div><font color=3D"#000000" size=3D"3"># multiple=
aliases, or if using LMTP, aliases entirely..</font></div><div><font color=
=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"=
3"># ParseToHeader: Parse the To: headers of an incoming message. This must=
be</font></div><div><font color=3D"#000000" size=3D"3"># =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0set to 'on' to use either of =
the following features.</font></div><div><font color=3D"#000000" size=3D"3"=
>#</font></div><div><font color=3D"#000000" size=3D"3"># ChangeModeOnParse:=
Automatically change the class (to spam or innocent)</font></div><div><fon=
t color=3D"#000000" size=3D"3"># =C2=A0 depending on whether spam- or notsp=
am- was specified, and change the source</font></div><div><font color=3D"#0=
00000" size=3D"3"># =C2=A0 to 'error'. This is convenient if you=
9;re not using aliases at all, but</font></div><div><font color=3D"#000000"=
size=3D"3"># =C2=A0 are delivering via LMTP.</font></div><div><font color=
=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"=
3"># ChangeUserOnParse: Automatically change the username to match that spe=
cified</font></div><div><font color=3D"#000000" size=3D"3"># =C2=A0 in the =
To: header. For example, <a href=3D"mailto:[email protected]">spam-bob@e=
xample.org</a> will set the username</font></div><div><font color=3D"#00000=
0" size=3D"3"># =C2=A0 to bob, ignoring any --user passed in. This may not =
always be desirable if</font></div><div><font color=3D"#000000" size=3D"3">=
# =C2=A0 you are using virtual email addresses as usernames. Options:</font=
></div><div><font color=3D"#000000" size=3D"3"># =C2=A0 =C2=A0 on or user =
=C2=A0 =C2=A0 =C2=A0 =C2=A0take the portion before the @ sign only</font></=
div><div><font color=3D"#000000" size=3D"3"># =C2=A0 =C2=A0 full =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0take everything after the initial {sp=
am,notspam}-.</font></div><div><font color=3D"#000000" size=3D"3">#</font><=
/div><div><font color=3D"#000000" size=3D"3">ParseToHeaders on</font></div>=
<div><font color=3D"#000000" size=3D"3">ChangeModeOnParse on</font></div><d=
iv><font color=3D"#000000" size=3D"3">#ChangeUserOnParse on</font></div><di=
v><font color=3D"#000000" size=3D"3">ChangeUserOnParse full</font></div><di=
v><font color=3D"#000000" size=3D"3"><br></font></div><div><font color=3D"#=
000000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3"># =
Broken MTA Options: Some MTAs don't support the proper functionality</f=
ont></div><div><font color=3D"#000000" size=3D"3"># necessary. In these cas=
es you can activate certain features in DSPAM to</font></div><div><font col=
or=3D"#000000" size=3D"3"># compensate. 'returnCodes' causes DSPAM =
to return an exit code of 99 if</font></div><div><font color=3D"#000000" si=
ze=3D"3"># the message is spam, 0 if not, or a negative code if an error ha=
s occured.</font></div><div><font color=3D"#000000" size=3D"3"># Specifying=
'case' causes DSPAM to force the input usernames to lowercase.</fo=
nt></div><div><font color=3D"#000000" size=3D"3"># Specifying 'lineStri=
pping' causes DSPAM to strip ^M's from messages passed</font></div>=
<div><font color=3D"#000000" size=3D"3"># in.</font></div><div><font color=
=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"=
3">#Broken returnCodes</font></div><div><font color=3D"#000000" size=3D"3">=
#Broken case</font></div><div><font color=3D"#000000" size=3D"3">#Broken li=
neStripping</font></div><div><font color=3D"#000000" size=3D"3"><br></font>=
</div><div><font color=3D"#000000" size=3D"3">#</font></div><div><font colo=
r=3D"#000000" size=3D"3"># MaxMessageSize: You may specify a maximum messag=
e size for DSPAM to process.</font></div><div><font color=3D"#000000" size=
=3D"3"># If the message is larger than the maximum size, it will be deliver=
ed</font></div><div><font color=3D"#000000" size=3D"3"># without processing=
. Value is in bytes.</font></div><div><font color=3D"#000000" size=3D"3">#<=
/font></div><div><font color=3D"#000000" size=3D"3">#MaxMessageSize 4194304=
</font></div><div><font color=3D"#000000" size=3D"3"><br></font></div><div>=
<font color=3D"#000000" size=3D"3"># --- ClamAV ---</font></div><div><font =
color=3D"#000000" size=3D"3"><br></font></div><div><font color=3D"#000000" =
size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3"># Virus Ch=
ecking: If you are running clamd, DSPAM can perform stream-based</font></di=
v><div><font color=3D"#000000" size=3D"3"># virus checking using TCP. Uncom=
ment the values below to enable virus</font></div><div><font color=3D"#0000=
00" size=3D"3"># checking.</font></div><div><font color=3D"#000000" size=3D=
"3">#</font></div><div><font color=3D"#000000" size=3D"3"># ClamAVResponse:=
reject (reject or drop the message with a permanent failure)</font></div><=
div><font color=3D"#000000" size=3D"3"># =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=
=C2=A0 =C2=A0 =C2=A0 accept (accept the message and quietly drop the messa=
ge)</font></div><div><font color=3D"#000000" size=3D"3"># =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 spam =C2=A0 (treat as spam and quara=
ntine/tag/whatever)</font></div><div><font color=3D"#000000" size=3D"3">#</=
font></div><div><font color=3D"#000000" size=3D"3">#ClamAVPort =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 3310</font></div><div><font color=3D"#00000=
0" size=3D"3">#ClamAVHost =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 127.0.0=
.1</font></div><div><font color=3D"#000000" size=3D"3">#ClamAVResponse =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 accept</font></div><div><font color=3D"#000000" si=
ze=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3"># --- CLI=
ENT / SERVER ---</font></div><div><font color=3D"#000000" size=3D"3"><br></=
font></div><div><font color=3D"#000000" size=3D"3">#</font></div><div><font=
color=3D"#000000" size=3D"3"># Daemonized Server: If you are running DSPAM=
as a daemonized server using</font></div><div><font color=3D"#000000" size=
=3D"3"># --daemon, the following parameters will override the default. Use =
the</font></div><div><font color=3D"#000000" size=3D"3"># ServerPass option=
to set up accounts for each client machine. The DSPAM</font></div><div><fo=
nt color=3D"#000000" size=3D"3"># server will process and deliver the messa=
ge based on the parameters</font></div><div><font color=3D"#000000" size=3D=
"3"># specified. If you want the client machine to perform delivery, use</f=
ont></div><div><font color=3D"#000000" size=3D"3"># the --stdout option in =
conjunction with a local setup.</font></div><div><font color=3D"#000000" si=
ze=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3"># ServerHost=
: Not enabling ServerHost will bind DSPAM server to all available</font></d=
iv><div><font color=3D"#000000" size=3D"3"># interfaces.</font></div><div><=
font color=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000=
" size=3D"3"># ServerPort: Default upstream configuration is to run dspam d=
aemon on port</font></div><div><font color=3D"#000000" size=3D"3"># 24. On =
Debian, dspam being run as a unprivileged user, default port is</font></div=
><div><font color=3D"#000000" size=3D"3"># set to 2424.</font></div><div><f=
ont color=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000"=
size=3D"3">#ServerHost =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 127.0.0.1=
</font></div><div><font color=3D"#000000" size=3D"3">#ServerPort =C2=A0 =C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 2424</font></div><div><font color=3D"#00000=
0" size=3D"3">#ServerQueueSize =C2=A0 =C2=A0 =C2=A0 =C2=A032</font></div><d=
iv><font color=3D"#000000" size=3D"3">ServerPID =C2=A0 =C2=A0 =C2=A0 =C2=A0=
=C2=A0 =C2=A0 =C2=A0 /var/run/dspam/dspam.pid</font></div><div><font color=
=3D"#000000" size=3D"3"><br></font></div><div><font color=3D"#000000" size=
=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3"># ServerMode s=
pecifies the type of LMTP server to start. This can be one of:</font></div>=
<div><font color=3D"#000000" size=3D"3"># =C2=A0 =C2=A0 dspam: DSPAM-propri=
etary DLMTP server, for communicating with dspamc</font></div><div><font co=
lor=3D"#000000" size=3D"3"># =C2=A0standard: Standard LMTP server, for comm=
unicating with Postfix or other MTA</font></div><div><font color=3D"#000000=
" size=3D"3"># =C2=A0 =C2=A0 =C2=A0auto: Speak both DLMTP and LMTP; auto-de=
tect by ServerPass.IDENT</font></div><div><font color=3D"#000000" size=3D"3=
">#</font></div><div><font color=3D"#000000" size=3D"3">#ServerMode dspam</=
font></div><div><font color=3D"#000000" size=3D"3">ServerMode auto</font></=
div><div><font color=3D"#000000" size=3D"3"><br></font></div><div><font col=
or=3D"#000000" size=3D"3"># If supporting DLMTP (dspam) mode, dspam clients=
will require authentication</font></div><div><font color=3D"#000000" size=
=3D"3"># as they will be passing in parameters. The idents below will be us=
ed to</font></div><div><font color=3D"#000000" size=3D"3"># determine which=
clients will be speaking DLMTP, so if you will be using</font></div><div><=
font color=3D"#000000" size=3D"3"># both LMTP and DLMTP from the same host,=
be sure to use something other</font></div><div><font color=3D"#000000" si=
ze=3D"3"># than the server's hostname below (which will be sent by the =
MTA during a</font></div><div><font color=3D"#000000" size=3D"3"># standard=
LMTP LHLO).</font></div><div><font color=3D"#000000" size=3D"3">#</font></=
div><div><font color=3D"#000000" size=3D"3">#ServerPass.Relay1 =C2=A0 =C2=
=A0 =C2=A0"secret"</font></div><div><font color=3D"#000000" size=
=3D"3">#ServerPass.Relay2 =C2=A0 =C2=A0 =C2=A0"password"</font></=
div><div><font color=3D"#000000" size=3D"3"><br></font></div><div><font col=
or=3D"#000000" size=3D"3"># If supporting standard LMTP mode, server parame=
ters will need to be specified</font></div><div><font color=3D"#000000" siz=
e=3D"3"># here, as they will not be passed in by the mail server. The Serve=
rIdent</font></div><div><font color=3D"#000000" size=3D"3"># specifies the =
250 response code ident sent back to connecting clients and</font></div><di=
v><font color=3D"#000000" size=3D"3"># should be set to the hostname of you=
r server, or an alias.</font></div><div><font color=3D"#000000" size=3D"3">=
#</font></div><div><font color=3D"#000000" size=3D"3"># NOTE: If you specif=
y --user in ServerParameters, the RCPT TO will be</font></div><div><font co=
lor=3D"#000000" size=3D"3"># =C2=A0 =C2=A0 =C2=A0 used only for delivery, a=
nd not set as the active user for processing.</font></div><div><font color=
=3D"#000000" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"=
3">#ServerParameters =C2=A0 =C2=A0 =C2=A0 "--deliver=3Dinnocent -d %u&=
quot;</font></div><div><font color=3D"#000000" size=3D"3">ServerParameters =
=C2=A0 =C2=A0 =C2=A0 =C2=A0"--deliver=3Dinnocent"</font></div><di=
v><font color=3D"#000000" size=3D"3">#ServerIdent =C2=A0 =C2=A0 =C2=A0 =C2=
=A0 =C2=A0 =C2=A0"localhost.localdomain"</font></div><div><font c=
olor=3D"#000000" size=3D"3">ServerIdent =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 "<a href=3D"http://localhost.xm23.net">localhost.xm23.net</a>&q=
uot;</font></div><div><font color=3D"#000000" size=3D"3"><br></font></div><=
div><font color=3D"#000000" size=3D"3"># If you wish to use a local domain =
socket instead of a TCP socket, uncomment</font></div><div><font color=3D"#=
000000" size=3D"3"># the following. It is strongly recommended you use loca=
l domain sockets if</font></div><div><font color=3D"#000000" size=3D"3"># y=
ou are running the client and server on the same machine, as it eliminates<=
/font></div><div><font color=3D"#000000" size=3D"3"># much of the bandwidth=
overhead.</font></div><div><font color=3D"#000000" size=3D"3">#</font></di=
v><div><font color=3D"#000000" size=3D"3">#ServerDomainSocketPath "/va=
r/run/dspam/dspam.sock"</font></div><div><font color=3D"#000000" size=
=3D"3">ServerDomainSocketPath =C2=A0"/var/spool/postfix/tmp/dspam.sock=
"</font></div><div><font color=3D"#000000" size=3D"3"><br></font></div=
><div><font color=3D"#000000" size=3D"3">#</font></div><div><font color=3D"=
#000000" size=3D"3"># Client Mode: If you are running DSPAM in client/serve=
r mode, uncomment and</font></div><div><font color=3D"#000000" size=3D"3">#=
set these variables. A ClientHost beginning with a / will be treated as</f=
ont></div><div><font color=3D"#000000" size=3D"3"># a domain socket.</font>=
</div><div><font color=3D"#000000" size=3D"3">#</font></div><div><font colo=
r=3D"#000000" size=3D"3">#ClientHost =C2=A0 =C2=A0 /var/run/dspam/dspam.soc=
k</font></div><div><font color=3D"#000000" size=3D"3">#ClientIdent =C2=A0 =
=C2=A0"secret@Relay1"</font></div><div><font color=3D"#000000" si=
ze=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3">#ClientHost =
=C2=A0 =C2=A0 127.0.0.1</font></div><div><font color=3D"#000000" size=3D"3"=
>#ClientPort =C2=A0 =C2=A0 2424</font></div><div><font color=3D"#000000" si=
ze=3D"3">#ClientIdent =C2=A0 =C2=A0"secret@Relay1"</font></div><d=
iv><font color=3D"#000000" size=3D"3"><br></font></div><div><font color=3D"=
#000000" size=3D"3"># --- RABL ---</font></div><div><font color=3D"#000000"=
size=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3"># RABL=
Queue: Touch files in the RABL queue</font></div><div><font color=3D"#00000=
0" size=3D"3"># If you are a reporting streamlined blackhole list participa=
nt, you can</font></div><div><font color=3D"#000000" size=3D"3"># touch ip =
addresses within the directory the rabl_client process is watching.</font><=
/div><div><font color=3D"#000000" size=3D"3">#</font></div><div><font color=
=3D"#000000" size=3D"3">#RABLQueue =C2=A0 =C2=A0 =C2=A0/var/spool/rabl</fon=
t></div><div><font color=3D"#000000" size=3D"3"><br></font></div><div><font=
color=3D"#000000" size=3D"3"># --- =C2=A0---</font></div><div><font color=
=3D"#000000" size=3D"3"><br></font></div><div><font color=3D"#000000" size=
=3D"3"># DataSource: If you are using any type of data source that does not=
include</font></div><div><font color=3D"#000000" size=3D"3"># email-like h=
eaders (such as documents), uncomment the line below. This</font></div><div=
><font color=3D"#000000" size=3D"3"># will cause the entire input to be tre=
ated like a message "body"</font></div><div><font color=3D"#00000=
0" size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3">#DataSo=
urce document</font></div><div><font color=3D"#000000" size=3D"3"><br></fon=
t></div><div><font color=3D"#000000" size=3D"3"># ProcessorWordFrequency: B=
y default, words are only counted once per message.</font></div><div><font =
color=3D"#000000" size=3D"3"># If you are classifying large documents, howe=
ver, you may wish to count once</font></div><div><font color=3D"#000000" si=
ze=3D"3"># per occurrence instead.</font></div><div><font color=3D"#000000"=
size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3">#Processo=
rWordFrequency occurrence</font></div><div><font color=3D"#000000" size=3D"=
3"><br></font></div><div><font color=3D"#000000" size=3D"3"># ProcessorURLC=
ontext: By default, a URL context is generated for URLs, which</font></div>=
<div><font color=3D"#000000" size=3D"3"># records their tokens as separate =
from words found in documents. To use</font></div><div><font color=3D"#0000=
00" size=3D"3"># URL tokens in the same context as words, turn this feature=
off.</font></div><div><font color=3D"#000000" size=3D"3">#</font></div><di=
v><font color=3D"#000000" size=3D"3">ProcessorURLContext on</font></div><di=
v><font color=3D"#000000" size=3D"3"><br></font></div><div><font color=3D"#=
000000" size=3D"3"># ProcessorBias: Bias causes the filter to lean more tow=
ard 'innocent', and</font></div><div><font color=3D"#000000" size=
=3D"3"># usually greatly reduces false positives. It is the default behavio=
r of</font></div><div><font color=3D"#000000" size=3D"3"># most Bayesian fi=
lters (including dspam).</font></div><div><font color=3D"#000000" size=3D"3=
">#</font></div><div><font color=3D"#000000" size=3D"3"># NOTE: You probabl=
y DONT want this if you're using Markovian Weighting, unless</font></di=
v><div><font color=3D"#000000" size=3D"3"># you are paranoid about false po=
sitives.</font></div><div><font color=3D"#000000" size=3D"3">#</font></div>=
<div><font color=3D"#000000" size=3D"3">ProcessorBias on</font></div><div><=
font color=3D"#000000" size=3D"3"><br></font></div><div><font color=3D"#000=
000" size=3D"3"># StripRcptDomain: Cut the domain (including the at sign) f=
rom recipients.</font></div><div><font color=3D"#000000" size=3D"3"># This =
is particularly useful if the recipient name is equal to real user</font></=
div><div><font color=3D"#000000" size=3D"3"># accounts as recipients with d=
omains tend to cause permission issues with</font></div><div><font color=3D=
"#000000" size=3D"3"># dspam-web.</font></div><div><font color=3D"#000000" =
size=3D"3">#</font></div><div><font color=3D"#000000" size=3D"3">StripRcptD=
omain off</font></div><div><font color=3D"#000000" size=3D"3"><br></font></=
div><div><font color=3D"#000000" size=3D"3"># GroupConfig: The configuratio=
n file for groups. See the README file</font></div><div><font color=3D"#000=
000" size=3D"3"># for details on how to enable users to combine their train=
ing data to</font></div><div><font color=3D"#000000" size=3D"3"># get bette=
r results.</font></div><div><font color=3D"#000000" size=3D"3">GroupConfig =
/var/spool/dspam/group</font></div><div><font color=3D"#000000" size=3D"3">=
<br></font></div><div><font color=3D"#000000" size=3D"3"># --- Split Config=
uration File Support ---</font></div><div><font color=3D"#000000" size=3D"3=
"><br></font></div><div><font color=3D"#000000" size=3D"3"># Include a dire=
ctory with configuration items.</font></div><div><font color=3D"#000000" si=
ze=3D"3">Include /etc/dspam/dspam.d/</font></div><div><font color=3D"#00000=
0" size=3D"3"><br></font></div><div><font color=3D"#000000" size=3D"3"># --=
- =C2=A0---</font></div><div><font color=3D"#000000" size=3D"3"><br></font>=
</div><div><font color=3D"#000000" size=3D"3">IgnoreHeader Accept-Language<=
/font></div><div><font color=3D"#000000" size=3D"3">IgnoreHeader Authentica=
tion-Results</font></div><div><font color=3D"#000000" size=3D"3">IgnoreHead=
er Content-Type</font></div><div><font color=3D"#000000" size=3D"3">IgnoreH=
eader DKIM-Signature</font></div><div><font color=3D"#000000" size=3D"3">Ig=
noreHeader Date</font></div><div><font color=3D"#000000" size=3D"3">IgnoreH=
eader DomainKey-Signature</font></div><div><font color=3D"#000000" size=3D"=
3">IgnoreHeader Importance</font></div><div><font color=3D"#000000" size=3D=
"3">IgnoreHeader In-Reply-To</font></div><div><font color=3D"#000000" size=
=3D"3">IgnoreHeader List-Archive</font></div><div><font color=3D"#000000" s=
ize=3D"3">IgnoreHeader List-Help</font></div><div><font color=3D"#000000" s=
ize=3D"3">IgnoreHeader List-Id</font></div><div><font color=3D"#000000" siz=
e=3D"3">IgnoreHeader List-Post</font></div><div><font color=3D"#000000" siz=
e=3D"3">IgnoreHeader List-Subscribe</font></div><div><font color=3D"#000000=
" size=3D"3">IgnoreHeader List-Unsubscribe</font></div><div><font color=3D"=
#000000" size=3D"3">IgnoreHeader Message-ID</font></div><div><font color=3D=
"#000000" size=3D"3">IgnoreHeader Message-Id</font></div><div><font color=
=3D"#000000" size=3D"3">IgnoreHeader Organization</font></div><div><font co=
lor=3D"#000000" size=3D"3">IgnoreHeader Received</font></div><div><font col=
or=3D"#000000" size=3D"3">IgnoreHeader Received-SPF</font></div><div><font =
color=3D"#000000" size=3D"3">IgnoreHeader References</font></div><div><font=
color=3D"#000000" size=3D"3">IgnoreHeader Reply-To</font></div><div><font =
color=3D"#000000" size=3D"3">IgnoreHeader Resent-Date</font></div><div><fon=
t color=3D"#000000" size=3D"3">IgnoreHeader Resent-From</font></div><div><f=
ont color=3D"#000000" size=3D"3">IgnoreHeader Thread-Index</font></div><div=
><font color=3D"#000000" size=3D"3">IgnoreHeader Thread-Topic</font></div><=
div><font color=3D"#000000" size=3D"3">IgnoreHeader User-Agent</font></div>=
<div><font color=3D"#000000" size=3D"3">IgnoreHeader X-policyd-weight</font=
></div><div><font color=3D"#000000" size=3D"3">IgnoreHeader thread-index</f=
ont></div><div style=3D"color:rgb(0,0,0);font-family:"times new roman&=
quot;;font-size:medium"><br></div></tt></div></div>
--001a11401bfe254500053b8b8e53--
--===============9127622846156426149==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
------------------------------------------------------------------------------
--===============9127622846156426149==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Dspam-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/dspam-user
--===============9127622846156426149==--