Reclassify --error "OK" with "properly" classified mail?

Jeff Kletsky <[email protected]> Fri, 18 Nov 2016 13:14:39 -0800
Newsgroups gmane.mail.spam.dspam.user
Message-ID <[email protected]> 
This is a multi-part message in MIME format.
--===============8965608189997139277==
Content-Type: multipart/alternative;
	boundary="------------399A3729B7480C93B8AA776E"

This is a multi-part message in MIME format.
--------------399A3729B7480C93B8AA776E
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit

Over the years I've ended up with some email addresses that are heavily 
spammed and no longer in use.

I'd like to take advantage of them as a honeypot for inoculation, with 
the knowledge that they only receive spam.

I run Postfix and use dspam as a post-queue filter, as described at 
http://www.postfix.org/FILTER_README.html#advanced_filter

As a result, all mail gets classified/before /I know the final 
recipient, as local aliases haven't been evaluated yet.

I'd like to "deliver" mail for these destinations by routing all of it 
through something like

         | dspam --client --user <user> --source=error --class=spam

without having to first determine if it was improperly classified as 
non-spam.

Reading DSPAM(1) reveals

     You should use error only when DSPAM has made an error in clas-
     sifying  the message, and should present the modified version of
     the message with the DSPAM signature when doing so.

Does this mean that if the message was originally classified as spam 
that the token and message counts
are "blindly" incremented each time it is called,
or does dspam check to see the classification of the message ID before 
incrementing the counts?

As easy as it would be to grep for 'X-DSPAM-Result: Innocent', it starts 
getting messy
since I also either need the full message or the signature (another grep 
pass) to pass to dspam.


If I can't just feed the message into the reclassify dspam call, are 
there any "elegant" approaches to this?


Thanks!


Jeff



--------------399A3729B7480C93B8AA776E
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<html>
  <head>

    <meta http-equiv=3D"content-type" content=3D"text/html; charset=3Dutf=
-8">
  </head>
  <body bgcolor=3D"#FFFFFF" text=3D"#000000">
    <p>Over the years I've ended up with some email addresses that are
      heavily spammed and no longer in use.</p>
    <p>I'd like to take advantage of them as a honeypot for inoculation,
      with the knowledge that they only receive spam.</p>
    <p>I run Postfix and use dspam as a post-queue filter, as described
      at <a class=3D"moz-txt-link-freetext" href=3D"http://www.postfix.or=
g/FILTER_README.html#advanced_filter">http://www.postfix.org/FILTER_READM=
E.html#advanced_filter</a></p>
    <p>As a result, all mail gets classified<i> before </i>I know the
      final recipient, as local aliases haven't been evaluated yet.</p>
    <p>I'd like to "deliver" mail for these destinations by routing all
      of it through something like</p>
    <p>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 | dspam --client --user=
 &lt;user&gt; --source=3Derror
      --class=3Dspam<br>
    </p>
    <p>without having to first determine if it was improperly classified
      as non-spam.</p>
    <p>Reading DSPAM(1) reveals</p>
    <p>=C2=A0=C2=A0=C2=A0 You should use error only when DSPAM has made a=
n error in=C2=A0
      clas-<br>
      =C2=A0=C2=A0=C2=A0 sifying=C2=A0 the message, and should present th=
e modified version
      of<br>
      =C2=A0=C2=A0=C2=A0 the message with the DSPAM signature when doing =
so.</p>
    <p>Does this mean that if the message was originally classified as
      spam that the token and message counts<br>
      are "blindly" incremented each time it is called, <br>
      or does dspam check to see the classification of the message ID
      before incrementing the counts?</p>
    <p>As easy as it would be to grep for 'X-DSPAM-Result: Innocent', it
      starts getting messy <br>
      since I also either need the full message or the signature
      (another grep pass) to pass to dspam.</p>
    <p><br>
    </p>
    <p>If I can't just feed the message into the reclassify dspam call,
      are there any "elegant" approaches to this?<br>
    </p>
    <p><br>
    </p>
    <p>Thanks!</p>
    <p><br>
    </p>
    <p>Jeff</p>
    <p><br>
    </p>
  </body>
</html>

--------------399A3729B7480C93B8AA776E--


--===============8965608189997139277==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------

--===============8965608189997139277==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Dspam-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/dspam-user

--===============8965608189997139277==--