Page 1 of 1

[solved] Using an intermediate mail provider messes up my spamassassin scores

Posted: 14 Nov 2017 07:01
by pdwalker
Ok, I've a problem that I wonder if someone can help me solve.

I use an intermediate mail service that scans all my incoming mail for viruses (messagelabs.com). However one problem I have is that all mail, according to spamassassin, comes from them.

For example, take a recent message:
Screen Shot 2017-11-14 at 14.51.png
Screen Shot 2017-11-14 at 14.51.png (80.97 KiB) Viewed 2315 times
Here's an annoying spam that the bayes classifier got right (I've added extra weighting to bayes since it does such a good job), but that the RCVD_IN_DNSWL_MED got wrong.

Here is the received path:
Screen Shot 2017-11-14 at 14.53 1.png
Screen Shot 2017-11-14 at 14.53 1.png (27.19 KiB) Viewed 2315 times
The last two addresses are legitimate, but the first "received via" is the true culprit.

What I would like is for somehow to tell spamassassin to ignore any of the messagelabs addresses for the RBL checks.

Is there a simple way to do this? I don't just want to whitelist the addresses as I do get legitimate spam (heh!) from these addresses as I want to accept all spam and let EFA decide if it is really spam or not.

Any thoughts, hints or suggestions would be greatly appreciated.

Re: Using an intermediate mail provider messes up my spamassassin scores

Posted: 14 Nov 2017 07:25
by pdwalker
Sometimes, to ask the question is to find the answer to that question.

Spamassassin does support this functionality through the use of the "trusted_networks" parameter in the /etc/mail/spamassassin/local.cf file.

Adding in the messagelabs ip network ranges into this file causes their addresses to be ignored in the rbl checks.

Wunderbar!

References: