[Rspamd-Users] mark spam in subject, any side effects?

[lutz.niederer at gmx.net]

Hi,

four differs from two in the way that it is about mails that were not classified as spam by rspamd.  When moving these mails (false negatives) into the spam folder because a human said they are spam (sieve giving the mails to rspamd for learning), they will be added a subject prefix of [SPAM score] by sieve.  The question is if this addition would be a problem.  But if you say that adding [SPAM xx] to the subject will generally be no problem for rspam's engine, then I don't care and just add it.  I was not sure if rspamd would learn "many mails that have [SPAM xx] in front of the subject are spam", what is no criterion that one should learn.

Cheers!
-lutzn


> Gesendet: Samstag, 13. August 2022 um 13:19 Uhr
> Von: "Paul Zillmann" <paul at zil.li>
> An: "User questions" <users at lists.rspamd.com>, lutz.niederer at gmx.net
> Betreff: Re: [Rspamd-Users] mark spam in subject, any side effects?
>
> Hello Lutz,
>
> have you checked to documentation and FAQ?
> A lot of your questions are answered there.
>
> Am 13.08.22 um 12:10 schrieb lutz.niederer at gmx.net:
> > Hi,
> >
> > just moving to rspamd and everything is new.  I have to say that I still have many problems with the config paradigm, structure, variables, etc.
> >
> > I would like to implement our spam filtering in a way that modifies the subject line for mails that exceed a specific first spam threshold.
> > We need the subject line because we use a unified inbox.  Beyond a second (pretty high) threshold, spam mail should simply be discarded silently.
> > We are using postfix milter.
> >
> > First question is, how do I implement these two thresholds and the actions?  To be honest I currently have no clue.
>
> Take a look here: [1]
>
> > Second.  If we add the tag to the subject, does this have any impact on learning spam?  Does rspamd know and remember that it added the [SPAM xx] itself?
> > The prefix to the subject should look like this:   [SPAM score]    like    [SPAM 8.0]
> > Below eg 4.0 it should not add any prefix to the subject, but still add the score to another header (see 3.).
>
> Well, [SPAM is a small term that would be ignored. It's the same with
> common letters.
> My spam mails use the letter e a lot - therefor any mail with the letter
> e used a lot is spam?
> Obviously not.
>
> > Third.  We need to add a header with the score as number, like X-Spam-Value: 4.0
>
> Since you use the milter protocol, you should look here: [2]
>
> > Fourth.  If we found the mail as false negative we would use sieve to not only notify rspamd and move to the spam folder but to also modify the subject line to mark the mail visibly as spam (unified inbox).  In that case rspamd will learn that this mail is spam, where rspamd though it is no spam.  But what about the addition of the [SPAM xx]?  Will it learn that spam mails will have [SPAM xx]?  This would not be true.  How could this be managed?
> > This case is different from rspamd detected mail as spam, added the header itself and we filtered it to spam folder.  If we see it is not spam, [SPAM xx] will be deleted, means subject line will be deleted and newly added to the end by sieve.  If one decides that it should be spam, [SPAM xx] will be added again, rspamd will be notified and mail gets moved to spam again.  I believe this would work.  But the question is, what happens to mails that sieve marks as spam afterwards by adding the tag to the subject if rspamd has seen this mail as not being spam.
>
> How does the question differ from #2?
>
> >
> > I thank you very much!
> > -lutzn
> >
> >
> >
>
> 1: https://rspamd.com/doc/faq.html#what-are-rspamd-actions
> 2: https://rspamd.com/doc/modules/milter_headers.html
>
> Sincerely,
> Paul
>