Byteplant Forum

Home » CleanMail Support » CleanMail SpamAssassin Filter » Learning ham
Learning ham [message #450] Tue, 05 September 2006 20:21
mtoth
Messages: 2
Registered: September 2006
Junior Member

I'm currently evaluating NoSpamToday! server.

I think the configuration GUI i very good but I canīt find any good information regarding ham (non SPAM).

I have configured a honeypot for ham. I've entered "advanced mode" in the honeypot configuration and entered "sa\sa-learn.exe -c "%CONFIGPATH%" --ham %IN%" in the command line. The email address assosiated with this honeypot is then used by me to send in ham marked as SPAM. Is this the correct way to do it?

One more question, the mails I send to this honeypot are "full mails" with all the header information included in the "body" of the mail. The mails are however sent from my personal email adress. Is that an ok way to do it?
Re: Learning ham [message #451 is a reply to message #450] Wed, 06 September 2006 13:13 Go to previous message
support
Messages: 919
Registered: April 2004
Senior Member
> I have configured a honeypot for ham. I've entered "advanced
> mode" in the honeypot configuration and entered
> "sa\sa-learn.exe -c "%CONFIGPATH%" --ham %IN%" in the command
> line. The email address assosiated with this honeypot is then
> used by me to send in ham marked as SPAM. Is this the correct
> way to do it?

If you are sure that
1) the mail address is not reachable from the Internet
2) your users only submit ham messages to this account
3) your mail client (and server) that does not modify the message at all
it might work. However, it will be difficult to meet criteria 2 and 3.

> One more question, the mails I send to this honeypot are "full
> mails" with all the header information included in the "body"
> of the mail. The mails are however sent from my personal email
> adress. Is that an ok way to do it?

The short answer is "No".
The long answer is that learning the changed headers does so much harm to the Bayes database that the all-over effect is detrimental to overall spam checking effectiveness.

To find more on this topic, there are some links below:

SpamAssassin Wiki:
http://wiki.apache.org/spamassassin/ResendingMailWithHeaders

Contribution Area/ IMAP2mbox:
http://www.byteplant.com/support/nospamtoday/contrib

FAQ/Whitepapers:
http://www.byteplant.com/support/nospamtoday/howtolearnspam.html
http://www.byteplant.com/support/nospamtoday/howtolearnexchange.html



Customer Support
Byteplant GmbH
Re: Learning ham [message #452 is a reply to message #450] Wed, 06 September 2006 19:17 Go to previous message
mtoth
Messages: 2
Registered: September 2006
Junior Member

1) the mail address is not reachable from the Internet

The mail address is not reachable from internet. I have added a subdomain in our internal DNS server and the mail address used for ham is using that sub domain. The MX record for that subdomain point to the NoSpamToday server.

2) your users only submit ham messages to this account

Yes, of course but I think I can educate some of the users to handle this correctly.

3) your mail client (and server) that does not modify the message at all
it might work. However, it will be difficult to meet criteria 2 and 3.

According to..
http://wiki.apache.org/spamassassin/ResendingMailWithHeaders
... it seems that I can redirect the mails. I have tried that and it works fine for me. The header information is modified a bit but according to this page it will probably be ok?

What troubles me most at this stage is that NoSpamToday adds information about why the mail was considered SPAM. The mails are therefore already altered by NoSpamToday server. Will that be a problem?
Re: Learning ham [message #453 is a reply to message #452] Fri, 08 September 2006 09:32 Go to previous message
support
Messages: 919
Registered: April 2004
Senior Member
> 1) the mail address is not reachable from the Internet
>
> The mail address is not reachable from internet. I have added a
> subdomain in our internal DNS server and the mail address used
> for ham is using that sub domain. The MX record for that
> subdomain point to the NoSpamToday server.
>
> 2) your users only submit ham messages to this account
>
> Yes, of course but I think I can educate some of the users to
> handle this correctly.
>
> 3) your mail client (and server) that does not modify the
> message at all
> it might work. However, it will be difficult to meet criteria 2
> and 3.
>
> According to..
> http://wiki.apache.org/spamassassin/ResendingMailWithHeaders
> ... it seems that I can redirect the mails. I have tried that
> and it works fine for me. The header information is modified a
> bit but according to this page it will probably be ok?
>
> What troubles me most at this stage is that NoSpamToday adds
> information about why the mail was considered SPAM. The mails
> are therefore already altered by NoSpamToday server. Will that
> be a problem?

No, because sa-learn will ignore the spam report.



Customer Support
Byteplant GmbH
Previous Topic: Bayes Learning
Next Topic: Bayes in use ?
Goto Forum:
  


Current Time: Fri Dec 09 20:18:39 CET 2016