How To Improve SPAM Filtering using Runbox Filters

[tore]

Originally posted by mail2me
Thanks tore for the reply. You have answered all the questions.

I will wait till the reject function is enabled before testing again.

You're welcome. The new box is now in production, so feel free to start your testing.

[mail2me]

Originally posted by tore
The new box is now in production, so feel free to start your testing.

I'm afraid that the test spam message sent from both my FastMail and MailSnare simply got filed to "Spam" folder instead of being rejected. Reject if possible option was selected in Runbox Mail Manager.

[mail2me]

Originally posted by mail2me
I'm afraid that the test spam message sent from both my FastMail and MailSnare simply got filed to "Spam" folder instead of being rejected. Reject if possible option was selected in Runbox Mail Manager.

The Runbox reject seem to work now. A possible reason for it not working previously might have been the filter order "-2" saving messages to spam folder before the Runbox spam filter action which is at order "-1". Therefore I suggest that those who want to setup a customized more aggressive manual filter to give it an order number of "0" if they want the "reject if possible messages" to be rejected first.

The reject message that Runbox sends out is as follows:

From: Mail Delivery System
Sent: Saturday, May 8, 2004 04:22 PM
To: <sender email address>
Subject: Undelivered Mail Returned to Sender

This is the Postfix program at host <sender smtp server>

I'm sorry to have to inform you that the message returned
below could not be delivered to one or more destinations.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can
delete your own text from the message returned below.

The Postfix program

<your email address>: host aibo.runbox.com[193.71.199.94] said: 550-This message
was automatically rejected because the recipient has chosen 550-not to
receive unsolicited email. If you feel your message was erroneously
550-rejected you may want to reformat/rephrase it and try again, or contact
550 support@runbox.com. (in reply to end of DATA command)

[tore]

Originally posted by mail2me
The Runbox reject seem to work now. A possible reason for it not working previously might have been the filter order "-2" saving messages to spam folder before the Runbox spam filter action which is at order "-1". Therefore I suggest that those who want to setup a customized more aggressive manual filter to give it an order number of "0" if they want the "reject if possible messages" to be rejected first.

Actually, the filters doesn't matter at all here. The "reject" stuff happens before the message is accepted into Exim's queue, while the filters are processed as the message is departing from Exim's queue and into your home directory (or to a forwarded address, perhaps).

However, changing the reject setting doesn't come into effect real-time - the configuration is distributed to the MXes every six minutes (if I recall correctly). That also applies to the white list. That was probably the reason it didn't work for you the first time around - there is no other obvious one I can think of, at least.

[carverrn]

Thanks for posting what the spam rejection message looks like. I hadn't seen it yet.

However, the filters shouldn't have anything to do with why you weren't getting the rejection message before. According to Linpro and Runbox, SPAM rejection takes place while the message is being received so that it is never actually accepted by the Runbox mail servers. Since it is never really delivered I don't think it can ever be processed by the filters.

At least this is my understanding.

Maybe they were still playing around with getting it working again while you were playing around with the filters.

Regards,
Rich

[carverrn]

Thanks for the explanation Tore!

Rich

[Liz]

Could a MODERATOR please make this thread sticky? Thanks.

Liz

[shelmart]

Originally posted by jbs
Just tested it with an email from myself (fortunately I'm on my whitelist -- it's obviously not that exclusive) and saw the beloved USER_IN_WHITELIST flag.

--Jason [/b]

I'm making extensive use of the whitelist function in Runbox but I'm not familiar with the USER_IN_WHITELIST flag. I've just looked at a couple of emails that came from folks who are on my whitelist, and this flag doesn't appear anywhere. Is there something that I need to turn on in order to see these flags?

Shelley

[jbs]

Originally posted by shelmart
I'm making extensive use of the whitelist function in Runbox but I'm not familiar with the USER_IN_WHITELIST flag. I've just looked at a couple of emails that came from folks who are on my whitelist, and this flag doesn't appear anywhere. Is there something that I need to turn on in order to see these flags?

Shelley

It's not it's own header flag, but is rather embedded in the Spam Status flag. By way of examples, here's a message I got this morning from my mother (yes, she's on my whitelist too )

X-Spam-Status: No, hits=-99.0 required=5.0 tests=CLICK_BELOW, HTML_60_70, HTML_FONTCOLOR_BLUE, HTML_LINK_CLICK_HERE, HTML_MESSAGE, HTML_TAG_BALANCE_HTML, NO_REAL_NAME, USER_IN_WHITELIST

So it's that last entry in the X-Spam-Status flag that tells you the sender is in the whitelist, and it adds a -100 (negative one hundred) to the spam score. Thus my mother would have to REALLY send me a lousy piece of mail for it to add up to a plus five total.

When you look in that flag, do you then see the USER_IN_WHITELIST text?

--Jason

[oysterquartz]

Originally posted by carverrn


(2) Create a "Spam" folder and a filter defined as:

Order: -2
Messages where: "Header" "contains" "X-Spam-Flag: YES"
will be: "saved to folder" "Spam"

By selecting "reject if possible" for the "Detect junk mail" option,
we have also disabled the ability to move SPAM to a Spam folder. This
defines our own Spam Filter that will do the same thing the original
Spam Filter did.

If you want your Spam Filter to be more restrictive, like have a cutoff
of 4 instead of the default of 5, you can define your filter like this:

Order: -2
Messages where: "Header" "contains" "X-Spam-Level: ****"
will be: "saved to folder" "Spam"

For this filter, any message with a score greater than 4 (e.g. 4.1) will
be moved to the Spam folder.


(3) Create a "NotInWhiteList" folder and a filter defined as:

Is anyone using multiple X-Spam-Level : ---- filters in order to filter different S.A. values into folders? If so, what is the folder preference level set at (-2 or other) and how does this affect X-Spam-Status (which I assume is like saying) X-Spam-Level: *****

I started using Rich's method and (shockingly) spam seems to have disappeared. This worries me somewhat (the fear of false positives)

[carverrn]

Is anyone using multiple X-Spam-Level : ---- filters in order to filter different S.A. values into folders? If so, what is the folder preference level set at (-2 or other) and how does this affect X-Spam-Status (which I assume is like saying) X-Spam-Level: *****

I do. Here is my general setup:

Order: -6
Messages where: "Header" "contains" "X-Spam-Level: ******"
will be "save to folder" "spam.level6"

Order: -5
Messages where: "Header" "contains" "X-Spam-Level: *****"
will be "save to folder" "spam.level5"

Order: -4
Messages where: "Header" "contains" "X-Spam-Level: ****"
will be "save to folder" "spam.level4"

Order: -3
Messages where: "Header" "contains" "X-Spam-Level: ***"
will be "save to folder" "spam.level3"

My Order values are actually different (lower) because of other filters I have but this ordering should work fine.

I wanted to see how the scoring of spam broke down into the different levels.

On rare occasions I might get a non-spam at level 3 or 4.

Regards,
Rich

[oysterquartz]

Rich,

Thanks for the info. Do you filter any pop retrieved account email into specific folders (i.e. for personalities). If so, how do you deal with spam (low threshold) slipping through the spam filters into the account.

I have all of my pop account specific folders set at "0".

.... that is unless your set up above intends to do this very thing ...

Lastly, don't you find the NotinWhitelist system to be a little annoying. It certainly protects the Inbox, but I suppose that you'll have quite a whitelist built up over time. It would be nice to somehow automate the process

[carverrn]

I don't really POP from other sources much anymore. I use my own domains now so I just redirect/forward those to my proper accounts (i.e. Runbox).

I don't really have to do much with my White List because I use my Runbox Toolbar 2. I just click on the "Add To Whitelist" when I need to add an address.

Since the White List is only good for checking "From" addresses I still have to add filters for Groups/Listservs that pass along the senders "From" address. Obvisously I don't want to add every Group/Listserv member to my White List.

It would be nice to have the option to say "use my addressbook as a white list". I suppose I could provide a manual option on the Runbox Toolbar to copy all addressbook addresses to the white list. Is that the kind of automation you were thinking of or did you have something else in mind?

Regards
Rich

[oysterquartz]

Rich,

Do you simply use forwarding for your domains, or do you havae proper email accounts (pop3 or imap)?

Why do you prefer forwarding to pop retrieval into Runbox. All of my domains have proper accounts/pop3/imap, but I've used Runbox as a backup of sorts. I could just forward vs. pop retrieve. Do you find any benefit to this approach?

By automating I meant an automatic add to whitelist if you "rescue" an email from a NotInWhiteList folder, or the ability to whitelist a number of emails at one time.

Lastly, whether forwarded or retrieved are you filtering into account specific folders, and if so, how is your anti-spam filter strategy being affected?

[carverrn]

Do you simply use forwarding for your domains, or do you havae proper email accounts (pop3 or imap)?

I use the domain registrars forwarding services to forward directly to Runbox. No POP or IMAP in the middle. So would you say that's an "improper" email account?

Why do you prefer forwarding to pop retrieval into Runbox. All of my domains have proper accounts/pop3/imap, but I've used Runbox as a backup of sorts. I could just forward vs. pop retrieve. Do you find any benefit to this approach?

It's less expensive for me. Domains are about $5-$9USD/year. The registrars I use give free email forwarding. POP accounts would cost extra. Runbox is my primary account so I just forward to that. Actually, I do have a backup account too but I forward too both accounts at the same time.

By automating I meant an automatic add to whitelist if you "rescue" an email from a NotInWhiteList folder, or the ability to whitelist a number of emails at one time.

You mean something like the Yahoo! "Not Spam" button in the Bulk mail folder. I have a feeling that's part of the upcoming spam filtering improvements that Geir has been referring to. Basically we'll have a way of telling the spam filters what we consider spam and not spam. At least that's my understanding.

Lastly, whether forwarded or retrieved are you filtering into account specific folders, and if so, how is your anti-spam filter strategy being affected?

Yes, I do sort many of the messages into folders. I filter a lot of messages based on the domain of mine to which it was sent. Most of my domains get very little spam. The spam that is sent to them is usually addressed to "webmaster", "info" or "sales" so I have a filter to catch those and move them to a spam folder.

Also, I would say that approximately 99.999999999% of all my spam is sent directly to my Runbox address. Because of that I don't really use that address for valid email anymore. I added a filter to move email with that address in the header to a spam folder. All my domains/aliases forward to the Runbox US or NO domains instead. This has eliminated a lot of those short spams that were coming in with scores of 1 and 0. This isn't a solution that everyone can use but it has been working for me.

One more thing. Since I do have my own domains I can create many usernames. My experience so far is that long usernames with dashes (-), dots (.) and underscores (_) don't seem to get spam. At least mine haven't. So I use names like

somesite.com-newsletter-maybe_another_keyord@my-domain-name.com

That way I will know where they got the address from if I do get spam. Plus I can setup filters to sort based on keywords in the address.

Does that address your question?

Regards,
Rich