Scrollout

Tips & Tricks

Working with the Bayes filter

Understanding the Bayesian filter is critical in environments with high email traffic. Administering high traffic can be difficult, but rich content is important for learning.

First aspect

  • The Bayes learning filter needs at least 200 SPAM and 200 HAM messages to become active.
  • Messages must meet technical requirements to be learned (SPAM: 3 header tokens + 3 body tokens; HAM: only 3 body tokens).
  • Both types vary in content (even in language), and overall traffic differs from day to day and company to company.
  • By design the filter learns gradually from your own traffic. Let the learning system (Bayes, SpamAssassin) work as designed.

Second aspect

  • Along with Bayes, network rules play an important role while Bayes is not active (and a lesser one afterwards).
  • Network rules (IP/URL checks against RBLs) use a delay to avoid flooding providers, so a few flood-spam messages may pass when RBL checks are skipped by that safety mechanism. A well trained Bayes compensates for these cases.

In the end

  • Spam that has not been seen before, sent from legit sources and containing legit elements (IPs, URLs), is the hardest to catch.
  • It is not possible to stop all spam in two hours of work by feeding 200+200 messages. The feeder’s scope is to adjust the learning system and cover these occasional cases.

Assign an outbound IP address per domain

Assigning an outbound IP address to a sender domain can:

  • Prevent the default IP from losing reputation when a sender domain is not trusted.
  • Increase delivery quality by associating an IP with good reputation to a sender domain.
  • Increase limits by associating an IP with good throughput to a sender domain.
  • Build reputation for a new IP using a sender domain with normal transactions.
  • Isolate a sender domain from being associated with others.

Disclaimer per domain

A disclaimer for each domain can be added in /var/www/disclaimer/domain.com.txt.

Useful bounce

In the web interface (ROUTE) you can add a URL page and a phone number for support. They appear in the returned bounce error. Instead of a phone number you can add an unfiltered email address such as postmaster@your-domain.com, for example as an alias of your IT department mailbox. Note that postmaster may become a spam target.

telnet 192.168.1.234 25
220 ScrolloutF1.scrolloutf1.com ESMTP  - Scrollout - Scrollout F1 2012-10-03
test
502-5.5.2 Error: command not recognized
502 5.5.2 For assistance, see www.scrolloutf1.com/contact or contact +40720xxxyyy. Please provide the following information in your problem report: Time: (Jan 30 10:43:07), Client: (192.168.1.9), Server: (ScrolloutF1.scrolloutf1.com).

Tag only the spam

To TAG spam messages instead of quarantining them:

  1. Go to ROUTE.
  2. Click Quarantine.
  3. Enter a score of 5 in the first field and 999 in the second field.

Done.

Quarantine per user (sort of)

After the step above, users can create a mail rule for messages containing Spam: in the Subject and move them to their Spam/Junk folder.