Remote SpamAssassin Low/Med/High Weight Recommendations

Question asked by Scott Hendrickson - 1/20/2016 at 6:26 PM

Unanswered

Does anyone have any recommendations for the low, medium, and high weight values for remote spam assassin? I'm using SpamAssassin in a Box, and I find that the total SA score SmarterMail adds does NOT match any of the three weights. Instead it seems to be based on the raw score returned by SA. However I can't figure what SmarterMail is doing with the SA raw score to come up with the number it eventually adds to the spam total, so I have no real idea what to put for the weights.

Any help here would me most appreciated.

Scott

Scott Hendrickson
SOS4Net, Inc.
Centennial, CO. U.S.A.

13 Replies

Reply to Thread

Dominick Meccarielli Replied

6/14/2017 at 10:33 AM

I just installed SpamAssassin in a Box also. Having the exact same issue. Can anyone comment on this?

David Fisher Replied

2/5/2018 at 12:26 PM

Hi,

Same here, I cannot figure out how SmarterMail determines if SpamAssassin score is Low, Medium or High, it seems most of the spam getting through it scores as low!

SpamAssassin 29 [raw: 14]

What is the difference between the first score and second score, I've seen raw: 19 and SmarterMail scores that as low, so changes it to 10 points as that is what I have for the Low score, I believe that value is the default.

Thanks,

-dave

Employee Replied

2/5/2018 at 12:43 PM

Employee Post

We are given only a single weighted score from SpamAssassin and a threshold value. We calculate the score by taking the given score divided by the given threshold and multiply that by the LOW spam score set within SmarterMail. (SA.score / SA.threshold) * SM.lowWeight. It currently does nothing the med or high weights.

David Fisher Replied

2/5/2018 at 2:05 PM

Thank You Robert for your reply and clarification on how it works.. I am still trying to figure out what you said.. I will let you know if I need better clarification.

Can I assume it works the same for the SpamAssassin-Based Pattern Matching? Or did you code it so you could get different results for Low, Med and High?

Thanks!
-dave

Matt Petty Replied

2/5/2018 at 2:17 PM

Employee Post

Yes the code for SpamAssassin Pattern Matching is pretty much the same, the only difference is the SA.threshold is hard-coded at 6.5. It still uses lowWeight the same way and it uses the same equation.

Matt Petty Software Developer SmarterTools Inc. (877) 357-6278 www.smartertools.com

David Fisher Replied

2/8/2018 at 12:12 PM

Hi,

How did this score negative?

X-SmarterMail-Spam: SPF_None, Reverse DNS Lookup, Bayesian Filtering, ISpamAssassin 0 [raw: 0], SpamAssassin 6 [raw: 2], DK_None, DKIM_None, Custom Rules [], UCEProtect Level 1, UCEProtect Level 2, URIBL - White:1
X-SmarterMail-SpamDetail: SPAMD/1.1 0 EX_OK
X-SmarterMail-SpamDetail: Spam: False ; 2.0 / 5.0
X-SmarterMail-SpamDetail: BAYES_40,HTML_MESSAGE,JAM_LARGE_FONT_SIZE,LOTS_OF_MONEY,UNPARSEABLE_RELAY
X-SmarterMail-TotalSpamWeight: -13

SPF = 0
RDNS = +2
Bay = +3
SA = ?
DK* = 0
CR = 0
UL1 = +4
UL2 = +2
UW = -2

Low SA = 15

Thanks,

-dave

David Fisher Replied

2/8/2018 at 12:17 PM

Thanks Matt..

Robert, are you sure it is times (*) by SM.lowWeight? Assuming my example SpamAssassin 29 [raw: 14]... 29 is the score and 14 is the threshold? 29/14*10 = 20.71.. ?

I have some that are like SpamAssassin 7 [raw: 2].. 7/2*10 = 35 which would be way too high!

Unless the threshold isn't one of those numbers.

Thanks,
-dave

David Fisher Replied

2/8/2018 at 12:20 PM

Hi,

Unless when you set it on detail log scoring in the headers you see :

X-SmarterMail-SpamDetail: Content analysis details: (10.2 points, 5.0 required)

Is that the SA.score (10.2) and Sa.threshold (5.0)?

Thanks,
-dave

David Fisher Replied

2/8/2018 at 12:41 PM

Hi,

In this example, I see now it says Spam False, so SpamAssassin didn't see it as spam, so I would imagine SmarterMail would report 0 for it, but still doesn't explain where the negative score same from. There must of been other tests that ran that aren't indicated in the header.

Thanks,
-dave

Brian Tesene Replied

3/8/2018 at 1:47 PM

Hi Robert, Thanks for the great information. I want to make sure I understand though. I too am using SpamAssassin in a box. When I read the returned mail headers I see two results like this:
SpamAssassin 6 [raw: 2]. I have it set to use the default 5 as the threshold for "spam". I am using 15 as my low spam weight for remote spam assassin. My questions are:

(1) I am assuming that the second number (2) is what SA is sending. If I read your formula correctly, the calculation would be (2 / 5) * 15 = 6. Correct?

(2) So my REAL question is how should I set the Spam LOW weight in SmarterMail? Since SA believes that "spamminess" begins at 5 and I have my overall filtering set on a 10/20/30 scale, should I be using the default 10 for the SA spam weight or should I have it higher (I have 15 now)? I am trying to decide that, if I trust SA, should i be giving its result a higher weight?

Matt Petty Replied

3/8/2018 at 2:10 PM

Employee Post

1) Yes, this is the value we get back from SpamAssassin

2) There is not necessarily a high/medium/low, The spam score is scaled based off of "15" your low spam score. So this scaling is relative to that number. If you want SA to have more weighty results, you can increase the number like you have.
However, If you notice that the weights you are getting from SpamAssassin are too high, then you may need to drop the Low score. The other scores have no affect on anything (and should probably be removed).

Matt Petty Software Developer SmarterTools Inc. (877) 357-6278 www.smartertools.com

Employee Replied

3/8/2018 at 2:13 PM

Employee Post

I'd like to reiterate that the score and threshold are scores that SpamAssassin returns to SmartMail. SmarterMail has no control over those values.

Brian Tesene Replied

3/8/2018 at 2:37 PM

Hi guys, thanks for your quick responses! Yes, I understand that SM has no control over the raw score and the threshold number. Basically, the only control from within SM is how it weights the response. I guess my question now is for those who use SpamAssassin in a Box. How much weight should I be giving the value it returns? The default (in the low weight category) is 10 but should it be higher?

When I look at the two solutions SmarterTools offers (Cyren and Message Sniffer), the default weight for "confirmed spam" is 30 so basically, if that one filter alone believes a message to be spam, it will get a final score of over 30 and will fall in to the spam-high bucket (I have the SM filtering thresholds set to 10/20/30). This is true for both Cyren and Message Sniffer. Should I trust SpamAssassin the same way? If it returns a raw value over 5, that means it believes it to be spam, right? So shouldn't I set the Low weight for SpamAssassin to 30 like the other boxed solutions? That way if SA thinks it is spam, it would ultimately fall into my spam high bucket. Is that thinking correct or would that make my filter to aggressive?

Back to Community Threads

Please leave this box unchecked

13 Replies

Reply to Thread

Tags

Related Knowledge Base Articles