Managing Email Spam

SpamAssassin Documentation & Information

What is SpamAssassin?

SpamAssassin is a server-based email filtering application that attempts to identify spam. When identified, SpamAssassin simply marks the message as potential spam and then continues to deliver the email to the intended recipient as normal.
SpamAssassin will NOT (by default) delete or move any email messages, but instead provides an individual a straightforward method in controlling his/her own spam.
SpamAssassin is currently in production, serving the Cal Poly Pomona community.

What does SpamAssassin do?

SpamAssassin inspects the headers and body of an email message and determines the probability of that message being spam.
SpamAssassin then tags or marks the email message as spam, adding spam identifiers to the header area of the message.
These identifiers can then be used as a filtering mechanism for your email client such as Outlook, Entourage, etc.
SpamAssassin is designed to provide an automated method of spam identification while allowing the individual to control the messages classified as spam.

How does SpamAssassin work?

Using a rule base and scoring system, a wide range of heuristic tests are performed on the mail headers and body text. For an in depth list of spam tests performed on an email message, click on the following site: http://www.spamassassin.org/tests.html.
Each test has a specified score associated with it. If the total score of the message exceeds the predefined threshold spam limit, the email message is then considered spam and tagged with the spam identifiers.

What are the SpamAssassin Identifiers?

When SpamAssassin identifies an email message as potential spam, there are three identifiers that could be added to the header or subject area of the email message.
- SpamAssassin Identifiers:
  - X-Spam-Status
  - X-Spam-Level
  - X-Spam-Flag
X-Spam-Status:
- The "X-Spam-Status:" identifier includes:
  - The email message total score or hits
  - The threshold value (default = 7.0)
  - The successful spam tests identified
- By default, the X-Spam-Status identifier appears in all email messages.
X-Spam-Level:
- The "X-Spam-Level:" identifier displays the email's total score using the asterisk character (*). This identifier rounds up or down to the nearest whole number. If the hit value is at .5, the number is rounded up.
  - For example: If the score or hit value of the message is 4.6, the X-Spam-Level identifier will contain 5 asterisks.
    X-Spam-Level: *****
  - For example: If the score or hit value of the message is 3.4, the X-Spam-Level identifier will contain 3 asterisks.
    X-Spam-Level: ***
- This identifier can be useful in advanced customization of spam filtering. By default, the "X-Spam-Level:" identifier appears in all messages.
X-Spam-Flag:
- The "X-Spam-Flag:" identifier will ONLY appear when an email message has reached the spam threshold limit (default is 7.0).
- When an email message reaches and/or exceeds the spam threshold limit, the identifier "X-Spam-Flag: YES" will appear.
- This SpamAssassin identifier easily enables the individual to configure his/her client to look for the "X-Spam-Flag: YES" header to filter the spam messages.

Examples of the Email Identifiers within a Message

Example of a NON-SPAM email message header:

To: <calpolyemailuser@csupomona.edu>
Subject: Regular Email
Date: Wed, 26 Feb 2003 14:05:47 -0800
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0040_01C2DDA0.292F5970"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

X-Spam-Status: No, hits=1.3 tagged_above=-999.0 required=7.0 tests=BAYES_20,
HTML_70_80, HTML_MESSAGE
X-Spam-Level: *

Example of an IDENTIFIED SPAM email message header:

To: <calpolyemailuser@csupomona.edu>
Subject: Spam Email
Date: Wed, 26 Feb 2003 14:01:16 -0800
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----=_NextPart_000_002D_01C2DD9F.876C8590"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

X-Spam-Status: Yes, hits=10.6 tagged_above=-999.0 required=7.0 tests=BAYES_56,
CLICK_BELOW, EXCUSE_10, EXCUSE_14, EXCUSE_22, EXCUSE_23, EXCUSE_24,
EXTRA_MPART_TYPE, HTML_60_70, HTML_COMMENT_SAVED_URL, HTML_FONT_COLOR_BLUE,
HTML_LINK_CLICK_HERE, HTML_MESSAGE, HTML_TAG_EXISTS_TBODY, MAILTO_LINK,
OFFER, OFFERS_ETC, OPT_OUT, ORIGINAL_MESSAGE, RECEIVE_EMAIL, SMTPD_IN_RCVD
X-Spam-Level: ***********
X-Spam-Flag: YES

More information is available at www.spamassassin.org.