Network Engineering

SpamAssassin

Oregon State University uses SpamAssassin to tag inbound email to orst.edu & oregonstate.edu email addresses. You can use these SpamAssassin tags to filter junk mail out of your mailbox. We do not block e-mail based on SpamAssassin information.

Headers assigned by SpamAssassin

Example headers that you can filter on:

X-Spam-Flag: YES
X-Spam-Level: ******** (a # of stars indicating the likeliness that this is spam)

When creating a rule in your e-mail program to filter mail based on SpamAssassin tags, you have the choice of either using the "X-Spam-Flag" header, or the "X-Spam-Level" header. The X-Spam-Flag header will be set to YES whenever the message has a SpamAssassin score of 5 or higher. If you would like to catch messages with a score of 3 or more instead, you can create a rule that looks for this header:

X-Spam-Level: ***

How to use SpamAssassin

• ONID users
• Microsoft Outlook 2000 & XP
• Entourage
• Eudora 5.x

ONID Users

You can enable SpamAssassin by going to http://www.onid.orst.edu. Choose "Login to ONID", and click on "Manage Mail" after you have authenticated.

Microsoft Outlook 2000 & XP:

1. Note: Outlook XP requires you first create a "Blank Rule" and then all of the following apply.
2. Right-click on your "Inbox" and choose "New Folder". Name it "junk".


3. Click Tools then Rules Wizard.


4. A window should pop up, click New. [View Screen Capture]


5. Choose "Check Messages When they Arrive" and click next. [View Screen Capture]


6. Check the box for "With <Specific Words> in the Message header". [View Screen Capture]


7. Click the "specific words" link and enter the following as its shown: X-Spam-Flag: YES [View Screen Capture]


8. Click "move it to the specified folder". [View Screen Capture]


9. Choose the "junk" folder you created in the first step and click OK. [View Screen Capture]


10. Click "Finish" then Ok. Your rule should now be setup. DO NOT CLICK NEXT.

Entourage:

1. Click Tools then Rules.


2. Select Specific Header as the criteria.


3. Enter the desired trap for the headers.
      Example: X-Spam-Flag: YES Would filter any message that was tagged by our system as "Spam"


4. Click apply.

Eudora 5.X

1. Click on Tools then Filters


2. Click New


3. Highlight the 'untilted' rule you've just created


4. On the right, check Incoming and change HEADER to say <ny Header>


5. Find the pulldown menu that says contains, and change it to matches regexp (case insensitive)


6. Enter X-Spam-Flag: YES on the line next to it.


7. Set first action to Transfer To then Trash. Or any other folder you want to filter the spam to.


8. Set second action to Skip Rest


9. Close box, and say yes when asked to save filters.

Spam-identification tactics used by SpamAssassin

• Header Analysis: spammers use a number of tricks to mask their identities, fool you into thinking they've sent a valid message, or fool you into thinking you must have subscribed at some stage. SpamAssassin tries to spot these.
  
  
• Text Analysis: Spam messages often have a characteristic style (to put it politely), and some characteristic disclaimers and CYA text. SpamAssassin can spot these, too. For a list of the rules that SpamAssassin uses see SpamAssassin Tests.
  
  
• Razor: Vipul's Razor is a collaborative spam-tracking database, which works by taking a signature of spam messages. Since spam typically operates by sending an identical message to hundreds of people, Razor short-circuits this by allowing the first person to receive a spam to add it to the database -- at which point everyone else will automatically block it.