help centre
For more info visit status.atmail.com

How can we help?


Search our knowledge base for answers to
common questions and latest updates.



My activities New request

Follow

Additional Anti-Spam Configuration

Chris -

PROBLEM

I want to reduce the amount of spam I am receiving.

ENVIRONMENT

  • On-Premise Server + WebMail Installations: Version 7.0 > Current Version

CAUSE

Too much spam.

RESOLUTION

You can add the following piece of code to your SpamAssassin as a custom configuration file within:

/usr/local/atmail/spamassassin/etc/mail/spamassassin/

Copy and paste the below code into a new file called, for example atmailcustom.cf:


score FREEMAIL_FORGED_REPLYTO 3.5
score T_FRT_CLICK 0.5
score T_MIME_NO_TEXT 2.0
score HTML_FONT_LOW_CONTRAST 2.5
score HTML_SHORT_LINK_IMG_1 0.6
score RAZOR2_CF_RANGE_E8_51_100 2.5
score MISSING_MID 0.5
score T_HK_NAME_DR 1.0
score RAZOR2_CF_RANGE_51_100 1.5
score RAZOR2_CHECK 2.0
score MISSING_MIMEOLE 0.2
score FSL_MIME_NO_TEXT 1.5
score DNS_FROM_AHBL_RHSBL 0.0
score FREEMAIL_FROM 1.0
score T_RP_MATCHES_RCVD 0.001
score SPF_PASS 0.0
score RCVD_IN_DNSWL_NONE 0.001
score RP_MATCHES_RCVD 0.001
score RCVD_IN_DNSWL_HI -2.0
score T_TVD_MIME_EPI 2.0
score DATE_IN_PAST_03_06 1.0
score DATE_IN_PAST_06_12 1.5
score DATE_IN_PAST_12_24 1.7
score DATE_IN_PAST_24_48 2.0
score DATE_IN_PAST_96_XX 2.3
score FROM_12LTRDOM 0
score HTML_EXTRA_CLOSE 0.5
score HTML_IMAGE_ONLY_32 1.1
score HTML_MESSAGE 0.5
score HTML_NONELEMENT_30_40 0.5
score LOTS_OF_MONEY 1.5
score RCVD_IN_RP_CERTIFIED 0.0
score RCVD_IN_RP_SAFE 0.0
score SUBJ_DOLLARS 1.25
score T_LOTTO_AGENT_FM 1.0
score T_OBFU_PDF_ATTACH 0.7
score T_REMOTE_IMAGE 1.0
score URIBL_DBL_REDIR 1.0
score URIBL_RED 0.5
score APOSTROPHE_FROM 0.548
score BANG_OPRAH 0.5
score CONFIRMED_FORGED 1.5
score CTYPE_001C_A 0.5
score CTYPE_001C_B 0.501
score CUM_SHOT 1.5
score CURR_PRICE 0.501
score DATE_SPAMWARE_Y2K 0.5
score DIET_1 1.714 0.000 0.399 0.001
score DIGEST_MULTIPLE 0.9 0.001 0 0.293
score DOS_ANAL_SPAM_MAILER 0.5
score DOS_FIX_MY_URI 0.5
score DOS_HIGH_BAT_TO_MX 0.5
score DOS_LET_GO_JOB 0.5
score DOS_STOCK_BAT 0.501
score DOS_STOCK_BAT2 0.5
score DOS_URI_ASTERISK 0.5
score DOS_YOUR_PLACE 0.5
score DRUGS_ANXIETY_EREC 0.9
score DRUGS_ANXIETY_OBFU 0.9
score DRUGS_DIET_OBFU 0.9
score DRUGS_HDIA 0.9
score DRUGS_MUSCLE 0.901
score DRUGS_SLEEP_EREC 0.9
score DRUG_DOSAGE 0.9
score DRUG_ED_GENERIC 0.9
score DRUG_ED_SILD 0.901
score DYN_RDNS_SHORT_HELO_HTML 0.701 0.001 0.000 0.001
score EMAIL_ROT13 0.5
score FAKE_OUTBLAZE_RCVD 0.9
score FAKE_REPLY_C 0.988 0.001 2.553 1.486
score FORGED_IMS_HTML 0.5
score FORGED_IMS_TAGS 0.5
score FORGED_IMS_AOL 0.5
score FORGED_MSGID_HOTMAIL 1.0
score FORGED_MSGID_MSN 1.0
score FORGED_OUTLOOK_HTML 0.901
score FORGED_OUTLOOK_TAGS 0.903
score FORGED_QUALCOMM_TAGS 0.5
score FORGED_THEBAT_HTML 0.5
score FORWARD_LOOKING 0.5
score FRAGMENTED_MESSAGE 0.5
score FREE_PORN 2.0
score FROM_EXCESS_BASE64 0.500 0.105 0.001 0.979
score FROM_LOCAL_DIGITS 0.501
score FROM_LOCAL_HEX 0.500 0.331 0.001 0.006
score FROM_NO_USER 0.501 2.599 0.019 0.798
score FSL_HELO_SETUP 0.2
score GEO_QUERY_STRING 0.9
score HDR_ORDER_FTSDMCXX_001C 0.5
score HDR_ORDER_FTSDMCXX_BAT 0.5
score HEAD_LONG 0.5
score HELO_DYNAMIC_ROGERS 0.5
score HELO_FRIEND 1.5
score HELO_LH_HOME 0.101 0.623 0.537 0.736
score HELO_LH_LD 0.2
score HIDE_WIN_STATUS 0.501 1.353 0.754 1.380
score HIGH_CODEPAGE_URI 0.5
score HTML_MIME_NO_HTML_TAG 0.501 0.635 0.001 0.377
score HTML_MISSING_CTYPE 0.5
score HTTP_77 0.5
score HTTP_EXCESSIVE_ESCAPES 0.501 1.516 0.000 1.572
score INVALID_DATE_TZ_ABSURD 1.262 0.632 0.706 0.491
score INVALID_TZ_CST 0.5
score INVALID_TZ_EST 0.5
score INVESTMENT_ADVICE 1.200 2.160 2.199 2.199
score IP_LINK_PLUS 1.001 0.001 0.246 0.012
score JAPANESE_UCE_BODY 0.5
score JAPANESE_UCE_SUBJECT 0.5
score JM_I_FEEL_LUCKY 1.0
score JM_RCVD_QMAILV1 1.0
score JM_TORA_XM 1.0
score JOIN_MILLIONS 0.900 0.128 1.549 1.026
score JS_FROMCHARCODE 0.5
score LIVE_PORN 2.0
score MID_DEGREES 0.5
score MIME_BOUND_EQ_REL 0.5
score MIME_BOUND_MANY_HEX 0.5
score MIME_HTML_ONLY_MULTI 0.500 0.001 0.001 0.001
score MISSING_HB_SEP 0.5
score MSGID_DOLLARS_RANDOM 0.5
score MSGID_SHORT 0.501 0.337 0.001 0.001
score MSGID_SPAM_LETTERS 0.5
score MULTI_FORGED 1.0
score NONEXISTENT_CHARSET 0.5
score NORMAL_HTTP_TO_IP 0.559 0.001 0.795 0.001
score NOT_ADVISOR 0.5
score NUMERIC_HTTP_ADDR 0.500 0.001 0.001 1.242
score OBFUSCATING_COMMENT 0.500 0.000 0.001 0.723
score OBSCURED_EMAIL 0.5
score PREST_NON_ACCREDITED 0.5
score PREVENT_NONDELIVERY 0.5
score RATWARE_HASH_DASH 0.5
score RATWARE_MOZ_MALFORMED 0.5
score RATWARE_OE_MALFORMED 0.5
score RATWARE_RCVD_AT 0.5
score RATWARE_RCVD_PF 0.5
score RCVD_AM_PM 0.5
score RCVD_BAD_ID 0.5
score RCVD_FORGED_WROTE 0.5
score RCVD_FORGED_WROTE2 0.5
score RCVD_IN_BRBL_LASTEXT 1.5 1.644 1.4 1.449
score RCVD_IN_PSBL 0.0
score RCVD_IN_RP_RNBL 0.5 1.284 0 1.310
score RCVD_MAIL_COM 0.5
score REFINANCE_NOW 0.9
score REFINANCE_YOUR_HOME 0.9
score REPTO_QUOTE_AOL 0.9
score REPTO_QUOTE_IMS 0.9
score REPTO_QUOTE_MSN 0.9
score REPTO_QUOTE_QUALCOMM 0.9
score RUDE_HTML 0.5
score SHORT_HELO_AND_INLINE_IMAGE 0.537 0.160 0.013 1.390
score SHORT_TERM_PRICE 0.501
score SPOOF_COM2COM 0.501 1.632 1.952 2.048
score SPOOF_NET2COM 0.5
score STOCK_ALERT 0.9
score STOCK_IMG_CTYPE 0.501 0.005 0.001 0.001
score STOCK_IMG_HDR_FROM 0.501 0.001 0.001 0.021
score STOCK_IMG_HTML 0.500 0.028 0.000 0.005
score STOCK_IMG_OUTLOOK 0.501 0.702 0.413 0.190
score STOCK_PRICES 0.9
score STOX_AND_PRICE 0.9
score STRONG_BUY 0.9
score SUBJECT_DRUG_GAP_S 0.9
score SUBJECT_DRUG_GAP_VA 0.9
score SUBJECT_DRUG_GAP_X 0.9
score SUBJECT_SEXUAL 0.9
score TT_OBSCURED_VALIUM 0.9
score TT_OBSCURED_VIAGRA 0.9
score TVD_ACT_193 0.9
score TVD_DEAR_HOMEOWNER 0.9
score TVD_EB_PHISH 0.9
score TVD_ENVFROM_APOST 0.9
score TVD_FINGER_02 0.501 1.544 1.394 1.215
score TVD_FLOAT_GENERAL 0.9
score TVD_LINK_SAVE 0.9
score TVD_PP_PHISH 0.9
score TVD_RATWARE_CB 0.9
score TVD_RATWARE_CB_2 0.9
score TVD_RATWARE_MSGID_02 0.9
score TVD_RCVD_SPACE_BRACKET 0.901 0.001 0.001 0.001
score TVD_SECTION 0.9
score TVD_SILLY_URI_OBFU 0.9
score TVD_SPACED_SUBJECT_WORD3 0.4
score TVD_SUBJ_ACC_NUM 0.601 2.199 2.199 2.198
score TVD_SUBJ_FINGER_03 0.5
score TVD_SUBJ_OWE 0.5
score TVD_VIS_HIDDEN 0.5
score UPPERCASE_75_100 1.0
score UPPERCASE_50_75 0.501 0.791 0.001 0.008
score URI_UNSUBSCRIBE 0.5
score VIA_GAP_GRA 0.5
score WEIRD_PORT 0.501 0.001 0.097 0.001
score WEIRD_QUOTING 0.501 0.001 0.001 0.001
score WITH_LC_SMTP 0.5
score X_MESSAGE_INFO 0.1
score X_PRIORITY_CC 0.1
score YAHOO_DRS_REDIR 0.1
score YAHOO_RD_REDIR 0.1
score HTML_COMMENT_SHORT 0.2
score HTML_EMBEDS 0.501 0.001 1.171 1.799
score HTML_EXTRA_CLOSE 0.101
score HTML_FONT_FACE_BAD 0.101 0.289 0.286 0.981
score HTML_FONT_SIZE_HUGE 0.101
score HTML_FONT_SIZE_LARGE 0.101
score HTML_FORMACTION_MAILTO 0.2
score HTML_IFRAME_SRC 1.5
score HTML_OBFUSCATE_30_40 0.5
score HTML_OBFUSCATE_50_60 0.5
score HTML_OBFUSCATE_70_80 0.5
score HTML_OBFUSCATE_90_100 0.5
score HTML_BADTAG_40_50 0.2
score HTML_BADTAG_50_60 0.2
score HTML_BADTAG_60_70 0.2
score HTML_BADTAG_90_100 0.2
score HTML_NONELEMENT_30_40 0.200 0.001 0.308 0.001
score HTML_NONELEMENT_40_50 0.2
score HTML_NONELEMENT_60_70 0.2
score HTML_NONELEMENT_80_90 0.2
score HTML_TAG_EXIST_BGSOUND 0.5
score RCVD_IN_BL_SPAMCOP_NET 0.5 1.246 0 1.347
score DATE_IN_FUTURE_96_XX 0.5
score FUZZY_AFFORDABLE 0.9
score FUZZY_BILLION 0.9
score FUZZY_CPILL 0.501
score FUZZY_GUARANTEE 0.9
score FUZZY_MEDICATION 0.9
score FUZZY_MERIDIA 0.9
score FUZZY_MONEY 0.5
score FUZZY_MORTGAGE 0.5
score FUZZY_OBLIGATION 0.5
score FUZZY_OFFERS 0.5
score FUZZY_PRESCRIPT 0.5
score FUZZY_REFINANCE 0.5
score FUZZY_REMOVE 0.5
score FUZZY_SOFTWARE 0.9
score FUZZY_THOUSANDS 0.6
score FUZZY_VLIUM 0.5
score FUZZY_VIOXX 0.5
score FUZZY_VPILL 0.501 0.494 0.796 1.014
score SUBJECT_FUZZY_MEDS 0.9
score SUBJECT_FUZZY_PENIS 0.9
score SUBJECT_FUZZY_TION 0.9
score SUBJECT_FUZZY_VPILL 0.9
score TVD_FUZZY_DEGREE 0.9
score TVD_FUZZY_FINANCE 0.9
score TVD_FUZZY_FIXED_RATE 0.9
score TVD_FUZZY_MICROCAP 0.9
score TVD_FUZZY_PHARMACEUTICAL 0.9
score TVD_FUZZY_SYMBOL 0.9
score HELO_NO_DOMAIN 1.0
score UNPARSEABLE_RELAY 0.2
score FH_HELO_ALMOST_IP 0.5
score FSL_HELO_BARE_IP_2 0.5
score SUBJ_ALL_CAPS 1.0
score DOS_OUTLOOK_TO_MX 1.2
score RDNS_NONE 0.5
score SORTED_RECIPS 2.0
score SPF_SOFTFAIL 0.1
score URIBL_BLACK 0
score URIBL_RED 0
score URIBL_GREY 0
score URIBL_BLOCKED 0
score URIBL_DBL_ABUSE_SPAM 3.5
score DYN_RDNS_SHORT_HELO_IMAGE 1.0
score DYN_RDNS_AND_INLINE_IMAGE 0.5
score MISSING_FROM 0.2
score URIBL_AB_SURBL 0
score URIBL_JP_SURBL 0
score URIBL_OB_SURBL 0
score URIBL_PH_SURBL 0
score URIBL_SC_SURBL 0
score URIBL_WS_SURBL 0
score URIBL_XS_SURBL 0
score RCVD_IN_PBL 0.0
score RCVD_IN_RP_RNBL 0.0
score MIME_HEADER_CTYPE_ONLY 1.5
score AWL -2.0
score RCVD_IN_BRBL_LASTEXT 0.9
score RDNS_NONE 1.0
score DATE_IN_FUTURE_06_12 0.5
score RCVD_IN_SORBS_DUL 2.0
score TVD_SPACE_RATIO 1.5
score MIME_QP_LONG_LINE 1.2
score ALL_TRUSTED 0.0
score BAYES_999 3.5
score BAYES_00 0.0


body ATMAIL_HELLOFRIEND_CHECK /\bHello Friend\b/i
score ATMAIL_HELLOFRIEND_CHECK 3.0


uri ATMAIL_LOCAL_HIJACKEDEU /\.eu/i
score ATMAIL_LOCAL_HIJACKEDEU 1.5
 
header ATMAIL_LOCAL_EUSPAM From =~ /\.eu/i
score ATMAIL_LOCAL_EUSPAM 2.0
 
header ATMAIL_LOCAL_USSPAM From =~ /\.us/i
score ATMAIL_LOCAL_USSPAM 2.0

uri ATMAIL_LOCAL_HIJACKEDUS /\.us/i
score ATMAIL_LOCAL_HIJACKEDUS 1.5

header __WHATS_APP_FROM From =~ /WhatsApp/i
body __WHATS_APP_BODY /\bIf you cannot play, move message to the \"?Inbox\"? folder\b/
meta WHATS_APP_CHECKS (( __WHATS_APP_FROM + __WHATS_APP_BODY) > 1)
score WHATS_APP_CHECKS 5.5
 
body ATMAIL_EBOLA_CHECK /In the event martial law is declared, civil rights may be modified/i
score ATMAIL_EBOLA_CHECK 1.5

body ATMAIL_EBOLA1_CHECK /This protocol will help you to understand modified rights./i
score ATMAIL_EBOLA1_CHECK 1.5

body atcl_BODY_05 /(facelift|face.lift|face.wrinkles|lasik|Oprah|HBO|CINEMAX|SHOWTIME|STARZ|easy system|start making money|protect your driveway|protect your garage floor|no exam necessary|Do I really need)/i
score atcl_BODY_05 0.5

header atcl_FROM_10 From =~ /(Horoscope)/i
score atcl_FROM_10 1.5

header atcl_ALL_11 ALL =~ /WhatsApp/i
score atcl_ALL_11 2.5

header atcl_ALL_12 ALL =~ /Selfie/i
score atcl_ALL_12 2.0

header atcl_ALL_13 ALL =~ /(FREE question|AskNow|Amazon Coupon S|Amazon Coupon)/i
score atcl_ALL_13 2.5

body atcl_BODY_12 /\bIf you cannot play, move message to the \"?Inbox\"? folder\b/
score atcl_BODY_12 2.5

body atcl_ALL_IFRAME /(iframe|String.fromCharCode|indexOf|data.charAt)/i
score atcl_ALL_IFRAME 3.0

header atcl_SUBJECT_10 Subject =~ /(forex|Anti(-| )Aging)/i
score atcl_SUBJECT_10 1.5

body atcl_BODY_10 /(End the suffering|Genie Zip|Walmart Rewards|extra online rewards|<><><><>|Milk worse than smoking|milk (is|are) now connected to cancer|hair loss|Cure For Diabetes|I (was|am) starving|Woodworking|DIY shed| harp |Billionaires|Student(-| )Debt|selfie|new lower home rate|Claim Airline Voucher)/i
score atcl_BODY_10 1.0

body atcl_BODY_30 /(not paid for driving on a toll road|Public Records Now Available|Hollywood celebrity|Celeb Gossip|auto warranty|Pet stores are so -overpriced|monthly AutoInsurance payments were just-reduced|Dealers have teamed up and are offering a special Clearance|Score-Report Team|Score Report Team|Your Pre-Approved Card|weight gain|no workout needed|lose weight rapidly|We Guarantee You('ll| will) Make|Making Home Affordable Plan|Own your piece|Fat Storage|Fat Fighter|haggling with auto sales|fad diet)/i
score atcl_BODY_30 3.0

header atcl_SUBJECT_30 Subject =~ /(Belly Bulge|Restore Vision loss|Look Years-Younger|Someone has run a background|background.check on you|There's cool new site on the web)/i
score atcl_SUBJECT_30 3.0

header actl_SUBJECT_31 Subject =~ /(80% utility|Save up to|Powerbill|Power bill|Solar Panel|Save money|Secret new|New secret|Save Over)/i
score actl_SUBJECT_31 3.0

header actl_HEADER_32 ALL =~ /(HealthDiscovery|NaturalMaleEnhancement|Enhancement|Male|Natural)/i
score actl_HEADER_32 2.5

header actl_HEADER_PERCENT ALL=~ /(%)/i
score actl_HEADER_PERCENT 1.0

header actl_SELFIE_KILL ALL=~ /(Selfie Button|Love Taking Photos On Your Phone?)/i
score actl_SELFIE_KILL 2.0

body atcl_BODY_35 /(accessed your personal record|Ondemand Research|\bICANCiANCg==\b|Warning: The eye-care industry does not want you to know about this)/i
score atcl_BODY_35 3.5

header atcl_SUBJECT_35 Subject =~ /(slim-fast|Home Depot Replacement Windows|Cigars|Satellite Internet|High Speed Internet)/i
score atcl_SUBJECT_35 3.5

body atcl_BODY_36 /(Your Private Information is Exposed!|Discover sites that expose|Private information|Spying|Neighbour watch)/i
score atcl_BODY_36 2.0

header atcl_FROM_35 From =~ /(Internet Millionaire|Satellite Internet|High Speed Internet|Replacement Window|Harp program|lasik|\blistname\b|Take your sex life to a new|CLEARANCE)/i
score atcl_FROM_35 3.5

body atcl_BODY_40 /(losing.pound|Transform Your Body|melt fat|melt away fat|melting fat|need cash fast|free profit|Profit Maker|easy trick to save you|To YOUR Success|per day part-time|weird food|never eat this food|DocOz|Doc Oz|DrOz|Dr Oz|Dr. Oz|Dr-Oz|Top story 2014|We have amazing news|Get the peace of mind)/i
score atcl_BODY_40 4.0

body atcl_BODY_41 /(INTERNET ALERT SERVICE.|Your doctor has probably told you)/i
score atcl_BODY_41 2.5

header atcl_SUBJECT_40 Subject =~ /(DocOz|Doc Oz|DrOz|Dr.Oz|Dr\. Oz)/i
score atcl_SUBJECT_40 4.0

body atcl_BODY_45 /dirty little/i
score atcl_BODY_45 4.5

body atcl_BODY_50 /(ashleymadison|ashley madison|eHarmony|Fountain of Youth)/i
score atcl_BODY_50 5.0

header atcl_FROM_50 From =~ /(ashleymadison|ashley madison|eHarmony)/i
score atcl_FROM_50 5.0

Once this has been placed within:

/usr/local/atmail/spamassassin/etc/mail/spamassassin/

Restart the atmailserver by running:

/etc/init.d/atmailserver restart

OR

service atmailserver restart

Your new rule set should now be in place and will start reducing spam for you.

ADVANCED USAGE

You may wish to add to this configuration file to suit your needs, to do so you will need to learn to write your own basic SpamAssassin rules.

For example if you're receiving a lot of spam from a certain domain that for some reason isn't being caught by spam filters, you could create a custom rule and add it into your atmailcustom.cf to stop this, the rule would be written like this:

header ATMAIL_BAN_DOMAIN1 From =~ /example\.com/i
score ATMAIL_BAN_DOMAIN1 3.0

This rule would mark any emails sent to you from the domain example.com with a spam score of 3.0.

If you're recieving a lot of spam from different domains but with the same title/subject, you can use the following to either give it an additional spam score:

header ATMAIL_BAN_SUBJECT1 Subject =~ /SPAM/i

score ATMAIL_BAN_SUBJECT1 2.5

This will add a spam score of 2.5 to any emails with "Spam/SPAM/spam" in the subject.

For additional information and a more in depth guide on how to write your own SpamAssassin rules please see: SpamAssassin Rules How To.

Have more questions? Submit a request

Comments

  • Avatar
    Mladen

    Duplicate lines?

    score HELO_NO_DOMAIN 0.15
    score HELO_NO_DOMAIN 1.0

  • Avatar
    Dominic

    Thanks Mladen,

    Just removed:
    score HELO_NO_DOMAIN 0.15

    Thank you

  • Avatar
    Mladen

    Another duplicate :

    score T_REMOTE_IMAGE 0.4
    score T_REMOTE_IMAGE 1.0

    Edited by Mladen
  • Avatar
    Dominic

    Thank you again Mladen,

    I have removed the duplication.

    Best Regards.


Contact our support team


+61 (7) 5357 6605       support@atmail.com