Re: Flag mail from certain country codes.

Den 2012-04-08 22:14, joea skrev:
> I find some SPAM slips through un marked, mostly from certain country
> codes (in the senders email address/domain).

pastebin is hungry

> I was thinking of a regex to taste and paste (say add 5 to SPAM
> score), but don't really want to reinvent a wheel.   Or run over my
> own toes.

train bayes ham , bayes spam more with dovecot, dovecot-antispam

move the autolearn threshold lover than default so bayes do not say
bayes 00 to spam that is untrained

using dspam with succes here

> I did find a plug in or two,

link ?

> but these seem to rely on checking the
> IP of sender or relay.

default with relaycountry in spamassassin, but do you like results of

ip2cc 2.104.223.10

if you do not see it, then you need to build updated db self

there is a new relaycountry2 that do use geoip database, but imho this
is progressing work in sa 3.4.x

> Since my mail collects at a mail provider, I
> fetch(mail)  it and pass it on to a box running spamassassin, they
> might not work un-hacked, in any case.

make sure that trusted_networks is setup to include the host you
fetchmail from aswell as your own ips listed in ifconfig

hope sa 3.4.x will have rfc1918 hardcoded internal_networks /
trusted_networks, even if there is legit servers there it makes no point
check dnsbl on them

> Direction?

you deside :)