On Fri, 17 Aug 2007, aag_uk wrote:
> I´ve noticed that some spam messages not marked as spam by spamassassin (the
> score is lower than the limit I´ve set: 5.0. Those emails usually have some
> hints that suggest they are probably spam: score about 4.6). These message
> are addressed to many people in my domain but the names before the email
> address are random. To explain it more clearly, for example, the recipient
> in the TO field is something like this: "John" <
user1@...>. Very
> ofter the CC field includes other recipients like: "Peter"
> <
user2@...>; "Mike" <
user3@...>; etc... The think is that
> the email recepients (user1, user2, user3,...) are real, they exist in my
> domain, but the names "Peter, John, Mike" have nothing to do with "user1,
> user2, user3", they are picked randomly. Wouldn´t be interesting to have a
> test that checks the "user name-email address" pairs according to some
> settings?
That's an interesting idea, but it
a) is probably going to be quite resource-intensive;
b) requires LDAP, NIS, etc., so that SpamAssassin can have a clue
about your accounts;
c) requires competent fuzzy matching so that, when a user sends mail
to "Chris St. Pierre <
stpierre@...>", it doesn't flag it
as spam because my "real name" is Christopher;
d) is prone to FPs, since its the clients who add that name, and it
could be literally _anything_ ("chris", "some guy", "", etc.) without
being spam; and
e) is fairly site-specific and would require a fair amount of
configuration.
It might be an interesting plugin, but I think that the kind of
scoring I'd be comfortable doing for a plugin like that -- very low --
wouldn't be worth the tradeoff in CPU time, network traffic, etc.
Chris St. Pierre
Unix Systems Administrator
Nebraska Wesleyan University
