SpamAssassin issue resolved
#31 Henry, Sunday, 03 January 2010 1:07 AM (Category: Email)
(Tags: spamassassin)

I searched online for the SpamAssassin problem I was having. I was not alone. There is a date test that looks for dates "grossly in the future" and triggers if the date is past 2010. This started being triggered on all emails once 1st January 2010 came along, and added about 3 points to the spam score. This was enough to tip a couple of emails over my threshold and turn them into false positives.

Here's the rule that was causing the problem:

FH_DATE_PAST_20XX: Date =~ /20[1-9][0-9]/

and the description is:

The date is grossly in the future.

There are two suggestions to fix the problem. First, turn the test off by adding this line to /etc/mail/spamassassin/local.cf:

score FH_DATE_PAST_20XX 0.0

Or push the problem ten years into the future by changing the file /usr/share/spamassassin/72_active.cf so that the rule is now:

Date =~ /20[2-9][0-9]/

SpamAssassin conducts a whole range of date tests, and this is just one of them. I looked through my test batch of spam and realised what it is trying to achieve. One trick that spammers use is to set the date of the spam email way in the future, so when you view your email (usually in reverse chronological order), that spam email is always jammed at the top and in your face because it's set to 2030 or 2050 or something. This test helps eliminate those gross abuses, so I can see that it is a useful test to have and I would rather not do without it.

Therefore I opted to use the second solution and still look for grossly in the future dates, which now means anything past 2020.

To make the change take effect, I restarted SpamAssassin with:

/etc/rc.d/rc.spamassassin restart

That's specific to Slackware. Other distributions will differ.

The only emails affected were ones that Anne sent from iPhoto to herself locally. They were the only false positives, and she has already worked around the problem by using a description and not just the filename.

0 comments