Latest revision as of 10:51, 18 December 2023

This page will outline the main spam checking systems we have which apply to incoming email we manage for our customer domains. This is not an exhaustive list of checks and processes.

Spam detection

We employ various techniques to reduce the amount of spam email we accept for domains that we host email services for.

Initial connection - Block-listed IP addresses

One of our first line of defences is using the Spamhaus block lists to deny access from IP addresses that are listed by Spamhaus.

Two Spam Engines

Since October 2023 we use two spam checking engines: (previous to this we only used Spamassassin)

Spamassassin
Rspamd.

Both of these will assign a 'spam score' to the message. We will then use the higher score to classify a message as spam or not.

Spam score options

Once a message has been processed by the spam engines the message will then be subject to one of three options:

Non-spam - accept
Medium-scoring Spam - accept, but marked with ****SPAM:<score>**** to the subject, and saved to the spam folder (unless the mailbox is using Sieve filtering)
High=scoring spam - rejected if possible, otherwise handled as per medium-scoring Spam

The score at which a messages is marked as spam or rejected can be set on the Control Pages on a per-Mailbox or per-Domain basis. The default score to mark as spam is 5, and to reject is 20.

Headers

We add various extra headers to email regarding the Spamassassin and Rspamd scores and reports.

Here are some examples:

Header	Information	example
X-Spam-Score	The spam score	2.1
X-AA-Spam-Rspamd-Score	The spam score from Rspamd	2.1
X-AA-Spamassassin-Score	The spam score from Spamassassin	2.0
X-AA-Spam-Engine-Used	Which spam checking engine we used to classify this message	Rspamd or Spamassassin
X-Spam-Score-Int	The spam score multiplied by ten, as an integer value	21
X-Spam-Bar	The spam score represented by +'s. One for each point. Negative scores represented by -'s. Very small scores by /.	++
X-Spam-Flag	Whether the message is classed as spam or not	YES or NO
X-Spam-Report	The list of rules that were used that made up the spam score
X-Spam-Report-Secondary	The list of rules from the other spam checker we use

@@ Line 15: / Line 15: @@
 *Rspamd.
-Both of these will assign a 'spam score' to the message. We will then use the highest score to classify a message as spam or not.
+Both of these will assign a 'spam score' to the message. We will then use the higher score to classify a message as spam or not.
 ===Spam score options===
 Once a message has been processed by the spam engines the message will then be subject to one of three options:
 * Non-spam - accept
-* Medium-scoring Spam - accept, but marked with ****SPAM <score>**** to the subject, and saved to the spam folder
+* Medium-scoring Spam - accept, but marked with ****SPAM:<score>**** to the subject, and saved to the spam folder (unless the mailbox is using Sieve filtering)
-* High=scoring spam - rejected
+* High=scoring spam - rejected if possible, otherwise handled as per medium-scoring Spam
 The score at which a messages is marked as spam or rejected can be set on the Control Pages on a per-Mailbox or per-Domain basis. The default score to mark as spam is 5, and to reject is 20.
@@ Line 59: / Line 59: @@
 | The spam score represented by +'s. One for each point.  Negative scores represented by -'s.  Very small scores by /.
 | ++
+|-
+| X-Spam-Flag
+| Whether the message is classed as spam or not
+| YES or NO
 |-
 | X-Spam-Report