Spam scrore in exim

#1

What is SPAM_SCORE = 50 in /etc/exim4/exim4.conf.template for?

Because in mail headers:
Content analysis details: (xxx points, 5.0 required)

But if I set (uncomment) required_score 15.0 in in /etc/spamassassin/local.cf then it applies.
So what is the one in exim conf one?

#2

EXIM’s spam score is the same, just without the decimal point in the middle.

So EXIM 50 is SPAMX 5.0

2 Likes
#3

So which one overrides if I set both:
/etc/spamassassin/local.cf or exim’s one?

#4 
/etc/spamassassin/local.cf

is only being used when spamassassin runs as standalone.

#5

What do you mean “standalone”? I sould not uncomment spam score in it?

#6

Nope, you can just leave it alone, everything is being taken care of in exim config.

/etc/exim4/exim4.conf.template
#7

If I only set score in exim4.conf.template, it does not apply in mail headers (score is still 5),
But if I set score in spamassaian.conf then it applies.

#8

are you using the hestiacp shipped exim config?

#9

Yes brand new fresh clean install :slight_smile:

#10

so without changing anything, can you send yourself a email and look into the header and check if spam-x is included?

#11

Ok in mail headers:

X-Spam-Score: 61
X-Spam-Bar: ++++++
X-Spam-Report: ....

…

Content analysis details: (6.1 points, 15.0 required)
X-Spam-Status: Yes
X-ACL-Warn: SpamAssassin detected spam

I am a bit confused. What is SPAM_SCORE = 50 in /etc/exim4/exim4.conf.template for and also one in /etc/spamassassin/local.cf when uncommented required_score 5.0 ?

#12 
X-Spam-Score: 61

This will tell you that spamassassin is actually being used and the score in total is 6.1 or for exim 61.

We could now tell EXIM to process this info, for example move the file into the SPAM folder or just rewrite the subject.

I for example have a rewrite subject enabled with my exim setup.

In /etc/exim4/exim4.conf.template , if not already there, add above line log_selector = ...

system_filter = /etc/exim4/system.filter
system_filter_user = Debian-exim

in /etc/exim4/system.filter add

if $header_X-Spam-Score matches "^[^-0][0-9\.]+" and ${sg{$header_X-Spam-Score:}{\\.}{}} is above 50
then
headers add "Old-Subject: $h_subject"
headers remove "Subject"
headers add "Subject: *** POSSIBLE SPAM *** $h_old-subject"
headers remove "Old-Subject"
endif

and restart exim

systemctl restart exim4.service

This will add to the beginning of the subject *** POSSIBLE SPAM *** if the score is 50 or above (5.0 or above)

I hope this helped.

-Dennis

1 Like
#13

Thank you. Only thing I can not figure out is; setting score threshold.
To set threshold , I need to uncomment and edit /etc/spamassassin/local.cf NOT /etc/exim4/exim4.conf.template which does not apply.

#14

you would set the threshold as score in /etc/exim4/exim4.conf.template

SPAM_SCORE = 50 (this is 5.0 points)

this is the only location you need to change.

#15

So it does not apply. I set it to 150 in exim conf and restart service. But mail headers still shows:
Content analysis details: (2.2 points, 5.0 required)

#16

okay. but this should not matter as exim is looking at the total points and then takes action, its not looking at the required by spamassasin as exim is in charge of what its doing at what points.

#17

Fine but I need to know where to set point to mark mail as spam or not.

#18

this is where you set the spam point limit.

SPAM_SCORE

whatever the SPAM_SCORE is set to this and higher it will be marked as spam.

#19

Let me explain the mail flow for you, i hope this will make it easier to understand.

Mail is being received by Exim.

Exim checks if spamassiasin is enabled for this mail domain and sends it over to spamassassin.

.ifdef SPAMASSASSIN
spamd_address = 127.0.0.1 783
.endif

Spamassassin checks the email and rates it with points and replies with points back to Exim.
Exim then checks if points received from spamassassin are below or higher than the set SPAM_SCORE.

.ifdef SPAMASSASSIN
  warn   !authenticated = *
         hosts          = !+relay_from_hosts
         condition      = ${if < {$message_size}{1024K}}
         condition      = ${if eq{$acl_m1}{yes}{yes}{no}}
         spam           = debian-spamd:true/defer_ok
         add_header     = X-Spam-Score: $spam_score_int
         add_header     = X-Spam-Bar: $spam_bar
         add_header     = X-Spam-Report: $spam_report
         set acl_m2     = $spam_score_int

If received spam higher or same as SPAM_SCORE it adds X-Spam-Status: Yes to the header.

  warn   condition      = ${if !eq{$acl_m2}{} {yes}{no}}
         condition      = ${if >{$acl_m2}{SPAM_SCORE} {yes}{no}}
         add_header     = X-Spam-Status: Yes
         message        = SpamAssassin detected spam (from $sender_address to $recipients).
.endif
2 Likes
#20

Then I say I can not change SPAM_SCORE threshold in exim. Can only change it in SPAMASSASSIN. :slight_smile: Can you test it yourself?