Introduction to spam filtering

If your damtp account was set up after September 2005 or you use the Hermes system to store your email, then you have a much easier way to filter your spam and should not read any further on this page.

Spam filtering

Spam filtering for accounts set up before September 2005, for people who still store their email on the damtp mail system.

Email to DAMTP is now run through a spam detector (courtesy of the University Computing Service). All mail is tagged with a "spam score" which can be used to filter out email that seems to be spam.

In the header of each email message the string

	X-Cam-SpamScore:

ill be added, followed by a number of s's. The more s's added the more likely it is that your message is spam. To make use of this header put the following at the top of a .forward file in your home directory:

#Exim Filter << Do not remove

if $h_X-Cam-SpamScore
   contains ssssss then
        save mail/spam
        seen finish
endif

If you already have a .forward file in your home directory, then you may already have a line like

#Exim Filter << Do not remove

in the file (if you do not have such a line then see below). In this case you only need to add

if $h_X-Cam-SpamScore
   contains ssssss then
        save mail/spam
        seen finish
endif

underneath it (but before the rest of your filtering so that your spam mail gets dealt with before the rest of your filtering tests).

Some people prefer to keep their spam email outside of their mail folder to avoid it adding to their quota. In this case replace the line

	save mail/spam

with the destination for your spam mail eg

	save /data/sub/ab123/tmp/spam

and create a symlink from your mail folder to this destination. eg

	ln -s /data/sub/ab123/tmp/spam  mail/spam

Periodically you MUST read through the spam folder, or you WILL miss messages which have been incorrectly guessed to be spam. It is also useful to delete the spam messages saved there from time to time so they do not contribute too much towards your disk space usage.

After a while you may feel that not all your spam is being caught, in which case you may want to decrease the number of s's that your spam filter is checking for. Alternatively, you may find that too many messages which are not spam are being guessed as spam, in which case you can increase the amount of s's in the line "contains ssssss then". We recommend you start with 6-8 s's and then decide for yourself how many are appropriate for you.

How to read the spam folder

Reading your spam folder depends on what email software you use.

Pine: From the main menu select "L" to choose a folder.
Webmail: Select the spam folder from the Change To: list at the top right hand side.
ucbmail/mail/mailx: Use "mail -f +spam".

For users of other software, remember that the spam folder is kept in your mail directory which is normally in your Unix home directory. Windows users note that this is your samba directory.

I have a .forward file but it does not have a "`#Exim Filter`" line at the top

If you redirect your email elsewhere with your .forward file, e.g. by placing the forwarding address at the top of the file without using the

#Exim Filter

syntax, then in order to get spam checking also working you may need to change your personal email forwarding to use the following

if personal alias M.Name@damtp.ac.uk alias myn12@cam.ac.uk then
  seen deliver M.Name@remote.site
endif

or if you also want to keep a copy of the email on the DAMTP system

if personal alias M.Name@damtp.ac.uk alias myn12@cam.ac.uk then
  unseen deliver M.Name@remote.site
endif

A spam statistic

On Monday 16th February 2004 PPSW rejected 480,000 messages and accepted 390,000. 64,000 of the accepted messages scored 5 or more, and 9,000 were discarded because of virus infection.

Draw your own conclusions.

Extra information for the interested

DAMTP email goes through the PPSW mail switch (run by the University Computing Service). This switch adds extra Cambridge specific headers to the emails, which look like

X-Cam-ScannerAdmin: mail-scanner-support@ucs.ac.uk
X-Cam-AntiVirus: Not scanned
X-Cam-SpamDetails: not spam, SpamAssassin (score=5.1, required 10,
        GAPPY_SUBJECT, HTML_60_70, HTML_IMAGE_ONLY_02, HTML_MESSAGE,
        MIME_HTML_ONLY, PLING_PLING, REMOVE_PAGE, SUBJ_FREE_CAP)
X-Cam-SpamScore: sssss

The X-Cam-SpamDetails line can be a lot lot longer than the example above if the score is a much higher number. This number can go up to at least 46.3.

You will note a X-Cam-AntiVirus: header.

For more information about the anti-spam measures look at the Computing Service April 2003 Newsletter.

Some email from sites known to support spam is rejected using Spamhaus SBL, MAPS RBL+ and Spamhaus XBL (since the start of February 2004).

Please email any suggestions, corrections, broken links, or errors to itweb [itweb@damtp.cam.ac.uk]