Support customization of spamassassin

[chris13524]

During setup, we could add include /home/user-data/mail/spamassassin/custom.cf to /etc/spamassassin/local.cf. However, because the setup script could be run several times, we would want to ensure that the file wasn't included more than once.

Does a custom configuration file already exist?

[tbhi]

I put my customisations in /etc/spamassassin/local2.cf

[n0doubt]

Bump on this issue

I often expect emails from smaller networks and they get blackholed and would really like at least a little whitelist by domain field in the admin control panel.

[n0doubt]

@stan3 just curious, what kind of customizations do you have/recommend?

[tbhi]

Mostly trying different blocklists. Bit messy and needs tweaking (currently mailchimp is getting flagged)

score RCVD_IN_SORBS_SPAM 0

header DNS_FROM_SORBS_SPAM      eval:check_rbl('sorbsspam', 'spam.dnsbl.sorbs.net.')
describe DNS_FROM_SORBS_SPAM    sender in sorbs spam
tflags DNS_FROM_SORBS_SPAM      net
score DNS_FROM_SORBS_SPAM 0

header DNS_FROM_SPAMCANNIBAL      eval:check_rbl('spamcannible', 'bl.spamcannibal.org.')
describe DNS_FROM_SPAMCANNIBAL    sender listed in bl.spamcannibal.org
tflags DNS_FROM_SPAMCANNIBAL      net
score DNS_FROM_SPAMCANNIBAL 0

header DNS_FROM_LASHBACK      eval:check_rbl('lashback', 'ubl.unsubscore.com.')
describe DNS_FROM_LASHBACK    sender listed in ubl.unsubscore.com
tflags DNS_FROM_LASHBACK      net
score DNS_FROM_LASHBACK 0

meta DNS_RBL  ( DNS_FROM_SORBS_SPAM || DNS_FROM_SPAMCANNIBAL || DNS_FROM_LASHBACK )
describe DNS_RBL  sender listed in 1 or more blacklists
score DNS_RBL  4.0

header DNS_FROM_EMAILBASURA      eval:check_rbl('EMAILBASURA', 'bl.emailbasura.org.')
describe DNS_FROM_EMAILBASURA    sender listed in bl.emailbasura.org
tflags DNS_FROM_EMAILBASURA      net
score DNS_FROM_EMAILBASURA 4.0

header RCVD_IN_FABEL rbleval:check_rbl('fabel', 'spamsources.fabel.dk.')
describe RCVD_IN_FABEL Received via a relay in spamsources.fabel.dk
tflags RCVD_IN_FABEL net
score  RCVD_IN_FABEL 4

header DNS_FROM_ZEROSPAM      eval:check_rbl('0spam', '0spam.fusionzero.com.')
describe DNS_FROM_ZEROSPAM    sender listed in 0spam.fusionzero.com
tflags DNS_FROM_ZEROSPAM      net
score DNS_FROM_ZEROSPAM 4

header DNS_FROM_ZAPBL      eval:check_rbl('zapbl', 'dnsbl.zapbl.net.')
describe DNS_FROM_ZAPBL    sender listed in dnsbl.zapbl.net.
tflags DNS_FROM_ZAPBL      net
score DNS_FROM_ZAPBL 4

header DNS_FROM_SUOMISPAM      eval:check_rbl('suomispam', 'bl.suomispam.net.')
describe DNS_FROM_SUOMISPAM    sender listed in bl.suomispam.net.
tflags DNS_FROM_SUOMISPAM      net
score DNS_FROM_SUOMISPAM 4

header DNS_FROM_UCEPROTECT2      eval:check_rbl('uceprotect2', 'dnsbl-2.uceprotect.net.')
describe DNS_FROM_UCEPROTECT2    sender listed in dnsbl-2.uceprotect.net.
tflags DNS_FROM_UCEPROTECT2      net
score DNS_FROM_UCEPROTECT2 2

# not reliable
score RCVD_IN_MSPIKE_H2 0.0
score RCVD_IN_MSPIKE_H3 0.0
score RCVD_IN_MSPIKE_H4 0.0
score RCVD_IN_MSPIKE_H5 0.0

score RCVD_IN_MSPIKE_BL 4

# as so many RBL pick them up (gmail, aol)
score FREEMAIL_FROM -4.0
score RDNS_DYNAMIC 5.0
# seems like the lookup is sometimes unreliable
score RDNS_NONE 2.0
score URIBL_DBL_ABUSE_SPAM 5.0
score RCVD_IN_BRBL_LASTEXT 5.0
score URI_WP_HACKED_2 5.0
score ALL_TRUSTED -15.0
score RCVD_IN_BL_SPAMCOP_NET 4.0
# adjusted to not max out with MIME_HTML_ONLY BODY at 1.1
# further reduced due to hit rate on legitament mails (from 3.8)
score LOTS_OF_MONEY 0.1
score PYZOR_CHECK 3.0
score MONEY_FRAUD_8 2.0
score TVD_PH_BODY_ACCOUNTS_PRE 2.0
# seems to be quite common now :/
score MIME_HTML_ONLY 0.3

whitelist_from *@getsimpleform.com
whitelist_from *@owasp.org

# seeing false positives because of the autolearning
use_bayes 0