FAQ & Knowledge Base

Welcome to our Knowledge Base. Search or browse through the topics below to find answers to your questions.

Categories: Exchange Server Toolbox | Show all categories

Custom SpamAssassin Ruels

Question / Problem

How can I improve the spam detection rate of the Exchange Server Toolbox's SpamAssassin?

Answer / Solution

Blacklist/Whitelist

You can add email addresses and domains to your blacklist or whitelist by navigation to Spam | Black-/Whitelist. Add known spam domains to the blacklist or trusted domains to the whitelist for a better spam detection. Because of spoofing, it is not advised to add your own email addresses to the whitelist.

If a spam sender is on the whitelist the spam report will contain the line

"-100 USER_IN_WELCOMELIST"

and the spam score will be around -100. You can find the spam score in the email header under "x-spam-report".

Blacklist for words

You can add rules for emails with specific words by using the conditions "Mail contains text" and/or "Subject contains text". You can choose between different actions for these emails:

In the Incoming (receive) rules you can choose the action "Refuse mail". The email will be refused and the sender will be notified. You can also choose "Do not deliver mail" which will result in the email being discarded.

In the Incoming (accepted) rules you can also choose "Do not deliver mail". Alternatively, you can choose "Add text to the message subject" to mark the email as spam.

You can learn about the differences between Incoming (receive) and (accepted) in our Knowledge Base: JAM Software - FAQs & Knowledge Base (jam-software.com)

User defined Rules

You can also navigate to Spam | Custom Config to create custom SpamAssassin rules instead if you prefer adding to the spam score rather than always marking these emails as spam. Refer to this website to see how to create custom rules: https://cwiki.apache.org/confluence/display/SPAMASSASSIN/WritingRules

URIBL

If you receive an unusual amount of spam emails, please check the email header and review the "x-spam-report" entry. If this entry contains

URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.  See https://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information.

then please follow the directions on this website or in our Knowledge Base: JAM Software - FAQs & Knowledge Base (jam-software.com) This step noticeably improves the spam detection rate.

Change existing SpamAssassin rules

If you want to change the spam score of existing SpamAssassin rules you can follow the directions on this website: https://cwiki.apache.org/confluence/display/SPAMASSASSIN/AdjustRuleScore
For this you can also use the Exchange Server Toolbox Custom Config Editor. Adding the changed rule into Custom Config Editor will overwrite the existing rule.