Catching Spam on AAS Mail Servers

Arts & Sciences has implemented a tool to allow users to manage the influx of spam messages in their e-mail: SpamAssassin.  SpamAssassin is in operation for all non-forwarded e-mail* delivered to addresses ending in @aas.duke.edu, @pps.duke.edu, @asdean.duke.edu and @pmac.duke.edu.

SpamAssassin does not block spam messages.  Instead, it checks each incoming message for characteristics of spam and appends the resulting "score" to each message’s header.  The "score" is simply a sum of the number of spam-like characteristics the message includes.

By default, messages with a "score" of nine or higher will be marked as spam, and the text "*****SPAM*****" will be inserted at the beginning of the subject line of the message.

Users are free to customize:

1) What "score" constitutes a message being marked as spam; and
2) What to do with the messages once they are marked as spam.

For more information on customizing your settings, see How to Modify SpamAssassin Preferences, contact your departmental computer support professional or call the A&S Help Desk at 660-3186.

*Please note that SpamAssassin works on messages as they are delivered.  Users who forward their mail to other accounts (such as ACPUB) will not be able to use SpamAssassin’s functionality.  Some basic blocking does exist on the ACPUB server, denying mail from IP addresses, hostnames, and usernames that are repeat spammers.  Users who have fullname Duke aliases (first.last@duke.edu) forwarded to their AAS accounts will get both SpamAssassin filtering AND the ACPUB spam filtering.

What "Score" Constitutes a Message Being Marked as Spam?

A&S Computing has set "9" as the default "score" or number of spam-like characteristics which must be found in an e-mail message in order for it be marked as spam.  This score identifies a fair percentage of spam while minimizing the misclassification of legitimate e-mail as spam.

Users are free to customize the number at which an e-mail is marked as spam.  The lower the number, the greater the chance that legitimate e-mail will be marked as spam.  The higher the number, the greater the chance that spam will remain unmarked.

Users may also prevent mail from a particular address from being marked as spam by adding the address to a "whitelist." If an address is on the user's whitelist, mail from that address will not be marked as spam even if it receives a score that would classify the message as spam.

What to Do with Messages Marked as Spam?

Users have several options of what to do with e-mail messages marked as spam.

1. Manual review and deletion: The insertion of *****SPAM***** at the beginning of the subject line makes it easy to peruse and delete marked e-mails.  If e-mail has been incorrectly marked, it is easy to remove the inserted text from the subject line when replying or forwarding the message along.  In fact, if you don’t, the message may be incorrectly filtered from the recipient’s in-box!

2. Automated filtering: It is possible to configure your e-mail client to take specific action when a message containing *****SPAM***** is received.  For example, you may instruct your e-mail client to delete the messages and copy them to a special Spam folder for later review.

Instructions for how to set up filtering vary according to the e-mail client. See:

Filtering email in Netscape, Pine, Eudora and Outlook
Filtering email in Mulberry (PDF 616 KB: see "Filtering Messages" p. 19)
or ask for assistance from your local computer support staff. You may also call the A&S Help Desk at 660-3186.

Spam-Like Characteristics and the "Score"

Spam-like characteristics include such things as

• lines of text in all caps,
• undisclosed recipients and
• known spam originating addresses.

If messages are being inappropriately being marked as spam, or too much spam is getting through undetected, it is possible for individuals to increase or decrease the sensitivity of their SpamAssassin filter by modifying their SpamAssassin preferences.