Re: why not doing a test that checks "name"-<email address> pairs

On Fri, 17 Aug 2007, aag_uk wrote:

> I´ve noticed that some spam messages not marked as spam by spamassassin (the
> score is lower than the limit I´ve set: 5.0. Those emails usually have some
> hints that suggest they are probably spam: score about 4.6). These message
> are addressed to many people in my domain but the names before the email
> address are random. To explain it more clearly, for example, the recipient
> in the TO field is something like this: "John" <user1@mydomain.com>. Very
> ofter the CC field includes other recipients like: "Peter"
> <user2@mydomain.com>; "Mike" <user3@mydomain.com>; etc... The think is that
> the email recepients (user1, user2, user3,...) are real, they exist in my
> domain, but the names "Peter, John, Mike" have nothing to do with "user1,
> user2, user3", they are picked randomly. Wouldn´t be interesting to have a
> test that checks the "user name-email address" pairs according to some
> settings?

That's an interesting idea, but it

1. is probably going to be quite resource-intensive;
2. requires LDAP, NIS, etc., so that SpamAssassin can have a clue about your accounts;
3. requires competent fuzzy matching so that, when a user sends mail to "Chris St. Pierre <stpierre@nebrwesleyan.edu>", it doesn't flag it as spam because my "real name" is Christopher;
4. is prone to FPs, since its the clients who add that name, and it could be literally _anything_ ("chris", "some guy", "", etc.) without being spam; and
5. is fairly site-specific and would require a fair amount of configuration.

It might be an interesting plugin, but I think that the kind of scoring I'd be comfortable doing for a plugin like that -- very low -- wouldn't be worth the tradeoff in CPU time, network traffic, etc.

Chris St. Pierre
Unix Systems Administrator
Nebraska Wesleyan University Received on Fri Aug 17 16:59:14 2007