From 413f02d9c18c44e96148e8384c6e22753dd4f998 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A2u=20Cao?= Date: Mon, 17 Aug 2026 14:57:10 -0600 Subject: [PATCH] Fix commercial validity lists poisoning Bayes db, harden Bayes learning --- .../templates/spamassassin_local.cf.erb | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/site-cookbooks/kosmos_email/templates/spamassassin_local.cf.erb b/site-cookbooks/kosmos_email/templates/spamassassin_local.cf.erb index c196054..052a15c 100644 --- a/site-cookbooks/kosmos_email/templates/spamassassin_local.cf.erb +++ b/site-cookbooks/kosmos_email/templates/spamassassin_local.cf.erb @@ -16,6 +16,37 @@ whitelist_auth <%= @whitelist_auth %> # _CONTACTADDRESS_ in the report template) report_contact <%= @report_contact %> +########################################################################### +# Kosmos custom score overrides +# +# The Validity (Return Path / SenderScore) "certified sender" whitelists +# (RCVD_IN_VALIDITY_CERTIFIED, RCVD_IN_VALIDITY_SAFE) hand out up to -5.0 +# of credit to sending IPs. These lists are commercially gamed and +# routinely award -5.0 to IPs that are simultaneously listed on Spamhaus +# SBL-CSS, SpamCop, MSPIKE and Validity's own RPBL. Neutralise them. +########################################################################### +score RCVD_IN_VALIDITY_CERTIFIED 0 +score RCVD_IN_VALIDITY_SAFE 0 + +########################################################################### +# Bayes hardening +########################################################################### +use_bayes 1 +bayes_auto_learn 1 + +# Do not let Bayes learn from SpamAssassin's own result headers or from +# Authentication-Results, which leak signal about prior scoring runs. +bayes_ignore_header X-Spam-Flag +bayes_ignore_header X-Spam-Status +bayes_ignore_header X-Spam-Level +bayes_ignore_header X-Spam-Checker-Version +bayes_ignore_header Authentication-Results + +# Only learn ham when the message is clearly clean, and only learn spam +# when it is clearly spam. The defaults (0.1 / 6.0) let marginally-spam +# or marginally-ham messages poison the database. +bayes_auto_learn_threshold_nonspam -1.0 +bayes_auto_learn_threshold_spam 8.0 # Add *****SPAM***** to the Subject header of spam e-mails #