9.18.5 Spam Package Configuration Examples

Ted's setup

From Ted Zlatanov <tzz@lifelogs.com>.

     ;; for gnus-registry-split-fancy-with-parent and spam autodetection
     ;; see gnus-registry.el for more information
     (gnus-registry-initialize)
     (spam-initialize)

     (setq
      spam-log-to-registry t     ; for spam autodetection
      spam-use-BBDB t
      spam-use-regex-headers t   ; catch X-Spam-Flag (SpamAssassin)
      ;; all groups with ‘spam’ in the name contain spam
      gnus-spam-newsgroup-contents
       '(("spam" gnus-group-spam-classification-spam))
      ;; see documentation for these
      spam-move-spam-nonspam-groups-only nil
      spam-mark-only-unseen-as-spam t
      spam-mark-ham-unread-before-move-from-spam-group t
      ;; understand what this does before you copy it to your own setup!
      ;; for nnimap you'll probably want to set nnimap-split-methods, see the manual
      nnimap-split-fancy '(|
                           ;; trace references to parents and put in their group
                           (: gnus-registry-split-fancy-with-parent)
                           ;; this will catch server-side SpamAssassin tags
                           (: spam-split 'spam-use-regex-headers)
                           (any "ding" "ding")
                           ;; note that spam by default will go to ‘spam’
                           (: spam-split)
                           ;; default mailbox
                           "mail"))

     ;; my parameters, set with G p

     ;; all nnml groups, and all nnimap groups except
     ;; ‘nnimap+mail.lifelogs.com:train’ and
     ;; ‘nnimap+mail.lifelogs.com:spam’: any spam goes to nnimap training,
     ;; because it must have been detected manually

     ((spam-process-destination . "nnimap+mail.lifelogs.com:train"))

     ;; all NNTP groups
     ;; autodetect spam with the blacklist and ham with the BBDB
     ((spam-autodetect-methods spam-use-blacklist spam-use-BBDB)
     ;; send all spam to the training group
      (spam-process-destination . "nnimap+mail.lifelogs.com:train"))

     ;; only some NNTP groups, where I want to autodetect spam
     ((spam-autodetect . t))

     ;; my nnimap ‘nnimap+mail.lifelogs.com:spam’ group

     ;; this is a spam group
     ((spam-contents gnus-group-spam-classification-spam)

      ;; any spam (which happens when I enter for all unseen messages,
      ;; because of the gnus-spam-newsgroup-contents setting above), goes to
      ;; ‘nnimap+mail.lifelogs.com:train’ unless I mark it as ham

      (spam-process-destination "nnimap+mail.lifelogs.com:train")

      ;; any ham goes to my ‘nnimap+mail.lifelogs.com:mail’ folder, but
      ;; also to my ‘nnimap+mail.lifelogs.com:trainham’ folder for training

      (ham-process-destination "nnimap+mail.lifelogs.com:mail"
                               "nnimap+mail.lifelogs.com:trainham")
      ;; in this group, only ‘!’ marks are ham
      (ham-marks
       (gnus-ticked-mark))
      ;; remembers senders in the blacklist on the way out---this is
      ;; definitely not needed, it just makes me feel better
      (spam-process (gnus-group-spam-exit-processor-blacklist)))

     ;; Later, on the IMAP server I use the ‘train’ group for training
     ;; SpamAssassin to recognize spam, and the ‘trainham’ group fora
     ;; recognizing ham---but Gnus has nothing to do with it.

Using spam.el on an IMAP server with a statistical filter on the server

From Reiner Steib <reiner.steib@gmx.de>.

My provider has set up bogofilter (in combination with DCC) on the mail server (IMAP). Recognized spam goes to ‘spam.detected’, the rest goes through the normal filter rules, i.e. to ‘some.folder’ or to ‘INBOX’. Training on false positives or negatives is done by copying or moving the article to ‘training.ham’ or ‘training.spam’ respectively. A cron job on the server feeds those to bogofilter with the suitable ham or spam options and deletes them from the ‘training.ham’ and ‘training.spam’ folders.

With the following entries in gnus-parameters, spam.el does most of the job for me:

        ("nnimap:spam\\.detected"
         (gnus-article-sort-functions '(gnus-article-sort-by-chars))
         (ham-process-destination "nnimap:INBOX" "nnimap:training.ham")
         (spam-contents gnus-group-spam-classification-spam))
        ("nnimap:\\(INBOX\\|other-folders\\)"
         (spam-process-destination . "nnimap:training.spam")
         (spam-contents gnus-group-spam-classification-ham))

• The Spam folder:

  In the folder ‘spam.detected’, I have to check for false positives (i.e. legitimate mails, that were wrongly judged as spam by bogofilter or DCC).

  Because of the gnus-group-spam-classification-spam entry, all messages are marked as spam (with $). When I find a false positive, I mark the message with some other ham mark (ham-marks, Spam and Ham Processors). On group exit, those messages are copied to both groups, ‘INBOX’ (where I want to have the article) and ‘training.ham’ (for training bogofilter) and deleted from the ‘spam.detected’ folder.

  The gnus-article-sort-by-chars entry simplifies detection of false positives for me. I receive lots of worms (sweN, ...), that all have a similar size. Grouping them by size (i.e. chars) makes finding other false positives easier. (Of course worms aren't spam (UCE, UBE) strictly speaking. Anyhow, bogofilter is an excellent tool for filtering those unwanted mails for me.)

• Ham folders:

  In my ham folders, I just hit S x (gnus-summary-mark-as-spam) whenever I see an unrecognized spam mail (false negative). On group exit, those messages are moved to ‘training.spam’.

Reporting spam articles in Gmane groups with spam-report.el

From Reiner Steib <reiner.steib@gmx.de>.

With following entry in gnus-parameters, S x (gnus-summary-mark-as-spam) marks articles in gmane.* groups as spam and reports the to Gmane at group exit:

        ("^gmane\\."
         (spam-process (gnus-group-spam-exit-processor-report-gmane)))

Additionally, I use (setq spam-report-gmane-use-article-number nil) because I don't read the groups directly from news.gmane.org, but through my local news server (leafnode). I.e. the article numbers are not the same as on news.gmane.org, thus spam-report.el has to check the X-Report-Spam header to find the correct number.