Re: SpamAssassin and Korean email

[Joe St Sauver <joe () OREGON UOREGON EDU>]

Hi Marty,

#Has anyone who uses SpamAssassin experienced any difficulties in
#delivering 

Delivering, or accepting? I assume you mean accepting...

#mail that originates from Korean (kr) mail systems, or is
#composed in the Korean language? Or both?

What version of SpamAssassin are you using? For the sake of discussion,
I'll assume you're running the current version, e.g., 3.3.x

If you look at http://spamassassin.apache.org/tests_3_3_x.html you can
see the tests that are performed by default, and their weights; 
grep'ing that page, the one rule that mentions Korea is:

   Subject: contacts Korean unsolicited email tag

however that's the *only* rule that explicitly calls out anything related to
Korea or Hangul content (at least as far as I could see).

Naturally, incoming mail may also be upscored as a result of things like
listings in the Spamhaus SBL, XBL or PBL, or URLs in the SURBL blocklist, 
etc. It may be that the user is simply trying to send from a host that's
listed in the SBL/XBL/PBL, or is mentioning a SURBL'd domain name in their
mail, or something of the sort. 

What rules are being triggered for these particular messages? 

Are you currently analyzing the system's SpamAssassin logs at all? (see
http://wiki.apache.org/spamassassin/StatsAndAnalyzers ) Anything 
looking abnormal in the logs?

#We have our default server side threshold set at 8. Anything over that
#is discarded prior to delivery to the recipient.

I think eight may be, if anything, somewhat high. (The normal default 
is five.)

Remember, that one single number really determines the relative extent 
to which you're willing to accept false negatives (spam gets delivered 
as legitimate mail) vs. false positives (real mail gets mistakenly blocked). 
While setting that value to 8 will decrease the number of false positives, 
that setting will increase the number of false negatives. 

No way to short circuit that push-me/pull-you tension, unfortunately. 

#We have a faculty member who is convinced that their mail with Korean
#correspondents is running afoul of this server side value and is
#lobbying for an increase. This would, of course, impact the entire campus.

Would it be acceptable for you to opt this user out of your default
spam filtering, thereby allowing him/her to do their own? (for example,
see http://wiki.apache.org/spamassassin/AllSpamToFiltering )

Obviously they'd see more real spam, as well as their missing 
correspondent's mail at that point, but they could then manage that with 
some other tool, if they wanted to do so.

Alternatively, perhaps you want to try whitelisting the correspondent's
domain? If they're coming from a domain that's not actively hammering
you, that might also resolve the issue for you and your user....

Many users may also find it helpful to have several accounts, one that
may be with you, and one or more others that may be with a free webemail
provider, or a commercial ISP (such as whatever broadband provider they
may use at home). Can the correspondent get through to them via one of
those other potential avenues?

Hope these ideas at least give you fodder for a conversation with your
user.

Regards,

Joe