>> Hi,=20
>> I=C2=B4m pretty new to SpamAssassin and maybe what I am saying is nonsense =
>> or
>> somebody else has suggested this, or the test already exists but I don=C2=
>> =B4t
>> know how to configure it, anyway here is my question.
>> I=C2=B4ve noticed that some spam messages not marked as spam by spamassassi=
>> n (the
>> score is lower than the limit I=C2=B4ve set: 5.0. Those emails usually have=
>> some
>> hints that suggest they are probably spam: score about 4.6). These message
>> are addressed to many people in my domain but the names before the email
>> address are random. To explain it more clearly, for example, the recipient
>> in the TO field is something like this: "John" . Very
>> ofter the CC field includes other recipients like: "Peter"
>> ; "Mike" ; etc... The think is that
>> the email recepients (user1, user2, user3,...) are real, they exist in my
>> domain, but the names "Peter, John, Mike" have nothing to do with "user1,
>> user2, user3", they are picked randomly. Wouldn=C2=B4t be interesting to ha=
>> ve a
>> test that checks the "user name-email address" pairs according to some
>> settings?=20
>> Regards,
>> Alberto.


you can do quite a few things to trap mail that probably is rubbish .... but it may be extra
I use some prefilter in line with forbidden attachment and virus scanning
but it could probably be written as a _personal_ plugin.
I like mail sent to just the plain email address or in "user" format written exactly
as I spell it. I collect mail from some other mailboxes, so of course the rule must know
about these other addresses as well.
For mail sent to my primary address (at a big isp) I dont like to see another address in the
To or Cc
The one that really caused work: I dont like mails where my address does not appear in
either To or Cc, unless the sender appears in a whitelist. You need to add mailing lists,
monthly password reminders from mailing lists, sourceforge addresses, whatnot...

Wolfgang Hamann