Dovecot Antispam

This page describes how I integrate my spam filter (dspam) into my IMAP server (dovecot) and the more generic plugin for dovecot I developed. More historic information is on the dovecot/dspam integration page.

Note that here is a way of achieving something similar with just existing infrastructure, namely the IMAP sieve plugin, but IMHO the plugin is (still) superior since it can report errors when problems occur and abort the mailbox COPY (move).

Rationale

We all want spam filtering, I want it on my server, so my webmail is already filtered. I get approximately 2500 spam mails per month, and many more that don't make it through my SMTP front lines. I use dspam because it has a much lower footprint than SpamAssassin, and also because it succeeds in catching almost all of my spam with virtually no false positives.

Additionally, most spam filters need training. In order to be able to train with as little overhead as possible, I want to simply be able to move false positives out of the spam folder and false negatives into it. This leads to the concept of integrating the spam retraining process into the IMAP server.

Even if I'm using dspam, the antispam plugin now has the concept of backends with different ways to call the spam filter retraining so it should be easy to adopt for other spam filters. In fact, there is a backend that simply sends the misclassified messages to two email addresses for reclassification, this is simple to use with existing setups.

Usage for end users

  • move mail into SPAM folder to classify as spam
  • move mail out of SPAM folder to classify as not spam

Backends

The plugin internally supports different backends. Please see the BACKENDS section in the man page for the full list of backends.

Code

The code to my plugin is available under the GNU GENERAL PUBLIC LICENSE Version 2.

To see it in gitweb, see http://git.sipsolutions.net/dovecot-antispam.git/, you can also have it generate a HEAD snapshot.

To check out the code, use

git clone http://git.sipsolutions.net/dovecot-antispam.git/

Using the plugin

For information on using the plugin please see the documentation in the source tree. The current man-page is at https://johannes.sipsolutions.net/files/antispam.html.

Other requirements

This project is a tool to train a mail classifier. It is absolutely necessary to also run the classifier, which is out of scope. Please try to understand exactly what this plugin does, and also what it does not do. Note that the classifier must be run before the email reaches dovecot, typically as part of the mail delivery process. The setup for this depends on the MDA you use.

Questions?

If you have any questions please send them to the dovecot mailing list: http://dovecot.org/cgi-bin/mailman/listinfo/dovecot.

If you need custom setup, development, installation support or similar send me an email to discuss a support contract.

Additional Tools

Along with the plugin, I use a script to automatically delete all seen mail in my SPAM folder that is older than three weeks. The script is also available. I invoke it from cron with

/usr/local/bin/cleanspam --seen --expunge 21

FAQ

The plugin isn't moving mail that was recognised as spam into the spam folder!

It's not supposed to, you need to set up external filtering using e.g. maildrop or procmail.

It segfaults with dovecot 1.1 (signal 11)

If you want to use dovecot 1.1, you need at least dovecot 1.1.2. Otherwise, 1.0 works fine.

I only get "signature not found" errors

You need to have your delivery process (say exim) add the dspam/crm/... signature to the email header. This is NOT handled by the plugin, it will not affect delivery at all.